joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dfe7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x482ad0], edi
mov esi, ecx
mov ebx, 0x42fb94
je 0x41e05f
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add esi, 0x124
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
call fcn.0041f0d8
mov eax, dword [esi]
mov ecx, esi
dec eax
push eax
call fcn.0041f1a9
cmp al, 0x5c
jne 0x41e08d
mov eax, dword [esi]
push 1
dec eax
mov ecx, esi
push eax
call fcn.0041f56f
jmp 0x41e08d
add esi, 0x124
push 0x482b90
mov ecx, esi
call fcn.0041f146
push 1
push edi
push ebx
mov ecx, esi
call fcn.0041f9a1
push eax
push edi
mov ecx, esi
call fcn.0041fe73
push eax
mov ecx, esi
call fcn.0041f146
cmp dword [0x482ad0], 0
je 0x41e12b
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
lea ecx, [ebp - 0xc]
push eax
call fcn.0041efa5
push 1
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.0041f9a1
cmp eax, 0xffffffff
je 0x41e123
mov ecx, dword [ebp - 0xc]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.0041f56f
push 1
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.0041f9a1
cmp eax, 0xffffffff
je 0x41e123
mov ecx, dword [ebp - 0xc]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.0041f56f
lea eax, [ebp - 0xc]
mov ecx, 0x482ae8
push eax
call fcn.0041f146
lea ecx, [ebp - 0xc]
jmp 0x41e1e9
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [ebp - 0x110], 0
je 0x41e1ee
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x111], 0x5c
je 0x41e186
lea eax, [ebp - 0x110]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [ebp - 0xc]
and esi, 0x7fffffff
call fcn.0041ef35
push 0x432518
lea ecx, [ebp - 0xc]
call fcn.0041f0d8
mov eax, esi
inc esi
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xc]
push str._sinst_d
push eax
call fcn.0041f62d
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.0041ff07
push eax
call fcn.0040f27e
test al, al
pop ecx
jne 0x41e19c
lea eax, [ebp - 0xc]
mov ecx, 0x482ae8
push eax
call fcn.0041f146
lea ecx, [ebp - 0xc]
call fcn.0041f06b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e43f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea esi, [ecx + 0x188]
xor ebx, ebx
push edi
mov ecx, dword [esi]
cmp ecx, ebx
je 0x41e45c
push ebx
call fcn.00407f13
mov dword [esi], ebx
push dword [0x482604]
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [0x482c40], ebx
je 0x41e49f
cmp byte [0x48376d], 0
je 0x41e483
push ebx
call dword [0x482be4]
pop ecx
cmp byte [0x48376c], 0
je 0x41e495
push 1
call dword [0x482be4]
pop ecx
mov ecx, 0x482be0
call fcn.00421e20
mov ecx, 0x482750
call fcn.0041ee9d
cmp byte [ebp + 8], 0
je 0x41e4c5
mov eax, dword [0x48374c]
cmp eax, ebx
je 0x41e4c5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x48374c], ebx
cmp dword [0x482c54], ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 8], ebx
jle 0x41e4fe
xor edi, edi
mov eax, dword [0x482c50]
cmp dword [edi + eax], ebx
lea ecx, [edi + eax]
jbe 0x41e4ed
call fcn.0041ff07
push eax
call esi
inc dword [ebp + 8]
add edi, 0xc
mov eax, dword [ebp + 8]
cmp eax, dword [0x482c54]
jl 0x41e4d8
cmp dword [0x4829dc], ebx
mov dword [ebp + 8], ebx
mov edi, 0x4829d0
jle 0x41e548
push dword [ebp + 8]
mov ecx, edi
call fcn.00421fff
mov ebx, eax
lea ecx, [ebx + 4]
call fcn.0041ff07
push eax
call esi
test ebx, ebx
je 0x41e538
lea ecx, [ebx + 4]
call fcn.0041f06b
push ebx
call fcn.00428bce
pop ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [0x4829dc]
jl 0x41e50e
xor ebx, ebx
mov ecx, edi
call fcn.004220c0
lea ecx, [ebp - 0x10]
call fcn.0041ef35
mov dword [ebp - 4], ebx
push ebx
mov edi, 0x482a20
mov ecx, edi
call fcn.0041fb98
test al, al
je 0x41e59f
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
inc ebx
call fcn.0041faf5
test bl, 1
je 0x41e58f
lea ecx, [ebp - 0x10]
call fcn.0041ff07
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
lea ecx, [ebp - 0x10]
call fcn.0041ff07
push eax
call esi
push dword [ebp - 4]
jmp 0x41e560
push 0x432518
mov ecx, edi
call fcn.0041f0d8
mov ecx, 0x4823ec
call fcn.0041ff07
push eax
call esi
mov ecx, 0x4823f8
call fcn.0041ff07
push eax
call esi
mov ecx, 0x4823e0
call fcn.0041ff07
push eax
call esi
mov ecx, 0x482c78
call fcn.0041ff07
push eax
call esi
push dword [0x482600]
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [ebp - 0x10]
call fcn.0041f06b
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41e5fd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.0041ef35
push str.___Internal_InstallationNotFound___
call fcn.00420778
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x41e62a
mov esi, str.The__s_installation_couldnt_be_found._Try_re_installing_the_application_before_running_the_update.
mov ecx, 0x4827dc
call fcn.0041ff07
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0041f62d
add esp, 0xc
lea eax, [ebp - 4]
mov ecx, 0x482a3c
push eax
mov eax, dword [0x483760]
or eax, 0x20019
push eax
push ebx
call fcn.0041ff07
push eax
push dword [0x482a38]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e6d4
cmp dword [0x482a48], ebx
jne 0x41e68b
cmp dword [0x482a54], ebx
jne 0x41e68b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41e716
mov eax, 0x104
mov dword [ebp - 8], eax
push eax
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.00428300
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, 0x482a48
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
call fcn.0041ff07
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41e70e
cmp dword [0x482b7c], ebx
je 0x41e6f7
and dword [0x48260c], 0xffffffbf
push ebx
push str._IsUpdate_
call fcn.00420a71
mov ecx, edi
call fcn.0041868d
jmp 0x41e716
push ebx
lea ecx, [ebp - 0x14]
call fcn.0041ff07
push eax
push ebx
mov ecx, 0x482408
call fcn.0041e1f3
jmp 0x41e73a
cmp dword [0x482a54], ebx
jne 0x41e71a
mov bl, 1
jmp 0x41e73a
test byte [0x482611], 0x20
lea eax, [ebp - 0x118]
mov ecx, edi
push eax
je 0x41e733
call fcn.0041e84c
jmp 0x41e738
call fcn.0041ea5a
mov bl, al
lea ecx, [ebp - 0x14]
call fcn.0041f06b
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x41fc8b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebp - 4]
push 1
push eax
push edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 4], edi
jle 0x41fcc2
xor eax, eax
jmp 0x41fd42
cmp eax, ebx
jbe 0x41fcc8
mov eax, ebx
mov ecx, dword [ebp + 0xc]
mov edx, ebx
sub edx, eax
mov dword [esi], ecx
cmp edx, ecx
jb 0x41fcd9
cmp ecx, edi
ja 0x41fcdb
mov dword [esi], edx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esi]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi], edi
mov dword [esi + 8], eax
je 0x41fcbb
cmp dword [esi + 4], edi
jne 0x41fd1e
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
lea eax, [ebp - 8]
push edi
push eax
mov dword [ebp - 8], edi
push dword [esi]
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 8]
xor eax, eax
cmp ecx, dword [esi]
sete al
dec eax
and al, 0xfe
inc eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41fff7
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x420014
xor ebx, ebx
xor esi, esi
test bl, 2
je 0x42001e
push 2
pop esi
test bl, 0x20
je 0x420026
or esi, 0x20
test esi, esi
jne 0x42002f
mov esi, 0x80
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 1
je 0x420044
mov eax, ebx
and al, 0xfe
push eax
push dword [ebp + 8]
call edi
xor eax, eax
push eax
push esi
push 2
push eax
push eax
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x420065
push 0xfffffffffffffffd
jmp 0x42009f
lea eax, [ebp - 4]
push 0
push eax
mov eax, dword [ebp - 8]
and dword [ebp - 4], 0
push dword [eax]
push dword [eax + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [ecx]
je 0x420093
push 0xfffffffffffffffe
jmp 0x42009f
test ebx, ebx
je 0x42009d
push ebx
push dword [ebp + 8]
call edi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x420c4f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0x432518
call fcn.0041f0d8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, 0xfffffc00
mov ecx, edx
and eax, esi
test ecx, ecx
ja 0x420ca2
jb 0x420c81
cmp eax, 0x100000
jae 0x420ca2
mov eax, dword [ebp + 8]
push 0xa
pop ecx
call fcn.00428e60
push eax
push str._d_KB
push dword [ebp + 0x10]
call fcn.0041f62d
add esp, 0xc
jmp 0x420dd3
mov eax, dword [ebp + 8]
push 0xa
pop ecx
call fcn.00428e60
and byte [ebp - 0xc], 0
mov ebx, eax
xor eax, eax
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push 0xa
push eax
push 0xe
push 0x400
mov dword [ebp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x420ce4
lea eax, [ebp - 0xc]
push 0x42ff70
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [ebp + 0xc]
mov eax, ebx
mov ecx, edi
and eax, esi
test ecx, ecx
ja 0x420d33
jb 0x420cfa
cmp eax, 0x100000
jae 0x420d33
push 0xa
mov eax, ebx
pop ecx
mov edx, edi
call fcn.00428e60
mov esi, eax
xor ecx, ecx
shl eax, 0xa
sub ebx, eax
push ecx
sbb edi, ecx
push 0x64
push edi
push ebx
call fcn.004292d0
cmp eax, 0xa
jb 0x420d23
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str._d_s_d_MB
jmp 0x420dc8
push 0xa
mov eax, ebx
pop ecx
mov edx, edi
call fcn.00428e60
mov edi, eax
mov ebx, edx
and eax, esi
test ebx, ebx
ja 0x420d88
jb 0x420d52
cmp eax, 0x100000
jae 0x420d88
push 0xa
mov eax, edi
pop ecx
mov edx, ebx
call fcn.00428e60
mov esi, eax
xor ecx, ecx
shl eax, 0xa
sub edi, eax
push ecx
sbb ebx, ecx
push 0x64
push ebx
push edi
call fcn.004292d0
cmp eax, 0xa
jb 0x420d7b
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str._d_s_d_GB
jmp 0x420dc8
push 0xa
mov eax, edi
pop ecx
mov edx, ebx
call fcn.00428e60
push 0xa
mov esi, eax
pop ecx
mov edi, edx
call fcn.00428e60
mov ebx, eax
xor ecx, ecx
shl eax, 0xa
sub esi, eax
push ecx
sbb edi, ecx
push 0x64
push edi
push esi
call fcn.004292d0
cmp eax, 0xa
jb 0x420dbd
push 9
pop eax
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str._d_s_d_TB
push dword [ebp + 0x10]
call fcn.0041f62d
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420dd8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
jne 0x420def
or eax, 0xffffffff
jmp 0x420e96
mov dword [eax], esi
lea eax, [ebp + 8]
push eax
mov eax, dword [0x483760]
or al, 1
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420e93
lea eax, [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x420e8f
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.00428bd9
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x420e50
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
mov eax, dword [ebp + 0xc]
inc eax
push eax
push esi
push ebx
call fcn.00428300
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x420e84
mov eax, dword [ebp + 0x14]
push dword [ebp + 8]
mov dword [eax], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
jmp 0x420e95
push ebx
call fcn.00428bce
pop ecx
push 0xfffffffffffffffe
jmp 0x420e95
push 0xfffffffffffffffd
jmp 0x420e95
push 0xfffffffffffffffc
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x420ef6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x104
push edi
push esi
push 0
push dword [ebp + 8]
call fcn.00428300
push esi
call fcn.00428bd9
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x420f2f
mov ecx, 0x482e04
call fcn.0041ff07
push eax
call fcn.00420bbf
pop ecx
push esi
push 0
push edi
call fcn.00428300
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x420f57
push 0x4317b8
push edi
call esi
jmp 0x420f66
add eax, edi
cmp byte [eax - 1], 0x5c
je 0x420f66
mov byte [eax], 0x5c
and byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea ebx, [eax + edi]
mov eax, dword [ebp - 4]
and byte [ebx], 0
inc dword [ebp - 4]
lea ecx, [ebp - 0x14]
push 0xa
push ecx
push eax
call fcn.0042b93f
add esp, 0xc
push 0x4317b4
push edi
call esi
lea eax, [ebp - 0x14]
push eax
push edi
call esi
push dword [ebp + 0xc]
push edi
call esi
push edi
call fcn.0040f27e
test al, al
pop ecx
jne 0x420f7a
push edi
push dword [ebp + 8]
call esi
push edi
call fcn.00428bce
mov eax, dword [ebp + 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421921
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push str.GetSystemWindowsDirectoryA
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421950
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x4219ae
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
pop edi
push dword [ebp + 0xc]
push dword [ebp + 8]
jne 0x4219a8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
je 0x4219ae
push 0x5c
push dword [ebp + 8]
call fcn.00428b20
pop ecx
test eax, eax
pop ecx
je 0x4219a4
and byte [eax], 0
mov eax, esi
jmp 0x4219ae
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop esi
leave
ret
Function at 0x421e48
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x60], ebx
jne 0x421fa8
push dword [esp + 0xc]
lea ecx, [esi + 0x64]
call fcn.0041f0d8
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0x60], eax
je 0x421fac
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MP3Close
push eax
call edi
push str.MP3DeInit
mov dword [esi], eax
push dword [esi + 0x60]
call edi
push str.MP3GetCurrentPos
mov dword [esi + 4], eax
push dword [esi + 0x60]
call edi
push str.MP3GetLength
mov dword [esi + 8], eax
push dword [esi + 0x60]
call edi
push str.MP3GetMPEG_Args
mov dword [esi + 0xc], eax
push dword [esi + 0x60]
call edi
push str.MP3GetPlayer
mov dword [esi + 0x10], eax
push dword [esi + 0x60]
call edi
push str.MP3GetPlayerMode
mov dword [esi + 0x14], eax
push dword [esi + 0x60]
call edi
push str.MP3Init
mov dword [esi + 0x18], eax
push dword [esi + 0x60]
call edi
push str.MP3Open
mov dword [esi + 0x1c], eax
push dword [esi + 0x60]
call edi
push str.MP3Pause
mov dword [esi + 0x20], eax
push dword [esi + 0x60]
call edi
push str.MP3Play
mov dword [esi + 0x24], eax
push dword [esi + 0x60]
call edi
push str.MP3SetDevice
mov dword [esi + 0x28], eax
push dword [esi + 0x60]
call edi
push str.MP3SetExternalValues
mov dword [esi + 0x2c], eax
push dword [esi + 0x60]
call edi
push str.MP3SetPriority
mov dword [esi + 0x30], eax
push dword [esi + 0x60]
call edi
push str.MP3Stop
mov dword [esi + 0x34], eax
push dword [esi + 0x60]
call edi
push str.MP3Resume
mov dword [esi + 0x38], eax
push dword [esi + 0x60]
call edi
push str.MP3Suspend
mov dword [esi + 0x40], eax
push dword [esi + 0x60]
call edi
cmp dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], eax
pop edi
je 0x421fac
cmp dword [esi + 0x20], ebx
je 0x421fac
cmp dword [esi + 0x34], ebx
je 0x421fac
cmp dword [esi + 0x28], ebx
je 0x421fac
cmp dword [esi], ebx
je 0x421fac
cmp dword [esi + 0x10], ebx
je 0x421fac
cmp dword [esi + 0x14], ebx
je 0x421fac
cmp dword [esi + 8], ebx
je 0x421fac
cmp dword [esi + 0xc], ebx
je 0x421fac
cmp dword [esi + 0x18], ebx
je 0x421fac
cmp dword [esi + 4], ebx
je 0x421fac
cmp dword [esi + 0x1c], ebx
je 0x421fac
cmp dword [esi + 0x30], ebx
je 0x421fac
cmp dword [esi + 0x24], ebx
je 0x421fac
cmp eax, ebx
je 0x421fac
cmp dword [esi + 0x40], ebx
je 0x421fac
mov al, 1
jmp 0x421fae
xor al, al
pop esi
pop ebx
ret 4
Function at 0x422b16
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov edi, ecx
push str.RAM:_t
lea ecx, [ebp - 0xc]
call fcn.0041efa5
push str.GlobalMemoryStatusEx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x422b6a
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x40
push ecx
call eax
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
push 0x14
pop ecx
call fcn.00428e60
mov ebx, eax
test ebx, ebx
jne 0x422b81
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ebx, dword [ebp - 0x24]
shr ebx, 0x14
test bl, 1
je 0x422b87
inc ebx
mov esi, str._d_MB_t
push ebx
lea eax, [ebp - 0xc]
push esi
push eax
mov dword [0x482bb8], ebx
call fcn.0041f62d
mov eax, dword [0x4825bc]
add esp, 0xc
test eax, eax
jne 0x422bb9
push eax
push 0x431928
lea ecx, [ebp - 0xc]
call fcn.0041f20d
jmp 0x422bcf
push eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.0041f62d
add esp, 0xc
cmp ebx, dword [0x4825bc]
jb 0x422bd6
push 0x482dd4
jmp 0x422be1
inc dword [0x482740]
push 0x482dbc
lea ecx, [ebp - 0xc]
call fcn.0041f28b
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.00422686
lea ecx, [ebp - 0xc]
mov dword [0x482744], ebx
call fcn.0041f06b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423240
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
push edi
je 0x4232d6
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4232d6
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp + 0xc], eax
jbe 0x4232cf
push eax
call fcn.00428bd9
mov esi, eax
pop ecx
test esi, esi
jne 0x42327e
mov eax, 0x8007000e
jmp 0x4232db
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4232c8
and dword [ebp + 8], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 0x42fb94
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4232c8
mov eax, dword [ebp + 8]
test eax, eax
je 0x4232c8
mov ecx, dword [eax + 8]
push esi
mov dword [edi + 4], ecx
mov eax, dword [eax + 0xc]
mov dword [edi], eax
call fcn.00428bce
pop ecx
xor eax, eax
jmp 0x4232db
push esi
call fcn.00428bce
pop ecx
mov eax, 0x80004005
jmp 0x4232db
mov eax, 0x80070057
pop edi
pop esi
leave
ret
Function at 0x4238e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
and byte [ebp - 0x408], 0
push esi
push edi
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x407]
and byte [ebp - 0x208], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
push 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x408]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x42393c
mov eax, esi
jmp 0x423ac7
lea eax, [ebp - 0x408]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push str.d3d8.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00423240
pop ecx
pop ecx
push 4
test eax, eax
pop edi
jl 0x4239e5
mov eax, dword [ebp - 4]
mov esi, 0x371
mov ecx, eax
shr ecx, 0x10
cmp cx, di
jne 0x4239b2
push esi
push 1
push 8
push edi
call fcn.004232df
push edx
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004232fe
add esp, 0x20
test eax, eax
jge 0x4239de
mov eax, dword [ebp - 4]
shr eax, 0x10
cmp ax, 5
jne 0x4239e5
push esi
push 0xa28
push 1
push 5
call fcn.004232df
push edx
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004232fe
add esp, 0x20
test eax, eax
jl 0x4239e5
mov dword [ebp + 8], 0x10008
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push str.dpnet.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00423240
pop ecx
test eax, eax
pop ecx
jl 0x423a84
mov eax, dword [ebp - 4]
mov esi, 0x86
mov ecx, eax
shr ecx, 0x10
cmp cx, di
jne 0x423a51
push esi
push 0
push 9
push edi
call fcn.004232df
push edx
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004232fe
add esp, 0x20
test eax, eax
jge 0x423a7d
mov eax, dword [ebp - 4]
shr eax, 0x10
cmp ax, 5
jne 0x423a84
push esi
push 0xe5d
push 2
push 5
call fcn.004232df
push edx
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004232fe
add esp, 0x20
test eax, eax
jl 0x423a84
mov dword [ebp + 8], 0x20008
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push str.d3d9.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00423240
pop ecx
pop ecx
pop ebx
test eax, eax
jl 0x423ac4
mov dword [ebp + 8], 9
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret