joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c000
Capabilities:
Capture microphone audio

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x41c03e
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 8]
push 0x50000
push edi
push eax
push ecx
push edx
push esi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x41c03e
push 1
mov ecx, esi
call fcn.0041c330
pop edi
mov eax, 1
pop esi
ret 4
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x41d210
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 0x1ac]
sub esp, 0xc
test eax, eax
push esi
lea esi, [ecx + 0x1ac]
jne 0x41d272
lea eax, [esp + 4]
mov dword [esi], 3
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d272
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push esi
push edx
push eax
mov eax, dword [esp + 0x14]
push str.NumRearJacks
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi]
pop esi
add esp, 0xc
ret

Function at 0x41d290
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4325d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
lea ecx, [esp]
mov dword [esp + 0xc], 0
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 4]
mov dword [esp + 0x120], 1
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d326
lea ecx, [esp + 8]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.PlatformIDString
push ecx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d31b
lea edx, [esp + 0x14]
lea ecx, [esp]
push edx
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov esi, dword [esp + 0x12c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x10], 1
lea ecx, [esp + 4]
mov byte [esp + 0x124], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x124
ret 4
Function at 0x41d390
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x432605
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push esi
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_3
push 0x70
lea ecx, [esp + 8]
mov dword [esp + 0x124], 1
call sub.MFC42.DLL_CString::LoadStringA
lea eax, [esp + 0xc]
push eax
push str.SoftwareStaccatoSCaCP_
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d49f
mov eax, dword [esp + 0x12c]
mov dword [esp + 8], pe_nt_image_headers32
test eax, eax
je 0x41d42f
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.CP_AUDIODOCTOR_SUPPORT_URL
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d494
lea edx, [esp + 0x18]
push edx
jmp 0x41d48b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.CP_VENDORLINK
push eax
call esi
test eax, eax
jne 0x41d45d
lea ecx, [esp + 0x18]
push ecx
jmp 0x41d48b
lea edx, [esp + 8]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.CP_SMAXLINK
push edx
mov dword [esp + 0x20], pe_nt_image_headers32
call esi
test eax, eax
jne 0x41d494
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x128]
lea edx, [esp + 4]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x14], 1
lea ecx, [esp + 4]
mov byte [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret 8

Function at 0x41d510
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xe4]
test eax, eax
jne 0x41d5b9
lea eax, [esp + 0xc]
mov dword [esi + 0xe4], 1
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push reloc.DSOUND.dll_DirectSoundCreate
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d596
lea ecx, [esp + 8]
lea edx, [esi + 0x1b4]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push edi
push str.SysCaps
push ecx
mov dword [esp + 0x20], 0xd0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d587
cmp dword [esp + 8], 0xd0
jne 0x41d587
mov edi, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x41d5b9
mov ecx, 0x34
xor eax, eax
lea edi, [esi + 0x1b4]
rep stosd dword es:[edi], eax
mov dword [esi + 0x208], 1
mov dword [esi + 0x20c], 1
lea eax, [esi + 0x1b4]
pop edi
pop esi
add esp, 0xc
ret
Function at 0x41d5d0
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43262c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
lea ecx, [esi + 0xc]
call sub.MFC42.DLL_CFileFind::CFileFind
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [esp + 0xfc], edi
call sub.MFC42.DLL_CString::CString_3
mov ebx, 1
mov dword [esi], 0x437670
mov byte [esp + 0xfc], bl
mov dword [esi + 8], edi
mov dword [esi + 0x34], edi
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.0041d7a0
lea ecx, [esp + 0x10]
mov dword [esi + 0x2c], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push ecx
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x24], edi
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d697
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
push str.ShowAllSkins
push edx
mov dword [esp + 0x2c], 4
call ebp
test eax, eax
je 0x41d68c
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], edi
je 0x41d6a6
mov dword [esi + 0x2c], 0xffffffff
jmp 0x41d702
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push reloc.DSOUND.dll_DirectSoundCreate
call ebx
test eax, eax
jne 0x41d702
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
mov ebx, 0xd0
push str.SysCaps
push edx
mov dword [esp + 0x2c], ebx
call ebp
test eax, eax
jne 0x41d6f7
cmp dword [esp + 0x14], ebx
jne 0x41d6f7
cmp dword [esp + 0x58], edi
je 0x41d6f7
mov dword [esi + 0x2c], 2
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xf4]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xf0
ret
Function at 0x41d7f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, 1
call fcn.0041d7a0
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x34], eax
je 0x41d916
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetGeneral
push eax
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x41d82d
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetBitmap
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x41d841
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetButton
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x41d855
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetGraph
push edx
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x34]
push str.GetIcon
push eax
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x41d877
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetKnob
push ecx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x41d88b
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetString
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x41d89f
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetText
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x41d8b3
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetSkinVersion
push ecx
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x41d8c7
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetVUMeter
push edx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x41d8db
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetBackground
push eax
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x41d8ef
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetSlider
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
je 0x41d939
test ebx, ebx
je 0x41d93b
call dword [esi + 0x58]
cmp eax, 2
jne 0x41d939
push ebp
lea ecx, [esi + 0x28]
call sub.MFC42.DLL_CString::operator_1
mov ecx, esi
call fcn.0041d970
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x2c]
test eax, edx
jne 0x41d942
mov ecx, esi
xor edi, edi
call fcn.0041d7a0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
xor ebx, ebx
mov ecx, esi
call fcn.0041d7a0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 4
Function at 0x41da40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, 0x41
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundCreate
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41daac
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.SkinPath
push ecx
mov dword [esp + 0x2c], 0x104
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x41dafc
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundEnumerateA
call ebp
test eax, eax
jne 0x41dafc
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.SkinPath
push edx
mov dword [esp + 0x2c], 0x104
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0041d7f0
test eax, eax
jne 0x41db61
mov ecx, esi
call fcn.0041db70
mov edi, eax
test edi, edi
je 0x41db5f
lea edx, [esp + 0x10]
push edx
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41db5f
mov eax, dword [esi + 0x28]
lea ecx, [esi + 0x28]
mov eax, dword [eax - 8]
push eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.SkinPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x41db70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43266b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push eax
mov dword [esp + 0x230], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push 0x43feb0
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x11c]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push edx
push eax
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41dc23
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Path
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x11c]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::operator_1
push str._res.skn
lea ecx, [esp + 0xc]
call fcn.0042f280
mov ecx, esi
call fcn.0041d7a0
mov eax, dword [esp + 8]
mov edx, dword [esi + 0xc]
lea ecx, [esi + 0xc]
push 0
push eax
call dword [edx + 0x48]
push 0x440948
mov ecx, esi
mov dword [esi + 4], eax
call fcn.0041d7f0
mov edi, eax
test edi, edi
jne 0x41dc77
mov ecx, esi
call fcn.0041dcb0
mov edi, eax
lea ecx, [esp + 8]
mov dword [esp + 0x228], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x220]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x224
ret
Function at 0x41e3c0
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x432716
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
call fcn.00408d50
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], 0
call fcn.00408d50
mov byte [esp + 0x124], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov si, ax
lea eax, [esp + 0x18]
push 0x104
push eax
push 2
push 0x400
and esi, 0xffff
call ebp
push 0xcc
lea ecx, [esp + 0x14]
call fcn.00408d60
push 0x43f114
lea ecx, [esp + 0x14]
call fcn.0042f280
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.0042f280
push 0x409
push 0xcc
lea ecx, [esp + 0x1c]
call fcn.00408e30
push 0x43f114
lea ecx, [esp + 0x18]
call fcn.0042f280
lea edx, [esp + 0x18]
lea ecx, [esp + 0x14]
push edx
call fcn.0042f280
mov ebx, dword [esp + 0x12c]
lea eax, [esp + 0x14]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push ebx
mov ecx, edi
call fcn.004119d0
lea edx, [esp + 0x18]
push 0x104
push edx
push 2
push esi
call ebp
push 0xcd
lea ecx, [esp + 0x14]
call fcn.00408d60
push 0x43f114
lea ecx, [esp + 0x14]
call fcn.0042f280
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call fcn.0042f280
push 0x409
push 0xcd
lea ecx, [esp + 0x1c]
call fcn.00408e30
push 0x43f114
lea ecx, [esp + 0x18]
call fcn.0042f280
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
call fcn.0042f280
lea edx, [esp + 0x14]
push 0
lea eax, [esp + 0x14]
push edx
push eax
push 0
push ebx
mov ecx, edi
call fcn.004119d0
lea ecx, [esp + 0x14]
mov byte [esp + 0x124], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x124], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x118
ret 4
Function at 0x41f6d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xdc
push esi
mov esi, ecx
push edi
push 0
lea edi, [esi + 8]
mov dword [esi], 0x43791c
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x41f739
push str.DSound.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x41f739
push str.DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi + 0x10], eax
je 0x41f739
push 0
push edi
push 0
call eax
test eax, eax
jge 0x41f739
mov dword [edi], 0
lea eax, [esp + 8]
mov dword [esi + 4], 0
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41f7a7
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
mov edi, 0xd0
push str.SysCaps
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41f79c
cmp dword [esp + 0xc], edi
jne 0x41f79c
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41f79c
mov dword [esi + 4], 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0xdc
ret

Function at 0x41f810
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
mov esi, ecx
push reloc.DSOUND.dll_DirectSoundEnumerateA
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41f86b
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.Speaker_Configuration
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
mov ecx, esi
push eax
call fcn.0041f880
pop esi
add esp, 0x10
ret

Function at 0x41f9f0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
mov esi, ecx
push reloc.DSOUND.dll_DirectSoundEnumerateA
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41fa3e
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push eax
push str.Speaker_Configuration
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41fa33
mov edi, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 8]
test eax, eax
je 0x41fa59
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41fa59
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0041fa80
test edi, edi
pop edi
pop esi
je 0x41fa75
mov edx, dword [0x440be8]
push 0
push 0
push edx
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
pop ecx
ret 8
Function at 0x4240d0
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push str.CSpeakerConfigDlg2::ConfigHeadphones__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebp, ebp
xor ebx, ebx
lea ecx, [edi + 0xaa8]
mov eax, dword [ebx + ecx + 0x34]
lea esi, [ebx + ecx]
test eax, eax
je 0x424121
cmp eax, 1
je 0x42410f
cmp eax, 2
je 0x42410f
cmp eax, 0xd
je 0x42410f
cmp eax, 3
je 0x42410f
cmp eax, 0xc
jne 0x42412c
test eax, eax
je 0x424121
cmp eax, 0xc
je 0x424121
mov dword [esi + 0x24], 0
jmp 0x42412c
push ebp
push 1
push ecx
mov ecx, edi
call fcn.00425180
push esi
mov ecx, edi
call fcn.00424450
lea ecx, [edi + 0xb5c]
mov eax, dword [ebx + ecx + 0x34]
lea esi, [ebx + ecx]
test eax, eax
je 0x424170
cmp eax, 1
je 0x42415e
cmp eax, 2
je 0x42415e
cmp eax, 0xd
je 0x42415e
cmp eax, 3
je 0x42415e
cmp eax, 0xc
jne 0x42417b
test eax, eax
je 0x424170
cmp eax, 0xc
je 0x424170
mov dword [esi + 0x24], 0
jmp 0x42417b
push ebp
push 1
push ecx
mov ecx, edi
call fcn.00425180
push esi
mov ecx, edi
call fcn.00424450
add ebx, 0x3c
inc ebp
cmp ebx, 0xb4
jl 0x4240e5
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x426cf0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x433b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
call fcn.00408d50
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
mov ecx, esi
mov dword [esi + 0x60], 3
mov eax, dword [0x440abc]
push eax
call fcn.00406720
push 0x9c9c9c
push 0xff00
push 0xff
push 0x3c3c3c
push 0xaeaeae
push 0
push 0
push 0xdcdcdc
mov ecx, esi
call fcn.004066b0
push 0x8c8c8c
push 0
push 0xffffff
push 0xffffff
mov ecx, esi
call fcn.00406670
push 0x6e6e6e
mov ecx, esi
call fcn.00406740
push 0xd
push 0x12
mov ecx, esi
call fcn.00408a20
mov dword [esi + 0xb4], 1
mov dword [esi + 0xa4], 0
mov edi, dword [edi + 0x20]
push 0x55
lea ecx, [esp + 0xc]
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], esi
call fcn.00408d60
push 0x400c
push 0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov ecx, esi
call fcn.004089d0
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
push 0
push 0x408
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0xa
push 0
push 0x415
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0x64
push 0
push 0x404
push edx
call edi
mov eax, dword [esi + 0x20]
push 0x54
push 0
push 0x404
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0x43
push 0
push 0x404
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0x32
push 0
push 0x404
push edx
call edi
mov eax, dword [esi + 0x20]
push 0x22
push 0
push 0x404
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0x11
push 0
push 0x404
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0
push 0
push 0x404
push edx
call edi
lea ecx, [esp + 8]
mov dword [esi + 0xac], 1
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4299b0
Capabilities:
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push 0
push 2
push esi
push 0x429580
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0x1e7c], eax
je 0x4299ee
mov ecx, 1
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x1e7c]
mov dword [esi + 0x1dc8], ecx
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret