joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4138d0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x41ded8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push str._sPanel_dJack_d
push ecx
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
push 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x413ae4
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.CODEC_ID
push ecx
call edi
mov eax, dword [esi + 0xc]
lea edx, [esp + 8]
push 4
push edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push 4
push 0
push 0x428d5c
push eax
call edi
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x38]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0
push str.PRIMARY_FC
push edx
mov dword [esp + 0x20], eax
call edi
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.CURRENT_FC
push ecx
call edi
push 0
mov ecx, esi
call fcn.00413be0
lea edx, [esp + 8]
and eax, 0xff
push 4
push edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push 4
push 0
push str.CURRENT_DID
push eax
call edi
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x18]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0
push str.FC_BITS
push edx
mov dword [esp + 0x20], eax
call edi
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.INHIBIT
push ecx
call edi
mov eax, dword [esi + 0x24]
lea edx, [esp + 8]
push 4
push edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push 4
push 0
push str.VREF_KEY
push eax
call edi
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x28]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0
push str.GROUP_IDX
push edx
mov dword [esp + 0x20], eax
call edi
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.JACK_CFG
push ecx
call edi
mov eax, dword [esi + 0x2c]
lea edx, [esp + 8]
push 4
push edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push 4
push 0
push str.COLOR
push eax
call edi
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x30]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0
push str.XPOS
push edx
mov dword [esp + 0x20], eax
call edi
mov ecx, dword [esp + 0xc]
mov esi, dword [esi + 0x34]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.YPOS
push ecx
mov dword [esp + 0x20], esi
call edi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.0041bec4
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x413b10
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x41def8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x20]
mov cl, byte [esi + 0x44]
cmp cl, al
mov dword [esp + 0x18], 0
je 0x413bb7
mov byte [esi + 0x44], al
and eax, 0xff
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 0x28]
push eax
push esi
push str.SoftwareAnalog_DevicesSMax4PNPSettings
lea eax, [esp + 0x10]
push str._sPanel_dJack_d
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 8]
push ecx
push 0
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x413bb7
lea edx, [esp + 0xc]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x18]
push str.CURRENT_DID
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.0041bec4
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x413be0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41df18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x2c]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x24], 0
test edx, edx
mov dword [esp + 0xc], 4
je 0x413cbe
xor edx, edx
mov dl, byte [esi + 0x44]
cmp edx, 0xffff
jne 0x413cd9
cmp ecx, edx
je 0x413cd9
cmp eax, edx
je 0x413cd9
push eax
push ecx
push str.SoftwareAnalog_DevicesSMax4PNPSettings
lea eax, [esp + 0x14]
push str._sPanel_dJack_d
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push 0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x413cd9
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.CURRENT_DID
push edx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
mov al, byte [esp + 0x14]
push ecx
mov byte [esi + 0x44], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413cd9
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.SMWDMIF.dll_GetJackDevice]
mov eax, dword [esp + 0x34]
add esp, 8
mov ecx, esi
push eax
call fcn.00413b10
mov bl, byte [esi + 0x44]
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041bec4
mov ecx, dword [esp + 0x1c]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x413d70
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x41df38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov edi, dword [esp + 0x28]
mov dword [esp + 0x20], 0
test edi, edi
je 0x413e48
cmp edi, 0xff
je 0x413e48
mov ebx, dword [esp + 0x2c]
cmp ebx, 0xf
je 0x413e48
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 0x28]
push eax
push esi
push str.SoftwareAnalog_DevicesSMax4PNPSettings
lea eax, [esp + 0x20]
push str._sPanel_dJack_d
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push 0
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x413e48
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x20]
push str.LAST_DID
push eax
mov dword [esp + 0x24], edi
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.LAST_FID
push edx
mov dword [esp + 0x24], ebx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041bec4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8

Function at 0x413e70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41df58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x28]
mov esi, dword [esi + 0xc]
cmp eax, 0xffff
mov dword [esp + 0x20], 0
mov dword [esp + 4], 4
je 0x413f71
cmp esi, 0xffff
je 0x413f71
push esi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
lea eax, [esp + 0x1c]
push str._sPanel_dJack_d
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
push 0
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x413f71
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.LAST_DID
push edx
mov dword [esp + 0x1c], 4
call esi
test eax, eax
jne 0x413f33
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.LAST_FID
push edx
mov dword [esp + 0x1c], 4
call esi
test eax, eax
jne 0x413f66
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041bec4
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x415ff0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x41e248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov ebx, dword [esi + 0x18]
lea eax, [esp + 0x14]
push ebx
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push str._sPanel_d
push eax
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x416122
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [esp + 0xc]
push 4
push edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push 4
push 0
push str.NAME_IDX
push eax
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.JACK_CNT
push edx
mov dword [esp + 0x24], eax
call edi
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push str.CURR_SPKR_CFG
push ecx
call edi
mov eax, dword [esi + 0xc]
lea edx, [esp + 0xc]
push 4
push edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push 4
push 0
push str.PREV_SPKR_CFG
push eax
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x3c]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.BG_COLOR
push edx
mov dword [esp + 0x24], eax
call edi
mov eax, dword [esi + 0x48]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push str.BORDER
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x1c]
xor edi, edi
test eax, eax
jle 0x416143
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x41613b
push ebx
call fcn.004138d0
mov eax, dword [esi + 0x1c]
inc edi
cmp edi, eax
jl 0x41612b
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041bec4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4174b0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x41aa70
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41e9fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
lea ecx, [esi + 0xc]
call sub.MFC42.DLL_CFileFind::CFileFind
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [esp + 0xfc], edi
call sub.MFC42.DLL_CString::CString
mov ebx, 1
mov dword [esi], 0x421480
mov byte [esp + 0xfc], bl
mov dword [esi + 8], edi
mov dword [esi + 0x34], edi
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.0041ac40
lea ecx, [esp + 0x10]
mov dword [esi + 0x2c], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push ecx
push str.SoftwareAnalog_DevicesSMax4Settings
push 0x80000001
mov dword [esp + 0x24], edi
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41ab37
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
push str.ShowAllSkins
push edx
mov dword [esp + 0x2c], 4
call ebp
test eax, eax
je 0x41ab2c
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], edi
je 0x41ab46
mov dword [esi + 0x2c], 0xffffffff
jmp 0x41aba2
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push 0x80000001
call ebx
test eax, eax
jne 0x41aba2
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
mov ebx, 0xd0
push str.SysCaps
push edx
mov dword [esp + 0x2c], ebx
call ebp
test eax, eax
jne 0x41ab97
cmp dword [esp + 0x14], ebx
jne 0x41ab97
cmp dword [esp + 0x58], edi
je 0x41ab97
mov dword [esi + 0x2c], 2
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xf4]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xf0
ret
Function at 0x41ac90
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, 1
call fcn.0041ac40
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x34], eax
je 0x41adb6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetGeneral
push eax
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x41accd
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetBitmap
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x41ace1
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetButton
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x41acf5
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetGraph
push edx
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x34]
push str.GetIcon
push eax
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x41ad17
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetKnob
push ecx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x41ad2b
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetString
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x41ad3f
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetText
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x41ad53
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetSkinVersion
push ecx
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x41ad67
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetVUMeter
push edx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x41ad7b
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetBackground
push eax
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x41ad8f
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetSlider
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
je 0x41add9
test ebx, ebx
je 0x41addb
call dword [esi + 0x58]
cmp eax, 2
jne 0x41add9
push ebp
lea ecx, [esi + 0x28]
call fcn.0041beb2
mov ecx, esi
call fcn.0041ae10
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x2c]
test eax, edx
jne 0x41ade2
mov ecx, esi
xor edi, edi
call fcn.0041ac40
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
xor ebx, ebx
mov ecx, esi
call fcn.0041ac40
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 4
Function at 0x41af20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, 0x41
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push str.SoftwareAnalog_DevicesSMax4Settings
push 0x80000001
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41af8c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.SkinPath
push ecx
mov dword [esp + 0x2c], 0x104
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x41afdc
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareAnalog_DevicesSMax4Settings
push 0x80000002
call ebp
test eax, eax
jne 0x41afdc
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.SkinPath
push edx
mov dword [esp + 0x2c], 0x104
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0041ac90
test eax, eax
jne 0x41b041
mov ecx, esi
call fcn.0041b050
mov edi, eax
test edi, edi
je 0x41b03f
lea edx, [esp + 0x10]
push edx
push str.SoftwareAnalog_DevicesSMax4Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41b03f
mov eax, dword [esi + 0x28]
lea ecx, [esi + 0x28]
mov eax, dword [eax - 8]
push eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.SkinPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x41b050
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41ea3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push eax
mov dword [esp + 0x230], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.SoundMAX
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x11c]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push edx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41b103
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Path
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x11c]
lea ecx, [esp + 8]
push eax
call fcn.0041beb2
push str._res.skn
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
mov ecx, esi
call fcn.0041ac40
mov eax, dword [esp + 8]
mov edx, dword [esi + 0xc]
lea ecx, [esi + 0xc]
push 0
push eax
call dword [edx + 0x48]
push 0x4292a0
mov ecx, esi
mov dword [esi + 4], eax
call fcn.0041ac90
mov edi, eax
test edi, edi
jne 0x41b157
mov ecx, esi
call fcn.0041b190
mov edi, eax
lea ecx, [esp + 8]
mov dword [esp + 0x228], 0xffffffff
call fcn.0041bec4
mov ecx, dword [esp + 0x220]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x224
ret

Function at 0x41b2d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xdc
push esi
mov esi, ecx
push edi
push 0
lea edi, [esi + 8]
mov dword [esi], 0x421484
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x41b339
push str.DSound.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x41b339
push str.DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi + 0x10], eax
je 0x41b339
push 0
push edi
push 0
call eax
test eax, eax
jge 0x41b339
mov dword [edi], 0
lea eax, [esp + 8]
mov dword [esi + 4], 0
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41b3a7
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
mov edi, 0xd0
push str.SysCaps
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41b39c
cmp dword [esp + 0xc], edi
jne 0x41b39c
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41b39c
mov dword [esi + 4], 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0xdc
ret
Function at 0x41b410
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
mov esi, ecx
push 0x80000002
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41b46b
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.Speaker_Configuration
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
mov ecx, esi
push eax
call fcn.0041b480
pop esi
add esp, 0x10
ret

Function at 0x41b5f0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
mov esi, ecx
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41b63e
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push eax
push str.Speaker_Configuration
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41b633
mov edi, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 8]
test eax, eax
je 0x41b659
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41b659
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0041b680
test edi, edi
pop edi
pop esi
je 0x41b675
mov edx, dword [0x4296bc]
push 0
push 0
push edx
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
pop ecx
ret 8

Function at 0x4f8006
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ret
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
jmp 0x4fc00f
cld
cmp byte [edi], 0
nop
not ebx
not ebx
not edx
not edx
nop
nop
pop eax
not ebp
not ebp
cld
jne 0x4fc0c1
xor eax, 0x894e45b0
nop
xchg ecx, edx
xchg ecx, edx
mov ch, ch
cld
cmp eax, dword [esp + 4]
jmp 0x4fbe72
wait
jne 0x4fbf0b
mov eax, 0xc7bb241a
mov esi, dword [edx + 0x24]
mov edi, dword [edx + 0x1c]
jmp 0x4fc01f
test edi, 0xf4c8f02f
push 0xffffffffffffffff
xchg al, ah
pop ecx
lodsd eax, dword [esi]
inc ecx
lea edi, [eax + ebx]
jmp 0x4fc0af
add esi, ebx
ret 4
lea edx, [edx + ebx]
mov esi, dword [edx + 0x20]
xor al, 0x7d
lea esi, [ebx + esi]
jmp 0x4fbf00
add esi, ebx
xchg dl, dh
add edi, ebx
movzx eax, word [esi + ecx*2]
nop
mov esi, dword [edi + eax*4]
jmp 0x4fbf2d
cmp ecx, dword [edx + 0x18]
cld
je 0x4f8005
sub eax, eax
jmp 0x4fc0c0
nop
push eax
add esi, ecx
sub esi, ecx
test cl, 0xa
shl eax, 4
xchg dword [esp], eax
jmp 0x4fc12f
not esi
not esi
cld
cmp bh, bl
cmp ebp, 0x25
sub dword [esp], eax
xchg edx, ecx
xchg edx, ecx
sahf
cld
nop
add dh, bh
sub dh, bh
movzx eax, byte [edi]
test ebx, 0xf52fc41
inc edi
sub esp, edx
add esp, edx
sub dword [esp], eax
jmp 0x4fbe41