joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408b5c
Capabilities:
Get geographical location
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
shr eax, 0x1f
not al
and al, 1
mov ebx, 0x401534
mov byte [0x40ca5c], al
je 0x408c11
push 0x40152c
call edi
push ebx
mov dword [ebp - 4], eax
call edi
push 0x401520
mov dword [ebp - 8], eax
call edi
push 0x401510
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call esi
push 0x401500
mov dword [0x40ca70], eax
push dword [ebp - 4]
call esi
push 0x4014f0
mov dword [0x40ca74], eax
push dword [ebp - 4]
call esi
push 0x4014e0
mov dword [0x40ca78], eax
push dword [ebp - 8]
call esi
push 0x4014c4
mov dword [0x40ca7c], eax
push dword [ebp - 8]
call esi
push 0x4014b8
mov dword [0x40ca80], eax
push dword [ebp - 0xc]
call esi
push 0x4014ac
mov dword [0x40ca84], eax
push dword [ebp - 0xc]
call esi
mov dword [0x40ca88], eax
mov eax, dword [ebp + 8]
push 6
shl eax, 2
mov ecx, dword [eax + 0x4016ec]
mov dword [0x40ca60], ecx
mov ecx, dword [eax + 0x4016f4]
mov eax, dword [eax + 0x401cf4]
mov dword [0x40ca64], ecx
lea ecx, [ebp - 0x14]
mov dword [0x40ca68], eax
push ecx
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dl, byte [ebp - 0x14]
xor eax, eax
test dl, dl
mov dword [0x40ca6c], eax
lea ecx, [ebp - 0x14]
je 0x408c73
movsx edx, dl
lea eax, [eax + eax*4]
inc ecx
lea eax, [edx + eax*2 - 0x30]
mov dl, byte [ecx]
test dl, dl
jne 0x408c5d
mov dword [0x40ca6c], eax
push dword [0x40ca68]
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x40149c
push ebx
call edi
push eax
call esi
pop edi
pop esi
test eax, eax
pop ebx
je 0x408c9b
mov cx, word [0x40ca68]
push ecx
call eax
leave
ret

Function at 0x408e57
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
cmp dword [0x40ca88], 0
je 0x408e97
lea eax, [ebp - 0x200]
push 0x100
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push dword [0x40ca6c]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x200]
push eax
call dword [0x40ca88]
leave
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
leave
ret
Function at 0x409394
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
lea eax, [ebp - 0x128]
mov edi, 0x100
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x40cbcc
xor ebx, ebx
push dword [0x40caa8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, eax, 0x343fd
add eax, 0x269ec3
shr eax, 0x10
and eax, 0x7fff
push eax
lea eax, [ebp - 0x128]
push eax
push 0x401634
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push ebx
push 1
push ebx
push ebx
push 0x40000000
push esi
call fcn.00408de8
add esp, 0x30
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x409421
mov byte [0x40cbcc], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x4093ba
xor al, al
jmp 0x40956e
lea eax, [ebp - 0x228]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push 0x8000000
push 3
push ebx
push 1
lea eax, [ebp - 0x228]
push SysReAllocString
push eax
call fcn.00408de8
mov esi, eax
push ebx
push ebx
push esi
mov dword [ebp - 8], esi
call fcn.00406d54
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0x28
push 1
push ebx
push 0xfffffffffffffffc
push esi
call edi
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x28]
push 4
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
call esi
push 1
push ebx
push 0xfffffffffffffff4
pop eax
sub eax, dword [ebp - 0x28]
push eax
push dword [ebp - 8]
call edi
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 4]
push 4
push eax
push dword [ebp - 8]
call esi
push 1
push ebx
push 0xfffffffffffffffc
pop eax
sub eax, dword [ebp - 4]
push eax
push dword [ebp - 8]
call edi
mov edi, pe_overlay
push edi
call fcn.00406ce9
push edi
mov dword [ebp - 0x18], eax
call fcn.00406ce9
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
jbe 0x409548
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x24]
push 4
push eax
push dword [ebp - 8]
call esi
lea eax, [ebp - 0xc]
sub dword [ebp - 4], 4
push ebx
push eax
lea eax, [ebp - 0x14]
push 4
push eax
push dword [ebp - 8]
call esi
lea eax, [ebp - 0xc]
push ebx
push eax
sub dword [ebp - 4], 4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x24], ebx
jne 0x409514
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
jmp 0x409537
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], edi
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004043ef
add esp, 0x10
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], eax
jne 0x4094ca
push dword [ebp - 0x1c]
call fcn.00406d2b
push dword [ebp - 0x18]
call fcn.00406d2b
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2bab383a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x19915cd5
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x406120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406139
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406174
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x406170
lea ebx, [ebx]
cmp esi, eax
jae 0x406174
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406160
cmp esi, eax
jb 0x40617a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x406880
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5b3720]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x4069e4
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x40691b
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 1
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x406955
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x40698f
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], 1
je 0x4069e0
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5c482c]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x406a20
test byte [0x5c4730], 8
mov ecx, 0x11
mov esi, 0x5c4718
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x406a3e
lea edi, [esp + 0x20]
mov dword [esp + 0x30], 1
call fcn.004fcee0
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.00524c67
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundCreate
jmp 0x406a20
Function at 0x406a50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5b3720]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x406bb8
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], 1
mov dword [esp + 0x9c], ebx
je 0x406aef
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 1
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x406b29
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], 1
mov dword [esp + 0x9c], ebx
je 0x406b67
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], ebx
je 0x406bb4
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5c482c]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x406bfd
mov al, byte [0x5c4730]
test al, 4
mov ecx, 0x11
mov esi, 0x5c4718
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x406c1b
mov ecx, 1
test cl, al
mov dword [esp + 0x2c], ecx
je 0x406bf2
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x20]
call fcn.004fcee0
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.00524c67
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundCreate
jmp 0x406bfd
Function at 0x406c30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x5b3720]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0xa4], 6
jae 0x406d96
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
cmp esi, 0xffffffff
mov eax, 1
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], eax
mov dword [esp + 0x9c], ebx
je 0x406cd5
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x34], 0x34
call edi
mov eax, 1
cmp esi, 0xffffffff
mov dword [esp + 0x6c], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x9c], ebx
je 0x406d0b
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x34
lea ecx, [esp + 0x80]
push ecx
push 0x222000
push esi
mov dword [esp + 0x38], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 3
mov dword [esp + 0x78], ebx
mov dword [esp + 0x9c], ebx
je 0x406d45
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x34
lea eax, [esp + 0x80]
push eax
push 0x222000
push esi
mov dword [esp + 0x3c], 0x34
call edi
cmp esi, 0xffffffff
mov dword [esp + 0x6c], 2
mov dword [esp + 0x78], ebx
je 0x406d92
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x34
lea edx, [esp + 0x80]
push edx
push 0x222000
push esi
mov dword [esp + 0x30], 0x34
call edi
mov eax, dword [0x5c482c]
push ebx
push ebx
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x406ddb
mov al, byte [0x5c4730]
test al, 2
mov ecx, 0x11
mov esi, 0x5c4718
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x406df9
mov ecx, 1
test cl, al
mov dword [esp + 0x28], ecx
je 0x406dd0
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x20]
call fcn.004fcee0
mov eax, ebx
xor ecx, ecx
cmp eax, ebx
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.00524c67
mov esp, ebp
pop ebp
ret
test al, 1
je 0x406e07
mov dword [esp + 0x24], 1
jmp 0x406dd0
mov eax, DirectSoundCreate
jmp 0x406ddb
Function at 0x4147b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x547d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x5b3720]
xor eax, esp
mov dword [esp + 0x408], eax
push esi
push edi
mov eax, dword [0x5b3720]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
xor esi, esi
push 0x3fe
lea eax, [esp + 0x1a]
push esi
push eax
mov word [esp + 0x20], si
call fcn.00526c60
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4148bd
mov word [esp + 0x21a], si
call fcn.005081a0
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x41483d
push 0x80004005
call fcn.004021d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push str.SoundRecorder.exe
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push str._s_s
push edx
mov dword [esp + 0x430], esi
call fcn.00402620
mov esi, dword [esp + 0x1c]
add esp, 0xc
add esi, 0xfffffff0
mov dword [esp + 0x14], esp
mov edi, esp
push esi
call fcn.00402380
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00426620
mov edi, eax
add esp, 4
mov dword [esp + 0x420], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4148b9
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
jmp 0x4148bf
xor eax, eax
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00524c67
add esp, 0x418
ret
Function at 0x4162f0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
cmp dword [esp + 8], 0
push esi
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
mov dword [esp + 0x14], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
je 0x41639b
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416357
mov esi, dword [esp + 0xc]
push 0x566c94
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push 0x566c94
push 1
push 0
push str.RTSndMgr.cpl
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x416415
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, 0x20006
lea esi, [esp + 0xc]
call fcn.004170d0
push reloc.DSOUND.dll_DirectSoundCreate
mov ecx, 0x2001f
mov edx, str.Control_Paneldont_load
call fcn.00411620
test eax, eax
jne 0x4163f9
mov edx, esi
push str.RTSndMgr.cpl
push edx
mov esi, 0x566c94
call fcn.00417120
jmp 0x416411
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4163b7
mov esi, dword [esp + 0xc]
push str.RTSndMgr.cpl
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x416415
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_Paneldont_load
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, 0x20006
lea esi, [esp + 0xc]
call fcn.004170d0
push reloc.DSOUND.dll_DirectSoundCreate
mov ecx, 0x2001f
mov edx, str.Control_Paneldont_load
call fcn.00411620
test eax, eax
jne 0x4163f9
mov esi, dword [esp + 4]
push str.RTSndMgr.cpl
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x416415
push str.Control_Paneldont_load
push reloc.DSOUND.dll_DirectSoundCreate
mov edx, 0x20006
lea esi, [esp + 0xc]
call fcn.004170d0
mov esi, dword [esp + 4]
test esi, esi
je 0x416420
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x4171b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41721e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x4171ef
cmp eax, 2
jne 0x41720a
test esi, esi
mov eax, dword [esp]
je 0x417218
test eax, eax
je 0x417213
test al, 1
jne 0x41720a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x417218
mov eax, 0xd
pop ecx
ret 8
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x41f0d0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x54ad50
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3720]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x30]
call fcn.005071e8
lea eax, [esp + 0x60]
push eax
xor ebx, ebx
mov dword [esp + 0x84], ebx
mov ecx, dword [esi + 4]
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call edi
push eax
lea ecx, [esp + 0x34]
call fcn.005076f6
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x34]
push esi
push edx
call fcn.00507a42
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], eax
call fcn.005071e8
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.CBrush.0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], vtable.CBitmap.0
push ebx
mov byte [esp + 0x84], 3
call edi
push eax
lea ecx, [esp + 0x44]
call fcn.005076f6
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x2c]
call fcn.005079bd
push 0xc0c0c0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x24]
call fcn.005079bd
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x44]
push eax
push ecx
call fcn.00507a42
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x58], edx
push ecx
lea edx, [esp + 0x54]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [esp + 0x44]
mov ebp, dword [sym.imp.GDI32.dll_GetPixel]
push 1
push 1
push ecx
call ebp
lea ecx, [esp + 0x20]
mov ebx, eax
call fcn.00507a10
test esi, esi
je 0x41f20c
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x44]
push esi
push edx
call fcn.00507a42
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
xor edi, edi
cmp dword [esp + 0x64], edi
mov dword [esp + 0x18], eax
jle 0x41f268
mov eax, dword [esp + 0x68]
xor esi, esi
test eax, eax
jle 0x41f25f
mov eax, dword [esp + 0x34]
push esi
push edi
push eax
call ebp
cmp eax, ebx
jne 0x41f254
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
push ecx
push esi
push edi
push edx
call dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [esp + 0x68]
add esi, 1
cmp esi, eax
jl 0x41f235
add edi, 1
cmp edi, dword [esp + 0x64]
jl 0x41f22f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41f273
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.00507a42
mov byte [esp + 0x80], 2
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.CBitmap.0
call fcn.00402490
mov byte [esp + 0x80], 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], vtable.CBrush.0
call fcn.00402490
lea ecx, [esp + 0x40]
mov byte [esp + 0x80], 0
call fcn.00507770
lea ecx, [esp + 0x30]
mov dword [esp + 0x80], 0xffffffff
call fcn.00507770
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret