joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x432705
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push esi
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_2
push 0x70
lea ecx, [esp + 8]
mov dword [esp + 0x124], 1
call sub.MFC42.DLL_CString::LoadStringA
lea eax, [esp + 0xc]
push eax
push str.SoftwareStaccatoSCaCP_
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d4ff
mov eax, dword [esp + 0x12c]
mov dword [esp + 8], 0x100
test eax, eax
je 0x41d48f
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.CP_AUDIODOCTOR_SUPPORT_URL
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d4f4
lea edx, [esp + 0x18]
push edx
jmp 0x41d4eb
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.CP_VENDORLINK
push eax
call esi
test eax, eax
jne 0x41d4bd
lea ecx, [esp + 0x18]
push ecx
jmp 0x41d4eb
lea edx, [esp + 8]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.CP_SMAXLINK
push edx
mov dword [esp + 0x20], 0x100
call esi
test eax, eax
jne 0x41d4f4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x128]
lea edx, [esp + 4]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x14], 1
lea ecx, [esp + 4]
mov byte [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret 8

Function at 0x41d570
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xe4]
test eax, eax
jne 0x41d619
lea eax, [esp + 0xc]
mov dword [esi + 0xe4], 1
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push reloc.DSOUND.dll_DirectSoundCreate
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d5f6
lea ecx, [esp + 8]
lea edx, [esi + 0x1b4]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push edi
push str.SysCaps
push ecx
mov dword [esp + 0x20], 0xd0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d5e7
cmp dword [esp + 8], 0xd0
jne 0x41d5e7
mov edi, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x41d619
mov ecx, 0x34
xor eax, eax
lea edi, [esi + 0x1b4]
rep stosd dword es:[edi], eax
mov dword [esi + 0x208], 1
mov dword [esi + 0x20c], 1
lea eax, [esi + 0x1b4]
pop edi
pop esi
add esp, 0xc
ret
Function at 0x41d630
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43272c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
lea ecx, [esi + 0xc]
call sub.MFC42.DLL_CFileFind::CFileFind
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [esp + 0xfc], edi
call sub.MFC42.DLL_CString::CString_2
mov ebx, 1
mov dword [esi], 0x437670
mov byte [esp + 0xfc], bl
mov dword [esi + 8], edi
mov dword [esi + 0x34], edi
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.0041d800
lea ecx, [esp + 0x10]
mov dword [esi + 0x2c], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push ecx
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x24], edi
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d6f7
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
push str.ShowAllSkins
push edx
mov dword [esp + 0x2c], 4
call ebp
test eax, eax
je 0x41d6ec
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], edi
je 0x41d706
mov dword [esi + 0x2c], 0xffffffff
jmp 0x41d762
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push reloc.DSOUND.dll_DirectSoundCreate
call ebx
test eax, eax
jne 0x41d762
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
mov ebx, 0xd0
push str.SysCaps
push edx
mov dword [esp + 0x2c], ebx
call ebp
test eax, eax
jne 0x41d757
cmp dword [esp + 0x14], ebx
jne 0x41d757
cmp dword [esp + 0x58], edi
je 0x41d757
mov dword [esi + 0x2c], 2
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xf4]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xf0
ret
Function at 0x41d850
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, 1
call fcn.0041d800
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x34], eax
je 0x41d976
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetGeneral
push eax
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x41d88d
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetBitmap
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x41d8a1
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetButton
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x41d8b5
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetGraph
push edx
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x34]
push str.GetIcon
push eax
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x41d8d7
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetKnob
push ecx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x41d8eb
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetString
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x41d8ff
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetText
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x41d913
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetSkinVersion
push ecx
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x41d927
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetVUMeter
push edx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x41d93b
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetBackground
push eax
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x41d94f
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetSlider
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
je 0x41d999
test ebx, ebx
je 0x41d99b
call dword [esi + 0x58]
cmp eax, 2
jne 0x41d999
push ebp
lea ecx, [esi + 0x28]
call sub.MFC42.DLL_CString::operator_1
mov ecx, esi
call fcn.0041d9d0
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x2c]
test eax, edx
jne 0x41d9a2
mov ecx, esi
xor edi, edi
call fcn.0041d800
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
xor ebx, ebx
mov ecx, esi
call fcn.0041d800
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 4
Function at 0x41daa0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, 0x41
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundCreate
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41db0c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.SkinPath
push ecx
mov dword [esp + 0x2c], 0x104
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x41db5c
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundEnumerateA
call ebp
test eax, eax
jne 0x41db5c
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.SkinPath
push edx
mov dword [esp + 0x2c], 0x104
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0041d850
test eax, eax
jne 0x41dbc1
mov ecx, esi
call fcn.0041dbd0
mov edi, eax
test edi, edi
je 0x41dbbf
lea edx, [esp + 0x10]
push edx
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41dbbf
mov eax, dword [esi + 0x28]
lea ecx, [esi + 0x28]
mov eax, dword [eax - 8]
push eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.SkinPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x41dbd0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43276b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push eax
mov dword [esp + 0x230], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.SoundMAX
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x11c]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push edx
push eax
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41dc83
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Path
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x11c]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::operator_1
push str._res.skn
lea ecx, [esp + 0xc]
call fcn.0042f390
mov ecx, esi
call fcn.0041d800
mov eax, dword [esp + 8]
mov edx, dword [esi + 0xc]
lea ecx, [esi + 0xc]
push 0
push eax
call dword [edx + 0x48]
push 0x440948
mov ecx, esi
mov dword [esi + 4], eax
call fcn.0041d850
mov edi, eax
test edi, edi
jne 0x41dcd7
mov ecx, esi
call fcn.0041dd10
mov edi, eax
lea ecx, [esp + 8]
mov dword [esp + 0x228], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x220]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x224
ret
Function at 0x41e420
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x432816
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
call fcn.00408d50
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], 0
call fcn.00408d50
mov byte [esp + 0x124], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov si, ax
lea eax, [esp + 0x18]
push 0x104
push eax
push 2
push 0x400
and esi, 0xffff
call ebp
push 0xcc
lea ecx, [esp + 0x14]
call fcn.00408d60
push 0x43f114
lea ecx, [esp + 0x14]
call fcn.0042f390
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.0042f390
push 0x409
push 0xcc
lea ecx, [esp + 0x1c]
call fcn.00408e30
push 0x43f114
lea ecx, [esp + 0x18]
call fcn.0042f390
lea edx, [esp + 0x18]
lea ecx, [esp + 0x14]
push edx
call fcn.0042f390
mov ebx, dword [esp + 0x12c]
lea eax, [esp + 0x14]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push ebx
mov ecx, edi
call fcn.00411a10
lea edx, [esp + 0x18]
push 0x104
push edx
push 2
push esi
call ebp
push 0xcd
lea ecx, [esp + 0x14]
call fcn.00408d60
push 0x43f114
lea ecx, [esp + 0x14]
call fcn.0042f390
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call fcn.0042f390
push 0x409
push 0xcd
lea ecx, [esp + 0x1c]
call fcn.00408e30
push 0x43f114
lea ecx, [esp + 0x18]
call fcn.0042f390
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
call fcn.0042f390
lea edx, [esp + 0x14]
push 0
lea eax, [esp + 0x14]
push edx
push eax
push 0
push ebx
mov ecx, edi
call fcn.00411a10
lea ecx, [esp + 0x14]
mov byte [esp + 0x124], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x124], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x118
ret 4
Function at 0x41f730
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xdc
push esi
mov esi, ecx
push edi
push 0
lea edi, [esi + 8]
mov dword [esi], 0x43791c
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x41f799
push str.DSound.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x41f799
push str.DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi + 0x10], eax
je 0x41f799
push 0
push edi
push 0
call eax
test eax, eax
jge 0x41f799
mov dword [edi], 0
lea eax, [esp + 8]
mov dword [esi + 4], 0
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41f807
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
mov edi, 0xd0
push str.SysCaps
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41f7fc
cmp dword [esp + 0xc], edi
jne 0x41f7fc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41f7fc
mov dword [esi + 4], 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0xdc
ret

Function at 0x41f870
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
mov esi, ecx
push reloc.DSOUND.dll_DirectSoundEnumerateA
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41f8cb
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.Speaker_Configuration
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
mov ecx, esi
push eax
call fcn.0041f8e0
pop esi
add esp, 0x10
ret

Function at 0x41fa50
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
mov esi, ecx
push reloc.DSOUND.dll_DirectSoundEnumerateA
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41fa9e
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push eax
push str.Speaker_Configuration
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41fa93
mov edi, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 8]
test eax, eax
je 0x41fab9
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41fab9
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0041fae0
test edi, edi
pop edi
pop esi
je 0x41fad5
mov edx, dword [0x440be8]
push 0
push 0
push edx
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
pop ecx
ret 8
Function at 0x4241e0
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push str.CSpeakerConfigDlg2::ConfigHeadphones__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebp, ebp
xor ebx, ebx
lea ecx, [edi + 0xaa8]
mov eax, dword [ebx + ecx + 0x34]
lea esi, [ebx + ecx]
test eax, eax
je 0x424231
cmp eax, 1
je 0x42421f
cmp eax, 2
je 0x42421f
cmp eax, 0xd
je 0x42421f
cmp eax, 3
je 0x42421f
cmp eax, 0xc
jne 0x42423c
test eax, eax
je 0x424231
cmp eax, 0xc
je 0x424231
mov dword [esi + 0x24], 0
jmp 0x42423c
push ebp
push 1
push ecx
mov ecx, edi
call fcn.00425290
push esi
mov ecx, edi
call fcn.00424560
lea ecx, [edi + 0xb5c]
mov eax, dword [ebx + ecx + 0x34]
lea esi, [ebx + ecx]
test eax, eax
je 0x424280
cmp eax, 1
je 0x42426e
cmp eax, 2
je 0x42426e
cmp eax, 0xd
je 0x42426e
cmp eax, 3
je 0x42426e
cmp eax, 0xc
jne 0x42428b
test eax, eax
je 0x424280
cmp eax, 0xc
je 0x424280
mov dword [esi + 0x24], 0
jmp 0x42428b
push ebp
push 1
push ecx
mov ecx, edi
call fcn.00425290
push esi
mov ecx, edi
call fcn.00424560
add ebx, 0x3c
inc ebp
cmp ebx, 0xb4
jl 0x4241f5
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x426e00
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x433c98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
call fcn.00408d50
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
mov ecx, esi
mov dword [esi + 0x60], 3
mov eax, dword [0x440abc]
push eax
call fcn.00406720
push 0x9c9c9c
push 0xff00
push 0xff
push 0x3c3c3c
push 0xaeaeae
push 0
push 0
push 0xdcdcdc
mov ecx, esi
call fcn.004066b0
push 0x8c8c8c
push 0
push 0xffffff
push 0xffffff
mov ecx, esi
call fcn.00406670
push 0x6e6e6e
mov ecx, esi
call fcn.00406740
push 0xd
push 0x12
mov ecx, esi
call fcn.00408a20
mov dword [esi + 0xb4], 1
mov dword [esi + 0xa4], 0
mov edi, dword [edi + 0x20]
push 0x55
lea ecx, [esp + 0xc]
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], esi
call fcn.00408d60
push 0x400c
push 0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov ecx, esi
call fcn.004089d0
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
push 0
push 0x408
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0xa
push 0
push 0x415
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0x64
push 0
push 0x404
push edx
call edi
mov eax, dword [esi + 0x20]
push 0x54
push 0
push 0x404
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0x43
push 0
push 0x404
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0x32
push 0
push 0x404
push edx
call edi
mov eax, dword [esi + 0x20]
push 0x22
push 0
push 0x404
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0x11
push 0
push 0x404
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0
push 0
push 0x404
push edx
call edi
lea ecx, [esp + 8]
mov dword [esi + 0xac], 1
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x429ac0
Capabilities:
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push 0
push 2
push esi
push 0x429690
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0x1e7c], eax
je 0x429afe
mov ecx, 1
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x1e7c]
mov dword [esi + 0x1dc8], ecx
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret
Function at 0x42de50
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x434461
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1fc
mov eax, dword [esp + 0x21c]
mov edx, dword [esp + 0x220]
mov dword [ecx + 0x154], eax
mov eax, dword [esp + 0x224]
mov dword [ecx + 0x158], edx
mov edx, dword [esp + 0x228]
mov dword [ecx + 0x168], eax
mov eax, dword [esp + 0x22c]
mov dword [ecx + 0x16c], edx
mov edx, dword [esp + 0x230]
push ebx
mov ebx, dword [esp + 0x21c]
mov dword [ecx + 0x170], eax
mov eax, dword [esp + 0x238]
mov dword [ecx + 0x174], edx
mov edx, dword [esp + 0x23c]
push ebp
mov ebp, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x220]
mov dword [ecx + 0x150], eax
mov eax, dword [esp + 0x24c]
mov dword [ecx + 0x15c], edx
mov edx, dword [esp + 0x250]
mov dword [ecx + 0x160], esi
mov dword [ecx + 0x164], edi
mov dword [ecx + 0x180], ebp
mov dword [ecx + 0x184], ebx
mov dword [ecx + 0x178], eax
mov dword [ecx + 0x17c], edx
mov dword [ecx + 0x98], 1
lea ecx, [esp + 0x1c]
call fcn.0040c7f0
lea ecx, [esp + 0x14]
mov dword [esp + 0x214], 0
call sub.MFC42.DLL_CString::CString_2
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x218], 1
call fcn.0040cd20
lea eax, [esp + 0x8c]
lea ecx, [esp + 0x14]
push eax
call fcn.0042f37e
lea ecx, [esp + 0x10c]
push str.VolSpkrs__
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::GetBuffer
lea edx, [esp + 0x10c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x18]
push eax
push str.SoftwareAnalog_DevicesSMax4Settings
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42e078
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x250]
mov edx, dword [esp + 0x24c]
mov eax, dword [esp + 0x248]
push ecx
mov ecx, dword [esp + 0x248]
push edx
mov edx, dword [esp + 0x248]
push eax
mov eax, dword [esp + 0x248]
push ecx
mov ecx, dword [esp + 0x248]
push edx
mov edx, dword [esp + 0x248]
push eax
mov eax, dword [esp + 0x248]
push ecx
mov ecx, dword [esp + 0x248]
push edx
push eax
push ecx
push ebx
push ebp
push edi
push esi
lea edx, [esp + 0x48]
push str._i__i__i__i__i__i__i__i__i__i__i__i__i__i
push edx
mov byte [esp + 0x254], 2
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x50]
add esp, 0x40
lea ecx, [esp + 0x10]
mov eax, dword [eax - 8]
push eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
mov edx, dword [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x118]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov byte [esp + 0x214], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x214], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x214], 0xffffffff
call fcn.0040c8b0
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x208
ret 0x38