joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c510
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x41c55f
lea eax, [esp + 4]
push 1
push eax
lea ecx, [esi + 0x80]
mov dword [esi + 0x5c], 0
call fcn.0041b980
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x41c55f
mov ecx, dword [eax + 0x2c]
push 0x7d0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esi + 0x7c]
test esi, esi
je 0x41c55f
mov edx, dword [esi + 0x2c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret

Function at 0x41e940
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push esi
push edi
push eax
push str.SoftwareStaccatoSCaDLSL
mov edi, ecx
push 0x80000002
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41e9c5
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push esi
push str.DLSL_EXELOCATION
push ecx
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41e99f
lea edx, [esp + 0x14]
mov ecx, edi
push edx
call fcn.0041efd0
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41e9c5
mov eax, dword [esp + 0x118]
test eax, eax
je 0x41e9c5
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
pop esi
add esp, 0x10c
ret 8
Function at 0x41e9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42c13b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0xc]
xor esi, esi
push eax
push str.SoftwareMicrosoftMediaPlayer
push 0x80000002
mov dword [esp + 0x230], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41eae4
lea ecx, [esp + 0x14]
push ebx
lea edx, [esp + 0x120]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push esi
push str.Installation_Directory
push ecx
mov dword [esp + 0x30], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x41eac1
lea edx, [esp + 0x120]
lea eax, [esp + 0x20]
push edx
push eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x20]
push str.wmplayer.exe
push ecx
call ebx
lea edx, [esp + 0x20]
mov ecx, edi
push edx
call fcn.0041efd0
mov esi, eax
test esi, esi
jne 0x41eac1
lea eax, [esp + 0x120]
lea ecx, [esp + 0x20]
push eax
push ecx
call ebp
lea edx, [esp + 0x20]
push str.mplayer2.exe
push edx
call ebx
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.0041efd0
mov esi, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop ebx
je 0x41eae4
mov eax, dword [esp + 0x22c]
test eax, eax
je 0x41eae4
lea edx, [esp + 0x1c]
push edx
push eax
call ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x224], 0xffffffff
call fcn.00428ee4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x21c
ret 8

Function at 0x41eb20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp + 0xc]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
mov ebx, ecx
push eax
xor esi, esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x1c]
push 0x4376dc
push ecx
call edi
lea edx, [esp + 0x1c]
push 0x437b44
push edx
call edi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41ebdc
lea edx, [esp + 0x14]
lea eax, [esp + 0x120]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push esi
push str.SBDemo
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41ebb7
lea eax, [esp + 0x120]
mov ecx, ebx
push eax
call fcn.0041efd0
mov esi, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41ebdc
mov eax, dword [esp + 0x228]
test eax, eax
je 0x41ebdc
lea edx, [esp + 0x120]
push edx
push eax
call ebp
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
Function at 0x41ebf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c171
push eax
mov dword fs:[0], esp
sub esp, 0x230
lea eax, [esp]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push esi
push edi
push eax
push str.SoftwareAnalog_DevicesSMax4WizSettings
mov edi, ecx
push 0x80000001
xor esi, esi
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41ec7d
lea ecx, [esp + 0x14]
lea edx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push esi
push str.FilePath
push ecx
mov dword [esp + 0x2c], 0x200
call ebx
test eax, eax
jne 0x41ec6a
lea edx, [esp + 0x40]
mov ecx, edi
push edx
call fcn.0041efd0
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41ed91
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsSMax4Wiz.exe
push 0x80000002
call ebp
test eax, eax
jne 0x41ecdc
lea edx, [esp + 0x14]
lea eax, [esp + 0x40]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push 0x43828c
push edx
mov dword [esp + 0x2c], 0x200
call ebx
test eax, eax
jne 0x41ecc9
lea eax, [esp + 0x40]
mov ecx, edi
push eax
call fcn.0041efd0
mov esi, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41ed91
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::CFileFind
lea edx, [esp + 0x20]
mov ecx, 0x438468
push edx
mov dword [esp + 0x24c], 0
call fcn.00401ed0
push str.SMax4Wiz.exe
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x250], 1
push eax
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x20]
mov byte [esp + 0x248], 3
call fcn.00428ee4
push 0
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBuffer
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFileFind::FindFile
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x248], 0
call fcn.00428ee4
lea ecx, [esp + 0x24]
mov dword [esp + 0x248], 0xffffffff
call fcn.00429046
test esi, esi
je 0x41eda8
mov eax, dword [esp + 0x250]
test eax, eax
je 0x41eda8
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x240]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x23c
ret 8
Function at 0x41edd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c1c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push esi
push edi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 8]
mov dword [esp + 0x240], 0
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0xc]
mov ecx, 0x438468
push eax
mov byte [esp + 0x244], 1
call fcn.00401ed0
push str.SMHelp.exe
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x24c], 2
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x244], 3
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x240], 2
call fcn.00428ee4
lea ecx, [esp + 0xc]
mov byte [esp + 0x240], 1
call fcn.00428ee4
push 0
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindFile
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, eax
test esi, esi
jne 0x41ef68
lea edx, [esp + 0x10]
mov ecx, 0x438468
push edx
mov byte [esp + 0x138], 0
call fcn.00401ed0
push str.HelpHelp.chm
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x248], 4
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x244], 5
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x240], 4
call fcn.00428ee4
lea ecx, [esp + 0x10]
mov byte [esp + 0x240], 1
call fcn.00428ee4
push 0
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0x30]
push eax
push ecx
call edi
lea edx, [esp + 0x30]
push 0
push edx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindFile
mov esi, eax
test esi, esi
je 0x41ef87
lea eax, [esp + 0x134]
lea ecx, [esp + 0x30]
push eax
push 0x43828c
push ecx
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
ja 0x41ef68
xor esi, esi
jmp 0x41ef87
mov eax, dword [esp + 0x248]
test eax, eax
je 0x41ef87
mov edx, dword [esp + 0x24c]
lea ecx, [esp + 0x30]
push ecx
push eax
mov byte [esp + edx + 0x37], 0
call edi
lea ecx, [esp + 8]
mov byte [esp + 0x240], 0
call fcn.00428ee4
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], 0xffffffff
call fcn.00429046
mov ecx, dword [esp + 0x238]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x23c
ret 8

Function at 0x41f060
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0
push 8
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
add esp, 0x54
ret 4
Function at 0x41f2a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x13c
lea eax, [esp + 0x3c]
push esi
push 0x100
mov esi, ecx
push eax
call fcn.0041edd0
cmp eax, 1
jne 0x41f287
xor eax, eax
lea edx, [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x40]
mov eax, 0x43828c
push edx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x14], str.open
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop esi
add esp, 0x13c
ret
cmp eax, 2
jne 0x41f298
lea eax, [esp + 0x40]
mov ecx, esi
push eax
call fcn.0041f060
pop esi
add esp, 0x13c
ret
jmp 0x41f220
Function at 0x4234e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x12c
mov ecx, 0xa
push esi
push edi
lea esi, [eax + 0x60]
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push eax
call fcn.00426da0
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
add esp, 4
push eax
push edi
push 5
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
jne 0x42352a
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax + 2], 0xffff
jne 0x423546
add eax, 0x1a
jmp 0x423549
add eax, 0x12
mov cx, word [eax]
test cx, cx
je 0x423566
cmp cx, 0xffff
jne 0x42355d
add eax, 4
jmp 0x423569
add eax, 2
cmp word [eax], 0
jne 0x42355d
add eax, 2
mov cx, word [eax]
test cx, cx
je 0x423586
cmp cx, 0xffff
jne 0x42357d
add eax, 4
jmp 0x423589
add eax, 2
cmp word [eax], 0
jne 0x42357d
add eax, 2
push 0
push 0
lea ecx, [esp + 0x38]
push 0x104
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4235d2
mov esi, dword [esp + 0x13c]
push str._n
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::operator_1
pop edi
pop esi
add esp, 0x12c
ret 8
Function at 0x4242e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42ca08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_AfxGetPropSheetFont
test eax, eax
jne 0x424347
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00428ee4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x30]
lea eax, [esp + 6]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CDialogTemplate::GetFont
add esp, 0xc
test eax, eax
je 0x4243c5
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x4243c5
mov cx, word [esp + 6]
cmp cx, word [esp + 0x10]
jne 0x4243c5
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], al
call fcn.00428ee4
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00428ee4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
push esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CDialogTemplate::CDialogTemplate
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
push edx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CDialogTemplate::SetFont
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CDialogTemplate::Detach
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0x28], 1
call fcn.004293a0
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00428ee4
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00428ee4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x4245b0
Capabilities:
Capture microphone audio

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x4245ee
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 8]
push 0x50000
push edi
push eax
push ecx
push edx
push esi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x4245ee
push 1
mov ecx, esi
call fcn.004248a0
pop edi
mov eax, 1
pop esi
ret 4
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x424990
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42ca4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi], 0x430268
mov dword [esi + 8], ebx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
call sub.MFC42.DLL_CFileFind::CFileFind
lea eax, [esp + 0x13c]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push eax
mov dword [esp + 0x250], ebx
mov byte [esp + 0x40], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x13c]
push 0x4376dc
push ecx
call edi
lea edx, [esp + 0x13c]
push 0x437b44
push edx
call edi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x13c]
push eax
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x424a67
lea edx, [esp + 0x14]
lea eax, [esp + 0x38]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.SBLivePath
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x38]
push str.Creative.btn
push ecx
call edi
lea edx, [esp + 0x38]
push ebx
push edx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x424add
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x424add
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetButtonInfo
push eax
mov ebp, 1
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x424ab4
xor ebp, ebp
mov ecx, dword [esi + 8]
push str.ButtonPushed
push ecx
call edi
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x424aca
cmp ebp, ebx
jne 0x424add
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x248], 0xffffffff
call fcn.00429046
mov ecx, dword [esp + 0x240]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x23c
ret
Function at 0x424bd0
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42ca7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
lea ecx, [esi + 0xc]
call sub.MFC42.DLL_CFileFind::CFileFind
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [esp + 0x108], edi
call sub.MFC42.DLL_CString::CString
mov ebx, 1
mov dword [esi], 0x430278
mov byte [esp + 0x108], bl
mov dword [esi + 8], edi
mov dword [esi + 0x34], edi
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.00424da0
lea ecx, [esp + 0x10]
mov dword [esi + 0x2c], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push ecx
push str.SoftwareAnalog_DevicesSMax4Settings
push 0x80000001
mov dword [esp + 0x24], edi
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x424c97
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
push str.ShowAllSkins
push edx
mov dword [esp + 0x2c], 4
call ebp
test eax, eax
je 0x424c8c
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], edi
je 0x424ca6
mov dword [esi + 0x2c], 0xffffffff
jmp 0x424d02
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push 0x80000001
call ebx
test eax, eax
jne 0x424d02
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
mov ebx, 0xdc
push str.SysCaps
push edx
mov dword [esp + 0x2c], ebx
call ebp
test eax, eax
jne 0x424cf7
cmp dword [esp + 0x14], ebx
jne 0x424cf7
cmp dword [esp + 0x58], edi
je 0x424cf7
mov dword [esi + 0x2c], 2
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x100]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xfc
ret
Function at 0x424df0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, 1
call fcn.00424da0
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x34], eax
je 0x424f16
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetGeneral
push eax
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x424e2d
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetBitmap
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x424e41
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetButton
push ecx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x424e55
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetGraph
push edx
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x34]
push str.GetIcon
push eax
call edi
test eax, eax
mov dword [esi + 0x50], eax
jne 0x424e77
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetKnob
push ecx
call edi
test eax, eax
mov dword [esi + 0x54], eax
jne 0x424e8b
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetString
push edx
call edi
test eax, eax
mov dword [esi + 0x60], eax
jne 0x424e9f
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetText
push eax
call edi
test eax, eax
mov dword [esi + 0x64], eax
jne 0x424eb3
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetSkinVersion
push ecx
call edi
test eax, eax
mov dword [esi + 0x58], eax
jne 0x424ec7
xor ebx, ebx
mov edx, dword [esi + 0x34]
push str.GetVUMeter
push edx
call edi
test eax, eax
mov dword [esi + 0x68], eax
jne 0x424edb
xor ebx, ebx
mov eax, dword [esi + 0x34]
push str.GetBackground
push eax
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x424eef
xor ebx, ebx
mov ecx, dword [esi + 0x34]
push str.GetSlider
push ecx
call edi
test eax, eax
mov dword [esi + 0x5c], eax
je 0x424f39
test ebx, ebx
je 0x424f3b
call dword [esi + 0x58]
cmp eax, 2
jne 0x424f39
push ebp
lea ecx, [esi + 0x28]
call fcn.00428fc8
mov ecx, esi
call fcn.00424f70
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x2c]
test eax, edx
jne 0x424f42
mov ecx, esi
xor edi, edi
call fcn.00424da0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
xor ebx, ebx
mov ecx, esi
call fcn.00424da0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 4
Function at 0x4250e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, 0x41
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push str.SoftwareAnalog_DevicesSMax4Settings
push 0x80000001
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42514c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.SkinPath
push ecx
mov dword [esp + 0x2c], 0x104
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x42519c
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareAnalog_DevicesSMax4Settings
push 0x80000002
call ebp
test eax, eax
jne 0x42519c
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.SkinPath
push edx
mov dword [esp + 0x2c], 0x104
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00424df0
test eax, eax
jne 0x425201
mov ecx, esi
call fcn.00425210
mov edi, eax
test edi, edi
je 0x4251ff
lea edx, [esp + 0x10]
push edx
push str.SoftwareAnalog_DevicesSMax4Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4251ff
mov eax, dword [esi + 0x28]
lea ecx, [esi + 0x28]
mov eax, dword [eax - 8]
push eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.SkinPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret