joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10199b1
Capabilities:
Create thread

Disassembly:
push 0x1d4
mov eax, 0x101a43b
call fcn.0100c0be
mov esi, ecx
xor ebx, ebx
mov byte [0x101e6f4], 1
cmp byte [esi], bl
je 0x1019b0c
lea ecx, [esi + 4]
mov dword [ebp - 0x1b4], ebx
call fcn.01018987
test eax, eax
jbe 0x1019a32
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x1b4]
lea edi, [eax + ecx*8]
lea eax, [ebp - 0x1d4]
push eax
mov eax, dword [edi + 4]
push ebx
push dword [eax + 0x20]
push 0x101894e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x1b4]
mov dword [edi], eax
mov eax, dword [esi + 8]
cmp dword [eax + ecx*8], ebx
je 0x1019a95
inc dword [ebp - 0x1b4]
lea ecx, [esi + 4]
call fcn.01018987
cmp dword [ebp - 0x1b4], eax
jb 0x10199e5
cmp byte [ebp + 8], bl
je 0x1019bae
lea ecx, [esi + 4]
mov dword [ebp - 0x1b4], ebx
call fcn.01018987
lea ecx, [ebp - 0x1b4]
push ecx
push eax
lea ecx, [ebp - 0x1c4]
call fcn.01019712
lea ecx, [esi + 4]
mov dword [ebp - 4], ebx
xor edi, edi
call fcn.01018987
test eax, eax
jbe 0x1019a89
mov eax, dword [esi + 8]
mov eax, dword [eax + edi*8]
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx + edi*4], eax
lea ecx, [esi + 4]
inc edi
call fcn.01018987
cmp edi, eax
jb 0x1019a6d
cmp dword [ebp - 0x1c0], ebx
jne 0x1019ac2
xor edi, edi
jmp 0x1019ad1
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x1b4], 0x100445c
call fcn.0100b340
push 0x101b83c
lea eax, [ebp - 0x1c0]
push eax
call fcn.0100b7cf
mov edi, dword [ebp - 0x1bc]
sub edi, dword [ebp - 0x1c0]
sar edi, 2
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x3e8
push eax
push 1
push ebx
lea ecx, [ebp - 0x1c4]
call fcn.01019402
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c4]
call fcn.01018621
mov ecx, esi
call fcn.0101988f
jmp 0x1019bae
push 0x1a0
lea eax, [ebp - 0x1b0]
push ebx
push eax
call fcn.0100b750
add esp, 0xc
cmp dword [esi + 0x2c], 8
jb 0x1019b32
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x1b0], eax
jmp 0x1019b3b
add esi, 0x18
mov dword [ebp - 0x1b0], esi
lea eax, [ebp - 0x1b0]
push eax
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x30], 0x1018978
mov dword [ebp - 0x20], 0x100aa4b
call dword [sym.imp.ADVAPI32.dll_OpenTraceW]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], edx
cmp eax, 0xffffffff
jne 0x1019b9d
cmp edx, ebx
jne 0x1019b9d
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 0x1c8], 0x1004448
call fcn.0100b340
push 0x101b83c
lea eax, [ebp - 0x1e0]
jmp 0x1019abc
push ebx
push ebx
push 1
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.ADVAPI32.dll_ProcessTrace]
call fcn.0100c112
ret 8
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x525540
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
test dword [0x59b2f9], ebp
jge 0x5254df
inc ecx
not ecx
test esp, 0xa033118a
jae 0x5254ec
shl ebx, 0x13
cmp dword [0x59e75b], 0xcb2adda5
jae 0x5254fa
sub eax, edi
shr eax, 9
xor ebx, edx
and ecx, 0xee66adca
test dword [0x59b885], ecx
ja 0x52550f
or edx, esi
neg esi
rol esi, 4
xchg edx, esi
mov ecx, 0x7efddc16
mov dword [0x5a7ccd], edx
xor ebx, dword [0x59d6ec]
test eax, esp
loopne 0x5255a8
push es
and ebx, 0xc923df09
mov eax, esp
shr ebx, 0xc
mov edi, 0xab98ebfa
dec eax
not edi
and edx, 0x3003d13d
shr ebx, 0x1f
dec ecx
jne 0x52551b
mov edx, esi
ror edi, 0xe
add edi, edi
test esi, edx
jo 0x52555b
mov ecx, 0x226fb684
call fcn.004d893e
cmp dword [0x59a5c0], ebx
je 0x52556a
neg edx
rol esi, 0x15
call fcn.004cb4c5
add ecx, 0x72dd6167
mov ecx, 0x3aec3525
or eax, 0x3f035501
xor ebx, esi
rol edx, 0x1e
sub edx, ebp
mov dword [0x5a7d59], esi
add ebx, esp
call fcn.0051d3ca
and esi, 0x4c1df0c6
shl ebx, 0x16
or eax, dword [0x59c04d]
sub ebx, 0x357815d8
add eax, ecx
dec edx
add esi, dword [0x59beb1]
add dword [0x5a7c94], 0x270b7ed6
add esi, 0x147a9771
mov esi, 0xc5875e6a
add ebx, dword [0x59dcef]
rol edx, 3
or edx, esi
dec ecx
jne 0x52557d
call fcn.0051d3ca
xor ebx, ebx
shr esi, 0x1e
sub esi, 0xbbdcaef0
shl ecx, 0xc
xor esi, 0x7405403e
or edx, ebx
xor edi, 0xe1650bb5
add ecx, 0x875bd361
shr ecx, 3
ror eax, 0x1f
neg edx
xor edx, 0x952d98e7
not esi
shl edi, 5
ror esi, 6
shl eax, 3
mov ecx, 0x2d9a91dd
inc edi
and dword [0x5a7d04], ebx
xor ebx, 0x206b19ea
call fcn.00513296
or ecx, dword [0x5a7f94]
rol ecx, 0x13
xchg ecx, edx
xor edi, esi
call fcn.004e2614
xor ebx, dword [0x5a7f99]
call fcn.00444308
call fcn.005018e8
call fcn.0041153b
xor edi, esi
xchg ecx, edx
ror ecx, 0x13
xor ebx, 0x206b19ea
dec edi
or ecx, 0x97632920
ror edi, 0xc
or dword [0x5a7cee], eax
xchg ebx, edx
add edi, dword [0x5a7e9d]
sub dword [0x5a7d71], ebx
call fcn.0041a405
ror edx, 0x12
add eax, edx
add eax, dword [0x5a7e7f]
dec edx
xchg eax, edx
sub eax, ebp
and dword [0x5a7d3a], edi
xchg ecx, eax
add eax, dword [0x5a7ec2]
call fcn.004cf315
xor ebx, dword [0x5a7ec8]
mov dword [0x5a7df1], 0xb9c38653
sub eax, 0x7a9de171
rol eax, 6
call fcn.004c1f9b
call fcn.004bfbfd
ror eax, 6
add eax, 0x7a9de171
sub dword [0x5a7e0d], 0x1ea94429
Function at 0x404510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4105a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x412ef8
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call sub.MFC42.DLL_CPtrArray::CPtrArray
mov dword [ebx], 0x412ee4
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call sub.MFC42.DLL_CPtrArray::CPtrArray
or eax, 0xffffffff
push 0x417280
mov dword [ebx], 0x412ea8
push edi
mov dword [esi], 0x412ebc
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x408c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x410b20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, esi
mov ebp, ecx
push edi
xor edi, edi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0x412f28
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edi
call fcn.00404670
test eax, eax
je 0x408cce
push 0xf
jmp 0x408cd0
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x408cf1
push 0x3fe33333
push 0x33333333
push eax
call fcn.00405590
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
call fcn.00404660
test eax, eax
je 0x408d49
mov eax, dword [edi + 4]
push 0xf
lea edx, [esp + 0x1c]
push 2
push edx
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
push 7
test eax, eax
jne 0x408d6d
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, 4
push eax
add edx, 4
push ecx
push edx
push edi
mov ecx, ebp
call fcn.00407be0
jmp 0x408d85
call ebx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
add ecx, 5
add eax, 4
push eax
push ecx
push edi
mov ecx, ebp
call fcn.00407a50
mov dword [esp + 0x10], 0x412c44
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x4092f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
and esi, 0xffff
push 2
push esi
call sub.MFC42.DLL_AfxFindResourceHandle
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
push 2
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x40932d
xor ebx, ebx
push 2
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x40932d
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40933e
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x40934e
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.004092b0
add esp, 4
cmp ax, 0x10
je 0x409364
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push edi
push ebx
call sub.MFC42.DLL_AfxLoadSysColorBitmap
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x409560
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4172a0]
sub esp, 0x134
test eax, eax
jne 0x409635
lea eax, [esp]
mov dword [0x4172a0], 1
push eax
push 0x20019
push 0
push 0x417090
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409635
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409628
mov ecx, 5
mov esi, 0x417078
lea edi, [esp + 0x14]
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x409628
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409628
mov dword [0x41729c], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [0x41729c]
add esp, 0x134
ret

Function at 0x40a040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x410c5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x412f58
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x40a0d0
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x40a097
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x40a0c1
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x40a0d6
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x40a0d6
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x412c44
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x412c30
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040f856
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40cc60
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40cd5b
push 0x94
mov ebx, 1
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x40cdd3
mov ecx, 0x25
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x40ccc6
push esi
mov ebx, 5
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 5
jne 0x40cdc9
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x40cceb
push esi
mov ebx, 6
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 5
jne 0x40cdc9
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x40cd10
push esi
mov ebx, 6
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 5
jne 0x40cdc9
cmp dword [esi + 8], ebx
jne 0x40cd33
push esi
mov ebx, 7
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 5
jne 0x40cdc9
cmp dword [esi + 8], 2
jne 0x40cdc9
push esi
mov ebx, 8
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp al, 4
jae 0x40cd65
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x94
mov ebx, 2
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x40cdd3
mov ecx, 0x25
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x40cdc9
cmp dword [esi + 8], 0xa
jne 0x40cdb9
push esi
mov ebx, 3
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 4
jne 0x40cdc9
cmp dword [esi + 8], 0x5a
jne 0x40cdc9
mov ebx, 4
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x40cf30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x410eb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push ebp
push esi
push edi
push fcn.00407930
push 0x40d410
push 0x40
lea eax, [esp + 0x34]
push 8
push eax
call fcn.0040fd86
mov ebp, dword [esp + 0x23c]
mov ebx, dword [sym.imp.GDI32.dll_CreateSolidBrush]
xor esi, esi
lea edi, [esp + 0x28]
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
mov ecx, dword [ebp + 4]
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
sub eax, ecx
mov dword [esp + 0x230], esi
mov dword [esp + 0x14], eax
mov eax, 0x55555556
imul esi
mov ecx, edx
mov eax, 0x66666667
shr ecx, 0x1f
add edx, ecx
or cl, 0xff
sub cl, dl
imul esi
sar edx, 1
mov eax, edx
and ecx, 0xff
shr eax, 0x1f
add edx, eax
or al, 0xff
sub al, dl
xor edx, edx
mov dh, al
or edx, ecx
shl edx, 8
or edx, ecx
push edx
call ebx
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
inc esi
add edi, 8
cmp esi, 0x40
jl 0x40cf99
mov eax, dword [esp + 0x14]
mov esi, dword [ebp + 4]
add eax, 2
cmp esi, eax
jg 0x40d057
mov ecx, dword [esp + 0x10]
mov edi, esi
add ecx, 2
lea ebx, [esi + 1]
shl edi, 6
mov dword [esp + 0x10], ecx
sub edi, esi
mov edx, dword [esp + 0x10]
mov eax, dword [ebp]
push ebx
push edx
push esi
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, edi
cdq
idiv dword [esp + 0x14]
lea eax, [esp + eax*8 + 0x28]
test eax, eax
je 0x40d030
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x238]
push eax
lea ecx, [esp + 0x1c]
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [esp + 0x14]
inc esi
inc ebx
add edi, 0x3f
lea eax, [ecx + 2]
cmp esi, eax
jle 0x40d008
lea esi, [esp + 0x28]
mov edi, 0x40
mov ecx, esi
call sub.MFC42.DLL_CGdiObject::DeleteObject
add esi, 8
dec edi
jne 0x40d060
push fcn.00407930
push 0x40
lea edx, [esp + 0x30]
push 8
push edx
mov dword [esp + 0x240], 0xffffffff
call fcn.0040fc92
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret 8
Function at 0x40f0a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x411201
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 1
call sub.MFC42.DLL_CString::CString
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x134]
push 0xffffffffffffffff
stosw word es:[edi], ax
push ebp
mov byte [esp + 0x134], 2
stosb byte es:[edi], al
call sub.MFC42.DLL_CStringArray::SetSize
push 0x4170fc
push 0x4170d8
lea eax, [esp + 0x14]
push 0x4170d0
push eax
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0x20019
push ebp
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x40f1c5
mov edi, dword [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [esp + 0x14], edi
push esi
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x2c]
push edx
push ecx
lea edx, [esp + 0x2c]
mov eax, 0xff
push 0
push edx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call sub.MFC42.DLL_CString::GetBuffer
push eax
push ebp
push edi
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov esi, eax
call sub.MFC42.DLL_CString::ReleaseBuffer
test esi, esi
jne 0x40f1eb
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40f1c2
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x140]
mov edx, dword [ecx + 8]
push edx
call sub.MFC42.DLL_CStringArray::SetAtGrow_1
inc ebp
jmp 0x40f15f
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 1
call fcn.0040f6e2
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 0
call fcn.0040f6e2
xor eax, eax
jmp 0x40f234
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40f200
push edi
call ebx
xor esi, esi
mov dword [esp + 0x18], esi
jmp 0x40f204
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 1
call fcn.0040f6e2
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], 0
call fcn.0040f6e2
test esi, esi
je 0x40f22d
push esi
call ebx
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x124]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x128
ret 4
Function at 0x40f250
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x411228
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
lea ecx, [esp]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
push 0x4170d8
lea eax, [esp + 4]
push 0x417108
push eax
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0xc]
add esp, 0xc
lea ecx, [esp + 4]
mov dword [esp + 4], 0
push ecx
push 0x20006
push 0
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f345
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 8]
push edi
push eax
mov dword [esp + 0x14], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push 0
push 0x417138
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40f307
push esi
call edi
xor esi, esi
mov dword [esp + 0x10], esi
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call fcn.0040f6e2
test esi, esi
je 0x40f31c
push esi
call edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040f6e2
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
lea ecx, [esp]
mov byte [esp + 0x14], 1
call fcn.0040f6e2
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040f6e2
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x40f380
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41127b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], 1
call sub.MFC42.DLL_CString::CString
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x417170
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 2
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_1
push 0x4170d8
lea eax, [esp + 0x18]
push 0x417108
push eax
mov byte [esp + 0x13c], 3
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
push 0x20019
push ebx
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x40f486
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push ebx
push 0x417138
push esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 0xff
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40f479
cmp dword [esp + 0x1c], ebx
jbe 0x40f479
lea eax, [esp + 0x28]
lea ecx, [esp + 0x18]
push eax
call fcn.0040f6ee
cmp esi, ebx
je 0x40f486
push esi
call ebp
xor esi, esi
mov dword [esp + 0x20], esi
mov edi, dword [esp + 0x138]
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x130], 2
call fcn.0040f6e2
lea ecx, [esp + 0x14]
mov byte [esp + 0x130], 1
call fcn.0040f6e2
cmp esi, ebx
je 0x40f4ca
push esi
call ebp
mov ecx, dword [esp + 0x128]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4