Function at 0x4027a0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027ae
call dword [0x52201c]
or eax, eax
je 0x4027af
ret
mov al, 1
jmp fcn.0040282c

Function at 0x4027b8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027c6
call dword [0x522020]
or eax, eax
jne 0x4027c7
ret
mov al, 2
jmp fcn.0040282c

Function at 0x4027d0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402808
test edx, edx
je 0x4027f2
push eax
mov eax, ecx
call dword [0x522024]
pop ecx
or eax, eax
je 0x402801
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040282c
mov dword [eax], edx
mov eax, ecx
call dword [0x522020]
or eax, eax
jne 0x4027eb
ret
mov al, 1
jmp fcn.0040282c
test edx, edx
je 0x40281c
push eax
mov eax, edx
call dword [0x52201c]
pop ecx
or eax, eax
je 0x402801
mov dword [ecx], eax
ret

Function at 0x40282c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x527004]
test ecx, ecx
je 0x40283c
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402855]
jns 0x402850
call fcn.00407980
mov eax, dword [eax + 4]
jmp fcn.00403c20

Function at 0x402870
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.00407980
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x402885
ret
xor eax, eax
jmp fcn.0040282c

Function at 0x4029e0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402a0f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403d2c
jmp 0x402a2d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402968
mov edi, eax
test ebx, ebx
je 0x402a2d
cmp dword [esi], 0
je 0x402a2d
dec ebx
jmp 0x402a16
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402cb4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x527044], 0x8088405
inc edx
mov dword [0x527044], edx
mul edx
mov eax, edx
ret

Function at 0x402ccc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x527044], 0x8088405
inc edx
mov dword [0x527044], edx
fld qword [0x52202c]
push 0
push edx
fild qword [esp]
add esp, 8
fscale
fstp st(1)
ret

Function at 0x402ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402f38
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402f18
xor eax, eax
push ebp
push 0x402f11
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402f54
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f18
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret