joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ce68
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48cf29
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48cf07
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403af4
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403af4
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.0040a930
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48cf13
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cf30
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48d03c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48d13c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48d0ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x105
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.004057a0
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x11c]
call fcn.00409b84
cmp dword [ebp - 0x11c], 0
jne 0x48d0e7
mov eax, dword [ebp - 8]
mov edx, 0x48d154
call fcn.00405584
jmp 0x48d0f5
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x115]
call fcn.0040aab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48d116
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d143
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00405554
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x48d16c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48d24a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48d21d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x104
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x48d213
test bl, bl
jne 0x48d1e2
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00409e64
jmp 0x48d213
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
movzx eax, word [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x48d260
call fcn.0040afa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48d234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d251
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48d278
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48d31f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48d2f2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x115]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x48d2e8
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x115]
call fcn.0040aab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48d309
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d326
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48d6c4
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x48d6f0
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040aab0
jmp 0x48d6f7
mov eax, ebx
call fcn.00405530
add esp, 0x104
pop ebx
ret

Function at 0x48d700
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48d72c
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040aab0
jmp 0x48d733
mov eax, ebx
call fcn.00405530
add esp, 0x104
pop ebx
ret
Function at 0x48d73c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push 5
lea eax, [esp + 4]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
sete al
test al, al
je 0x48d76a
mov eax, ebx
mov edx, esp
call fcn.00405728
jmp 0x48d776
mov eax, ebx
mov edx, 0x48d784
call fcn.00405584
pop ecx
pop edx
pop ebx
ret

Function at 0x48def4
Capabilities:
Identify system language via api

Disassembly:
push ebx
add esp, 0xffffff98
mov ebx, eax
call sub.kernel32.dll_GetUserDefaultLangID
push 0x64
lea edx, [esp + 4]
push edx
movzx eax, ax
push eax
call sub.kernel32.dll_VerLanguageNameA
mov eax, ebx
mov edx, esp
mov ecx, 0x65
call fcn.004057a0
add esp, 0x68
pop ebx
ret

Function at 0x48e55c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48e5fd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48e5d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x20
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x48e614
call fcn.0040afa0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, 0x48e620
call fcn.00405864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e5e7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e604
lea eax, [ebp - 0x28]
call fcn.00405530
ret

Function at 0x48e630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48e6c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xa
push ebx
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov esi, eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push esi
call sub.kernel32.dll_LockResource
lea edx, [ebp - 8]
mov ecx, ebx
xchg edx, eax
call fcn.00405620
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00405584
push esi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e6c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x402970
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x415552
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x804
push esi
mov dword [esp + 4], 0
mov ecx, dword [ecx]
mov edx, dword [esp + 0x820]
push ecx
mov ecx, dword [esp + 0x828]
lea eax, [esp + 0xc]
push 0x800
push eax
mov eax, dword [esp + 0x828]
push ecx
push edx
push eax
mov dword [esp + 0x828], 3
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [esp + 0x818]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 4], 1
lea ecx, [esp + 0x81c]
mov byte [esp + 0x810], 2
call fcn.00414af4
lea ecx, [esp + 0x820]
mov byte [esp + 0x810], 1
call fcn.00414af4
lea ecx, [esp + 0x824]
mov byte [esp + 0x810], 0
call fcn.00414af4
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x810
ret 0x10

Function at 0x402ac0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415588
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x4001
push 2
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x24]
push 0xffffffffffffffff
push 0
mov ecx, edi
mov esi, eax
call sub.MFC42.DLL_CStringArray::SetSize
mov ebp, dword [ebp]
mov eax, dword [esp + 0x20]
push ebp
push 0x4000
push esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x402b4a
cmp byte [esi], 0
je 0x402b4a
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [edi + 8]
push esi
push eax
mov ecx, edi
call sub.MFC42.DLL_CStringArray::SetAtGrow
push esi
call ebp
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x402b32
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [edi + 8]
xor ecx, ecx
test edi, edi
setg cl
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00414af4
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8

Function at 0x402c60
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4155d8
push eax
mov dword fs:[0], esp
push esi
mov ecx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00414af4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], 0xffffffff
call fcn.00414af4
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0xc
Function at 0x4038f0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415728
push eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
push 2
push 0
push 0
push eax
push 0x41f020
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [esp + 8], 0xffffffff
lea ecx, [esp + 0x10]
jae 0x403946
call fcn.00414af4
xor al, al
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 4
call fcn.00414af4
mov ecx, dword [esp]
mov al, 1
mov dword fs:[0], ecx
add esp, 0xc
ret 4
Function at 0x4050d0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4158d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString_1
push 0x80000000
mov ecx, esi
call fcn.00405290
mov esi, eax
test esi, esi
je 0x405154
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CString::LockBuffer
push eax
push 1
push 0
push 0x421388
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x41f8a8
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
mov byte [esp + 0x10], 0
call fcn.00414af4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0xffffffff
call fcn.00414af4
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x405190
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41590d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x130]
lea ecx, [esp + 0x18]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
mov ebx, 1
push eax
push ecx
push edx
push 0x80000000
mov dword [esp + 0x134], ebx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x405219
mov esi, dword [esp + 0x12c]
push 0x421388
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], ebx
jmp 0x405256
lea eax, [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::CString_2
mov esi, dword [esp + 0x12c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov byte [esp + 0x128], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x124], bl
call fcn.00414af4
lea ecx, [esp + 0x130]
mov byte [esp + 0x124], 0
call fcn.00414af4
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret 8
Function at 0x405450
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x415968
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
push edi
mov dword [esp + 0x11c], 0
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0x10]
push eax
push 0x41f070
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
lea edx, [esp + 0xc]
lea eax, [esp + 8]
not ecx
push edx
mov edx, dword [esp + 0x128]
push eax
dec ecx
push 0
push 0xf003f
mov esi, ecx
mov ecx, dword [esp + 0x138]
push 0
push 0x421388
push 0
push ecx
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
test eax, eax
je 0x40555a
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x120]
mov byte [esp + 0x114], 1
call fcn.00414af4
lea ecx, [esp + 0x124]
mov byte [esp + 0x114], 0
call fcn.00414af4
lea ecx, [esp + 0x128]
mov dword [esp + 0x114], 0xffffffff
call fcn.00414af4
xor eax, eax
mov ecx, dword [esp + 0x10c]
mov dword fs:[0], ecx
add esp, 0x118
ret 0x10
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x120]
mov byte [esp + 0x114], 1
call fcn.00414af4
lea ecx, [esp + 0x124]
mov byte [esp + 0x114], 0
call fcn.00414af4
lea ecx, [esp + 0x128]
mov dword [esp + 0x114], 0xffffffff
call fcn.00414af4
mov ecx, dword [esp + 0x10c]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x118
ret 0x10
Function at 0x4055c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x415990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
push 0x20019
push ebx
push ecx
push edx
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x405672
mov edx, dword [esp + 0x2c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x28]
push ebx
push ecx
push ebx
push edx
push eax
call edi
cmp eax, ebx
je 0x405633
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405672
mov edx, dword [esp + 0xc]
push edx
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x30]
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push esi
push ecx
push ebx
push edx
push eax
call edi
cmp eax, ebx
je 0x4056a6
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], bl
call fcn.00414af4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00414af4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x30]
push esi
call fcn.00414c26
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], bl
call fcn.00414af4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00414af4
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10

Function at 0x405700
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x4159b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00405290
mov esi, eax
test esi, esi
je 0x405757
mov edx, dword [esp + 0x20]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10], 1
call fcn.00414af4
lea ecx, [esp + 0x20]
mov byte [esp + 0x10], 0
call fcn.00414af4
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
call fcn.00414af4
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x407310
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x415ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x58]
xor edi, edi
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], edi
call sub.MFC42.DLL_CString::LoadStringA
test eax, eax
je 0x407360
mov eax, dword [esp + 0x10]
push 0xa
push edi
lea ecx, [esi + 8]
push eax
push ecx
call sub.MFC42.DLL_AfxExtractSubString
mov eax, dword [esi + 8]
lea ebx, [esi + 8]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407406
mov ebx, dword [ebx]
mov dword [esi + 4], edi
push ebx
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
test edi, edi
je 0x4073ee
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4073ee
inc ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], ecx
mov eax, dword [eax - 8]
inc eax
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::GetBuffer
lea edx, [esp + 0x14]
mov dword [esp + 0x1c], eax
push edx
push 0
push 0x4a
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
mov ecx, esi
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], 0xffffffff
call fcn.00414af4
xor eax, eax
jmp 0x4074be
push 0x41fdb0
mov ecx, ebx
call sub.MFC42.DLL_CString::operator
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], 0xb
call sub.MFC42.DLL_AfxGetAfxWndProc
mov dword [esp + 0x24], eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
and ebp, 0xffff
push ebp
push eax
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebx, dword [ebx]
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 6
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], ebx
call sub.MFC42.DLL_AfxRegisterClass
test eax, eax
jne 0x4074a8
push eax
push 0x10
push 0x41fd8c
call sub.MFC42.DLL_AfxMessageBox
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], 0xffffffff
call fcn.00414af4
xor eax, eax
jmp 0x4074be
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], 0xffffffff
call fcn.00414af4
mov eax, 1
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x4079c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x416008
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x421388
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.00404da0
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CString::CString_2
mov bl, 2
push 0
push 0x2e
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CString::Find_1
mov esi, eax
lea ecx, [esp + 0x10]
inc esi
push esi
push 0x2e
call sub.MFC42.DLL_CString::Find_1
mov edi, eax
cmp edi, 0xffffffff
je 0x407afc
mov ecx, edi
lea edx, [esp + 0x38]
sub ecx, esi
dec ecx
push ecx
push esi
push edx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Mid
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call fcn.00414c50
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], bl
call fcn.00414af4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push 0x2e
push ecx
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 4
call fcn.00414c50
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.00414af4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x42139c
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x38], 5
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x41f894
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x40], 6
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], bl
call fcn.00404de0
lea esi, [edi + 1]
lea ecx, [esp + 0x10]
push esi
push 0x2e
call sub.MFC42.DLL_CString::Find_1
mov edi, eax
cmp edi, 0xffffffff
jne 0x407a3a
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp esi, ecx
jge 0x407bb0
mov eax, ecx
lea ecx, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push esi
push eax
call sub.MFC42.DLL_CString::Mid
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 7
call fcn.00414c50
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], bl
call fcn.00414af4
lea ecx, [esp + 0xc]
lea edx, [esp + 0x38]
push ecx
push 0x2e
push edx
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 8
call fcn.00414c50
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], bl
call fcn.00414af4
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x42139c
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x38], 9
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x41f894
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x40], 0xa
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], bl
call fcn.00404de0
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00414af4
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.00404dd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00414af4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 4