joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045c0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x4045dc
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4046e7
jmp 0x4045f0
mov eax, ebx
cmp ebx, 0x15b0
jb 0x4045ff
mov eax, 0x15b0
sub ebx, eax
mov dword [ebp + 0x10], ebx
cmp eax, 0x10
jl 0x4046ac
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x404620
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
dec edx
jne 0x404620
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x4046bb
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
dec eax
jne 0x4046b0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
jne 0x4045f0
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
pop ebp
ret

Function at 0x404700
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x404707
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x4047dd
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x431f08]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x431f08]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x431f08]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x431f08]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x431f08]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x431f08]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x431f08]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x431f08]
add ecx, 8
sub edx, 8
dec esi
jne 0x404720
pop edi
test edx, edx
je 0x4047fa
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x431f08]
inc ecx
dec edx
jne 0x4047e1
not eax
pop esi
ret
Function at 0x404f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 8], edi
jmp 0x404f53
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0x64]
mov ebx, dword [esi + 0x34]
mov ecx, dword [esi + 0x6c]
sub ebx, eax
sub ebx, ecx
mov dword [ebp - 4], ebx
jne 0x404f72
test eax, eax
jne 0x404f80
test ecx, ecx
jne 0x404f80
mov dword [ebp - 4], edi
jmp 0x404fec
cmp ebx, 0xffffffff
jne 0x404f80
mov dword [ebp - 4], 0xfffffffe
jmp 0x404fec
mov ecx, dword [esi + 0x24]
lea edx, [edi + ecx - 0x106]
cmp eax, edx
jb 0x404fec
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00418ce0
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x404fc0
sub eax, edi
jmp 0x404fc2
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x404fb1
mov ecx, dword [esi + 0x38]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x404fdf
sub eax, edi
jmp 0x404fe1
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x404fd0
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x405088
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x30]
mov edx, dword [ebp - 4]
mov ebx, ecx
mov dword [ebp - 0xc], eax
cmp ebx, edx
jbe 0x405012
mov ebx, edx
test ebx, ebx
je 0x40504c
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
cmp dword [edx + 0x18], 0
jne 0x40503a
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.004045c0
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [edi]
push ebx
push edx
push eax
call fcn.00418ce0
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x6c], ebx
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x405074
mov edx, dword [esi + 0x64]
add edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
movzx edx, byte [edx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x405088
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x404f50
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a5f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x4090], 0
je 0x40a6a0
cmp dword [esi + 0x6c], 0
jbe 0x40a6a0
mov eax, 0xffffff78
push ebx
sub eax, esi
push edi
lea edi, [esi + 0x88]
mov dword [ebp - 4], eax
lea ecx, [ecx]
movzx ecx, byte [edi]
mov eax, dword [esi + 0x4094]
mov ebx, dword [esi + 0x40a0]
xor ecx, eax
mov edx, dword [esi + 0x409c]
shr eax, 8
and ecx, 0xff
mov ecx, dword [ebx + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x4098]
mov dword [esi + 0x4094], ecx
mov ecx, dword [esi + 0x409c]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x4098], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [ebx + eax*4]
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
mov dword [esi + 0x409c], ecx
mov ecx, dword [ebp - 4]
shr eax, 8
xor byte [edi], al
inc edi
add ecx, edi
cmp ecx, dword [esi + 0x6c]
jb 0x40a620
pop edi
pop ebx
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x20]
push edx
mov edx, dword [esi + 0x1c]
lea eax, [esi + 0x88]
push eax
mov eax, dword [esi + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, dword [esi + 0x6c]
mov dword [esi + 0x6c], 0
je 0x40a6ce
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40c160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d108
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x437610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x2c], cl
mov dword [ebp - 4], ecx
mov eax, dword [eax + 4]
mov ebx, dword [eax]
cmp ebx, eax
je 0x40c2d9
push 1
mov eax, 0x4325a4
lea ecx, [ebp - 0x2c]
call fcn.004039a0
push 0
lea eax, [ebx + 0xc]
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.00403c10
push 3
mov eax, 0x4325b0
mov ecx, esi
call fcn.004039a0
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax]
cmp edi, eax
je 0x40c27b
push 0
lea ecx, [edi + 0xc]
push ecx
or eax, 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.00403c10
push 1
mov eax, 0x4325ac
mov ecx, esi
call fcn.004039a0
push 0
lea edx, [edi + 0x28]
push edx
or eax, 0xffffffff
call fcn.00403c10
push 2
mov eax, 0x4325a0
mov ecx, esi
call fcn.004039a0
cmp byte [edi + 0x45], 0
jne 0x40c272
mov eax, dword [edi + 8]
cmp byte [eax + 0x45], 0
jne 0x40c250
mov edi, eax
mov eax, dword [edi]
cmp byte [eax + 0x45], 0
jne 0x40c272
mov edi, eax
mov eax, dword [edi]
cmp byte [eax + 0x45], 0
je 0x40c244
jmp 0x40c272
mov eax, dword [edi + 4]
cmp byte [eax + 0x45], 0
jne 0x40c270
lea esp, [esp]
cmp edi, dword [eax + 8]
jne 0x40c270
mov edi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x45], 0
je 0x40c260
mov edi, eax
cmp edi, dword [ebx + 0x2c]
jne 0x40c1f0
push 2
mov eax, 0x4325a0
lea ecx, [ebp - 0x2c]
call fcn.004039a0
cmp byte [ebx + 0x39], 0
jne 0x40c2ca
mov ecx, dword [ebx + 8]
cmp byte [ecx + 0x39], 0
jne 0x40c2af
mov eax, dword [ecx]
cmp byte [eax + 0x39], 0
jne 0x40c2ab
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x39], 0
je 0x40c2a1
mov ebx, ecx
jmp 0x40c2ca
mov eax, dword [ebx + 4]
cmp byte [eax + 0x39], 0
jne 0x40c2c8
cmp ebx, dword [eax + 8]
jne 0x40c2c8
mov ebx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x39], 0
je 0x40c2b8
mov ebx, eax
mov eax, dword [ebp - 0x34]
cmp ebx, dword [eax + 4]
jne 0x40c1b5
mov esi, dword [ebp - 0x30]
push 4
push esi
call fcn.004296ff
add esp, 8
test eax, eax
je 0x40c2f3
test esi, esi
je 0x40c2f3
mov ecx, esi
call fcn.0040c4e0
push 0x432514
push esi
call fcn.0041606d
add esp, 8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x40c311
xor eax, eax
jmp 0x40c337
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40c31d
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push esi
push 1
push ecx
push eax
call fcn.004172cc
push esi
mov edi, eax
call fcn.0041614d
add esp, 0x14
mov eax, edi
test eax, eax
setne bl
cmp dword [ebp - 0x18], 0x10
jb 0x40c34e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00416084
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415ac1
mov esp, ebp
pop ebp
ret 4
Function at 0x40c420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x437610]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push 0x4310a4
push esi
mov dword [ebp - 0x40], eax
call fcn.0041606d
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40c464
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00415ac1
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x3c]
push ecx
push esi
call fcn.00417ac6
mov edi, dword [ebp - 0x28]
lea edx, [edi + 1]
push 0x439ae0
push edx
call fcn.004176ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c44f
push ebx
push 1
push edi
push esi
call fcn.00417108
mov eax, esi
add esp, 0x10
mov byte [esi + edi], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c4a0
mov ecx, dword [ebp - 0x40]
sub eax, edx
push eax
push esi
call fcn.00401360
push esi
call fcn.004179e1
push ebx
call fcn.0041614d
mov ecx, dword [ebp - 8]
add esp, 8
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415ac1
mov esp, ebp
pop ebp
ret 4
Function at 0x40c4e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d0d6
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x437610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
xor edx, edx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], eax
mov word [ebp - 0x234], dx
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], eax
mov eax, ecx
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], dl
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c547
sub eax, esi
push eax
push ecx
lea ecx, [ebp - 0x250]
call fcn.00401360
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x224]
mov ebx, ecx
cmp ecx, eax
ja 0x40c6ae
lea esi, [ebp - 0x234]
call fcn.0040b300
mov edi, 8
mov ecx, dword [ebp - 0x234]
cmp dword [ebp - 0x220], edi
jae 0x40c59b
lea ecx, [ebp - 0x234]
mov eax, dword [ebp - 0x250]
mov esi, 0x10
cmp dword [ebp - 0x23c], esi
jae 0x40c5b4
lea eax, [ebp - 0x250]
push ebx
push ecx
push ebx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x23c], esi
jb 0x40c5d9
mov eax, dword [ebp - 0x250]
push eax
call fcn.00416084
add esp, 4
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x220], edi
jae 0x40c5ed
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x218]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40c5f5
lea ecx, [ebp - 0x218]
push 0x5c
push ecx
call fcn.00417685
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c632
lea edx, [ebp - 0x218]
push 0x2f
push edx
call fcn.00417685
mov esi, eax
add esp, 8
test esi, esi
je 0x40c679
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40c640
xor eax, eax
push eax
lea ecx, [ebp - 0x218]
push ecx
mov word [esi], ax
call ebx
mov edx, 0x5c
mov word [esi], dx
push edx
add esi, 2
push esi
call fcn.00417685
add esp, 8
test eax, eax
jne 0x40c673
push 0x2f
push esi
call fcn.00417685
add esp, 8
mov esi, eax
test eax, eax
jne 0x40c640
cmp dword [ebp - 0x220], edi
jb 0x40c690
mov eax, dword [ebp - 0x234]
push eax
call fcn.00416084
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415ac1
mov esp, ebp
pop ebp
ret
sub ecx, eax
mov edi, ecx
or ecx, 0xffffffff
sub ecx, eax
cmp ecx, edi
ja 0x40c6c5
push str.string_too_long
call fcn.0041503f
test edi, edi
je 0x40c582
lea esi, [eax + edi]
lea eax, [ebp - 0x234]
call fcn.0040b4d0
test al, al
je 0x40c582
mov edx, dword [ebp - 0x224]
mov ecx, edi
lea eax, [ebp - 0x234]
call fcn.0040b480
mov eax, dword [ebp - 0x234]
mov edi, 8
mov dword [ebp - 0x224], esi
cmp dword [ebp - 0x220], edi
jae 0x40c715
lea eax, [ebp - 0x234]
xor edx, edx
mov word [eax + esi*2], dx
jmp 0x40c587
Function at 0x40f560
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cfb8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x437610]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x21
mov esi, 0xf
xor edi, edi
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push str.locojoymtgameplugins.MtGamePlugin
mov byte [ecx], 0
call fcn.00401360
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 4], edi
push 0x32
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push str.SoftwareClasseslocojoymtgameplugins.MtGamePlugin
mov byte [ecx], 0
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
call fcn.004104d0
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push edi
push str.Software
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f69f
mov edx, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [ebp - 0x10]
push ecx
push str.Classes
push edx
call esi
mov eax, dword [ebp - 0x10]
push edi
push edi
push 1
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
call edi
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push str.locojoymtgameplugins.MtGamePlugin
push edx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.www.locojoy.com
call ebx
push eax
mov eax, dword [ebp - 0x14]
push str.www.locojoy.com
push 1
push 0
push 0
push eax
call edi
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
push str.CLSID
push edx
call esi
push str.6bae6e63_df53_5e73_929e_23c470749b19
call ebx
push eax
mov eax, dword [ebp - 0x18]
push str.6bae6e63_df53_5e73_929e_23c470749b19
push 1
push 0
push 0
push eax
call edi
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
push str.CurVer
push edx
call esi
push str.locojoymtgameplugins.MtGamePlugin.1
call ebx
push eax
mov eax, dword [ebp - 0x18]
push str.locojoymtgameplugins.MtGamePlugin.1
push 1
push 0
push 0
push eax
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f6c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cfb8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x437610]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
xor ebx, ebx
push 0x23
mov esi, 0xf
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.locojoymtgameplugins.MtGamePlugin.1
mov byte [ecx], bl
call fcn.00401360
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 4], ebx
push 0x34
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.SoftwareClasseslocojoymtgameplugins.MtGamePlugin.1
mov byte [ecx], bl
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
call fcn.004104d0
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push ebx
push str.SoftwareClasses
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f7b4
mov edx, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [ebp - 0x10]
push ecx
push str.locojoymtgameplugins.MtGamePlugin.1
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.www.locojoy.com
call edi
push eax
mov eax, dword [ebp - 0x10]
push str.www.locojoy.com
push 1
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
call ebx
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
push ecx
push str.CLSID
push edx
call esi
push str.6bae6e63_df53_5e73_929e_23c470749b19
call edi
push eax
mov eax, dword [ebp - 0x18]
push str.6bae6e63_df53_5e73_929e_23c470749b19
push 1
push 0
push 0
push eax
call ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f7d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cf88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x437610]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x1c
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
push 0x1a
mov esi, 0xf
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.application_x_mtgameplugin
mov byte [ecx], bl
call fcn.00401360
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 4], ebx
push 0x46
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.SoftwareClassesMIMEDatabaseContent_Type_application_x_mtgameplugin
mov byte [ecx], bl
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
call fcn.004104d0
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push ebx
push str.SoftwareClasses
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f925
mov edx, dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [ebp - 0x10]
push ecx
push str.MIME
push edx
call edi
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push 1
push ebx
push ebx
push eax
call esi
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push ecx
push str.Database
push edx
call edi
mov eax, dword [ebp - 0x10]
push 1
push ebx
push 1
push ebx
push ebx
push eax
call esi
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push ecx
push str.Content_Type
push edx
call edi
mov eax, dword [ebp - 0x10]
push 1
push ebx
push 1
push ebx
push ebx
push eax
call esi
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push str.application_x_mtgameplugin
push edx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.www.locojoy.com
call edi
push eax
mov eax, dword [ebp - 0x14]
push str.www.locojoy.com
push 1
push ebx
push ebx
push eax
call esi
push str.6bae6e63_df53_5e73_929e_23c470749b19
call edi
mov ecx, dword [ebp - 0x14]
push eax
push str.6bae6e63_df53_5e73_929e_23c470749b19
push 1
push ebx
push str.CLSID
push ecx
call esi
mov edx, dword [ebp - 0x14]
push ebx
push ebx
push 1
push ebx
push str.Extension
push edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f940
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cf60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x437610]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
xor ebx, ebx
push 0x26
mov esi, 0xf
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.B415CD14_B45D_4BCA_B552_B06175C38606
mov byte [ecx], bl
call fcn.00401360
sub esp, 0x1c
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x3d
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.SoftwareClassesAppIDB415CD14_B45D_4BCA_B552_B06175C38606
mov byte [ecx], bl
call fcn.00401360
or edi, 0xffffffff
mov dword [ebp - 4], edi
call fcn.004104d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x12
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.npMtGamePlugin.dll
mov byte [ecx], bl
call fcn.00401360
sub esp, 0x1c
mov dword [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x29
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push str.SoftwareClassesAppID_npMtGamePlugin.dll
mov byte [ecx], bl
call fcn.00401360
mov dword [ebp - 4], edi
call fcn.004104d0
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push ebx
push str.SoftwareClasses
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40faab
mov edx, dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [ebp - 0x10]
push ecx
push str.AppID
push edx
call edi
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push 1
push ebx
push ebx
push eax
call esi
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push str.B415CD14_B45D_4BCA_B552_B06175C38606
push edx
call edi
push str.FireBreathWin
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 0x14]
push str.FireBreathWin
push 1
push ebx
push ebx
push eax
call esi
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push str.npMtGamePlugin.dll
push edx
call edi
mov eax, dword [ebp - 0x14]
push 1
push ebx
push 1
push ebx
push ebx
push eax
call esi
push str.B415CD14_B45D_4BCA_B552_B06175C38606
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x14]
push eax
push str.B415CD14_B45D_4BCA_B552_B06175C38606
push 1
push ebx
push str.AppID
push ecx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret