joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67905410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6798dad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x84]
mov eax, dword [esi + 0x7c]
push 5
push 3
mov ecx, dword [eax + 0x1c]
mov ebp, dword [eax + 0x18]
mov eax, dword [esp + 0x90]
sub edi, ecx
add ebp, eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x1c], ebp
call sym.MfcHlpr520.dll_public:_static_class_CPoint___cdecl_CMHPDrawHelpers::Dlu2Pix_int__int_
add esp, 0xc
lea ecx, [esp + 0x5c]
push esi
call fcn.6797db38
lea ecx, [esi + 0x80]
lea edx, [esp + 0x5c]
push ecx
push edx
lea ecx, [esp + 0x54]
mov dword [esp + 0x80], 0
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPFontDC::constructor_class_CDC___class_CFont__
push str.XXXXXXXXXX
lea ecx, [esp + 0x88]
mov byte [esp + 0x7c], 1
call sub.MFC42.DLL_CString::CString_5
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x70]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x84]
mov dword [esp + 0x30], ebx
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
lea eax, [ebx + ecx]
mov ebx, dword [esi + 0x70]
dec ebx
mov dword [esp + 0x30], eax
test ebx, ebx
jl 0x679055a5
add eax, ebp
mov dword [esp + 0x14], eax
mov edx, dword [esi + 0x6c]
lea ecx, [esp + 0x84]
mov ebp, dword [edx + ebx*4]
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 0x84]
mov ecx, ebp
push eax
mov byte [esp + 0x7c], 2
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x34]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x70]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jg 0x6790553b
mov eax, ecx
mov ecx, dword [esp + 0x24]
mov edx, edi
add eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
sub edx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], edx
test ebp, ebp
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ecx
je 0x67905568
mov ebp, dword [ebp + 0x20]
mov eax, dword [esp + 0x80]
lea edx, [esp + 0x3c]
push edx
push ebp
push eax
call sub.MFC42.DLL_AfxRepositionWindow
mov ecx, dword [esi + 0x7c]
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x78], 1
mov edx, dword [ecx + 0x14]
lea ecx, [esp + 0x84]
add edx, ebp
sub edi, edx
call sub.MFC42.DLL_CString::CString
dec ebx
jns 0x679054eb
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x78], 0
mov dword [esi + 0xc4], ecx
lea ecx, [esp + 0x4c]
mov dword [esi + 0xc8], eax
call sym.MfcHlpr520.dll_public_virtual:_void___thiscall_CMHPFontDC::destructor_void_
lea ecx, [esp + 0x5c]
mov dword [esp + 0x78], 0xffffffff
call sub.MFC42.DLL_CClientDC::CClientDC
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret 0xc
Function at 0x67906880
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
test edi, edi
jne 0x67906899
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 0xc
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x67906915
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
jne 0x679068b8
pop edi
pop esi
add esp, 0x10
ret 0xc
mov edx, dword [esi]
push 0x2001f
push edi
mov ecx, esi
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x679068d3
pop edi
pop esi
add esp, 0x10
ret 0xc
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push 4
push eax
push 4
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x67906902
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 0xc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret 0xc
mov edx, dword [esp + 0x24]
lea eax, [esp + 8]
push edx
push 0x67a7233c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
mov eax, dword [esp + 0x2c]
add esp, 0xc
lea edx, [esp + 8]
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x67906a40
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
mov esi, ecx
jne 0x67906a57
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x67906b52
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
jne 0x67906a79
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x67906aba
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 4]
mov edi, eax
test edi, edi
jne 0x67906a97
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x67906b40
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov ebx, dword [esp + 0x1c]
mov edx, dword [esi]
test ebx, ebx
push 0x2001f
push ebp
mov ecx, esi
jne 0x67906aff
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x67906adc
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x67906b40
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x67906b0f
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [esp + 0x1c]
push ebx
push 1
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x67906b40
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x67906e00
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x6798db86
push eax
mov eax, 0x1014
mov dword fs:[0], esp
call fcn.6797ee40
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
mov dword [esp + 0x1c], ebx
cmp dword [ecx - 8], ebx
jne 0x67906f40
mov ecx, edi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
jne 0x67906e52
mov eax, dword [esp + 0x1040]
push eax
jmp 0x67906f7b
mov eax, dword [esp + 0x1038]
mov edx, dword [edi]
push 0x20019
push eax
mov ecx, edi
call dword [edx + 8]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, ebx
mov dword [esp + 0x102c], ebx
jne 0x67906e83
mov ecx, dword [esp + 0x1040]
jmp 0x67906f7a
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_4
mov ebp, dword [esp + 0x103c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push ebx
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebp
push esi
mov byte [esp + 0x1044], 1
call ebx
test eax, eax
mov dword [edi + 0x10], eax
je 0x67906eed
mov ecx, dword [esp + 0x1040]
push ecx
mov edi, dword [esp + 0x1038]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esp + 0x14]
mov byte [esp + 0x102c], 0
call sub.MFC42.DLL_CString::CString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x67906f8b
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push ebp
push esi
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
mov dword [edi + 0x10], eax
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [edi + 0x10]
test eax, eax
je 0x67906f2b
mov edx, dword [esp + 0x1040]
push edx
jmp 0x67906ec0
mov edi, dword [esp + 0x1034]
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call sub.MFC42.DLL_CString::CString_6
jmp 0x67906ece
mov eax, dword [esp + 0x1040]
mov byte [esp + 0x13], 0
cmp eax, ebx
jne 0x67906f54
lea eax, [esp + 0x13]
mov edx, dword [esp + 0x103c]
push ecx
lea ecx, [esp + 0x28]
push 0x1000
push ecx
push eax
mov eax, dword [esp + 0x1048]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x24]
push ecx
mov esi, dword [esp + 0x1038]
mov ecx, esi
call sub.MFC42.DLL_CString::CString_5
mov eax, esi
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1020
ret 0x10
Function at 0x6790743b
Capabilities:
Access peb ldr_data
Get ntdll base address
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x6798dc18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
push esi
mov esi, ecx
push edi
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x679074ea
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
jne 0x67907468
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push 0x2001f
push eax
mov ecx, esi
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x67907492
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 8
push ecx
push 3
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x679074cc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x10]
push str._i__i
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
add esp, 0x10
push ecx
push edx
push eax
mov ecx, esi
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPRegistryManager::WriteProfileStringA_char_const___char_const___char_const__
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x6790757f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6798dc38
push eax
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [eax - 8]
push edi
test ecx, ecx
jne 0x67907618
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
je 0x6790767e
mov eax, dword [esp + 0x28]
mov edx, dword [esi]
push 0x20019
push eax
mov ecx, esi
call dword [edx + 8]
mov edi, eax
test edi, edi
je 0x6790767e
mov ebx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0
push edx
push 0
push ebx
push edi
call ebp
test eax, eax
mov dword [esi + 0x10], eax
je 0x679075e9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x6790767e
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push ebx
push edi
call ebp
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x67907610
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x6790767e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x67907679
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0
push eax
lea edx, [esp + 0x34]
push ecx
push edx
mov ecx, esi
call sym.MfcHlpr520.dll_public:_class_CString___thiscall_CMHPRegistryManager::GetProfileStringA_char_const___char_const___char_const__
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x67907650
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x6790767e
mov ecx, dword [esp + 0x30]
lea edx, [ecx + 4]
push edx
push ecx
push str._ld__ld
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x679076bb
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x6798dc58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
push esi
mov esi, ecx
push edi
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x6790776a
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
jne 0x679076e8
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push 0x2001f
push eax
mov ecx, esi
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x67907712
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0x10
push ecx
push 3
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x6790774c
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 0
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x18]
push str._i__i__i__i
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
add esp, 0x18
push ecx
push edx
push eax
mov ecx, esi
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPRegistryManager::WriteProfileStringA_char_const___char_const___char_const__
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x679077ff
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6798dc78
push eax
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [eax - 8]
push edi
test ecx, ecx
jne 0x67907898
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
je 0x67907906
mov eax, dword [esp + 0x28]
mov edx, dword [esi]
push 0x20019
push eax
mov ecx, esi
call dword [edx + 8]
mov edi, eax
test edi, edi
je 0x67907906
mov ebx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0
push edx
push 0
push ebx
push edi
call ebp
test eax, eax
mov dword [esi + 0x10], eax
je 0x67907869
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x67907906
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push ebx
push edi
call ebp
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x67907890
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x67907906
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x67907901
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0
push eax
lea edx, [esp + 0x34]
push ecx
push edx
mov ecx, esi
call sym.MfcHlpr520.dll_public:_class_CString___thiscall_CMHPRegistryManager::GetProfileStringA_char_const___char_const___char_const__
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x679078d0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x67907906
mov eax, dword [esp + 0x30]
lea edx, [eax + 0xc]
push edx
lea edx, [eax + 8]
push edx
lea edx, [eax + 4]
push edx
push eax
push str._ld__ld__ld__ld
push ecx
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x18
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x6790793b
Capabilities:
Access peb ldr_data
Get ntdll base address
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x6798dc98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
push esi
mov esi, ecx
push edi
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x679079ea
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
jne 0x67907968
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
push 0x2001f
push eax
mov ecx, esi
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x67907992
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 8
push ecx
push 3
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x679079cc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x10]
push str._i__i
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
add esp, 0x10
push ecx
push edx
push eax
mov ecx, esi
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPRegistryManager::WriteProfileStringA_char_const___char_const___char_const__
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x67907a7f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6798dcb8
push eax
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [eax - 8]
push edi
test ecx, ecx
jne 0x67907b18
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
je 0x67907b7e
mov eax, dword [esp + 0x28]
mov edx, dword [esi]
push 0x20019
push eax
mov ecx, esi
call dword [edx + 8]
mov edi, eax
test edi, edi
je 0x67907b7e
mov ebx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0
push edx
push 0
push ebx
push edi
call ebp
test eax, eax
mov dword [esi + 0x10], eax
je 0x67907ae9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x67907b7e
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push ebx
push edi
call ebp
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x67907b10
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x67907b7e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x67907b79
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0
push eax
lea edx, [esp + 0x34]
push ecx
push edx
mov ecx, esi
call sym.MfcHlpr520.dll_public:_class_CString___thiscall_CMHPRegistryManager::GetProfileStringA_char_const___char_const___char_const__
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x67907b50
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x67907b7e
mov ecx, dword [esp + 0x30]
lea edx, [ecx + 4]
push edx
push ecx
push str._i__i
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x67907c9f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6798dcd8
push eax
mov eax, dword [sym.MfcHlpr520.dll_class_CString_CMHPRegistryManager::m_strINIFileName]
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [eax - 8]
push edi
test ecx, ecx
jne 0x67907d3b
mov ecx, esi
call sym.MfcHlpr520.dll_private:_int___thiscall_CMHPRegistryManager::GetProfileInfo_void_
test eax, eax
je 0x67907db3
mov eax, dword [esp + 0x28]
mov edx, dword [esi]
push 0x20019
push eax
mov ecx, esi
call dword [edx + 8]
mov edi, eax
test edi, edi
je 0x67907db3
mov ebx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0
push edx
push 0
push ebx
push edi
call ebp
test eax, eax
mov dword [esi + 0x10], eax
je 0x67907d09
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x67907db3
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push ebx
push edi
call ebp
test eax, eax
mov dword [esi + 0x10], eax
push edi
je 0x67907d33
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x67907db3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x67907dae
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0
push eax
lea edx, [esp + 0x34]
push ecx
push edx
mov ecx, esi
call sym.MfcHlpr520.dll_public:_class_CString___thiscall_CMHPRegistryManager::GetProfileStringA_char_const___char_const___char_const__
mov edi, dword [esp + 0x2c]
mov ebx, dword [edi - 8]
test ebx, ebx
jne 0x67907d73
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x67907db3
xor esi, esi
test ebx, ebx
jle 0x67907d9d
mov ebp, dword [esp + 0x30]
mov cl, byte [esi + edi + 1]
mov al, byte [esi + edi]
shl cl, 4
add cl, al
mov eax, esi
cdq
sub eax, edx
add esi, 2
sar eax, 1
sub cl, 0x51
cmp esi, ebx
mov byte [eax + ebp], cl
jl 0x67907d7d
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc