joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ae40
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x411e58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebp
push esi
push edi
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0xa4]
push 0
push eax
mov dword [esp + 0xa0], 1
mov ebp, eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
push edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [esp + 0x24]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0x419670
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
mov dx, word [eax + 2]
mov cx, word [eax]
push edx
push ecx
lea edx, [esp + 0x34]
push 0x419648
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x28]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x2c]
push eax
push ecx
push edx
push esi
call sub.VERSION.dll_VerQueryValueA
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
push 0x419588
push ecx
mov byte [esp + 0xa4], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
push 0x20
call sub.MFC42.DLL_CString::Remove
push esi
call sub.MFC42.DLL_operatordelete
mov edx, dword [esp + 0x10]
add esp, 4
lea ecx, [esp + 0x10]
mov edi, dword [edx - 8]
call sub.MFC42.DLL_CString::CString_2
xor esi, esi
mov byte [esp + 0x98], 3
test edi, edi
jle 0x40af63
mov eax, dword [esp + 0xc]
mov al, byte [esi + eax]
cmp al, 0x2c
je 0x40af5e
mov byte [esp + 0x14], al
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.00410442
inc esi
cmp esi, edi
jl 0x40af41
mov esi, dword [esp + 0xa0]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00410436
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x98], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x98], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xa4]
mov byte [esp + 0x98], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x90]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x90
ret 8

Function at 0x40afd0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [0x413968]
sub esp, 8
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b017
lea edx, [esp + 4]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x10]
push 0x41aaf8
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x40bb80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x411ee6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push edi
xor ebx, ebx
xor ebp, ebp
mov edx, dword [esp + 0x138]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x12c], ebx
je 0x40bd04
mov ecx, dword [esp + 0x134]
lea eax, [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push ebx
push edx
push ecx
mov dword [esp + 0x28], ebx
call esi
cmp eax, ebx
jne 0x40bce2
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
lea edx, [esp + 0x1c]
mov byte [esp + 0x130], 1
push edx
push 0x2001f
push ebx
push 0x41c354
push edi
mov dword [esp + 0x30], ebx
call esi
cmp eax, ebx
jne 0x40bc2f
lea ecx, [esp + 0x10]
call fcn.0040ef90
mov ecx, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x10], ecx
je 0x40bc44
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], bl
call fcn.0040ef90
jmp 0x40bccf
lea eax, [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push ebx
push ebx
lea edx, [esp + 0x24]
push ebx
lea eax, [esp + 0x38]
push edx
push eax
mov ebp, 0x100
push ebx
push ecx
mov dword [esp + 0x38], ebp
call esi
test eax, eax
jne 0x40bca1
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040f000
cmp eax, ebx
jne 0x40bc2f
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x38], ebp
call esi
test eax, eax
je 0x40bc6d
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40bcb4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
push 0x41c354
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40bccf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x40bcde
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x138]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp ebp, ebx
pop esi
je 0x40bd04
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x124]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 8
Function at 0x40bd20
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x411f06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push edi
xor ebx, ebx
xor ebp, ebp
mov edx, dword [esp + 0x138]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x12c], ebx
je 0x40bea4
mov ecx, dword [esp + 0x134]
lea eax, [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push ebx
push edx
push ecx
mov dword [esp + 0x28], ebx
call esi
cmp eax, ebx
jne 0x40be82
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
lea edx, [esp + 0x1c]
mov byte [esp + 0x130], 1
push edx
push 0x2001f
push ebx
push 0x41c354
push edi
mov dword [esp + 0x30], ebx
call esi
cmp eax, ebx
jne 0x40bdcf
lea ecx, [esp + 0x10]
call fcn.0040ef90
mov ecx, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x10], ecx
je 0x40bde4
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], bl
call fcn.0040ef90
jmp 0x40be6f
lea eax, [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push ebx
push ebx
lea edx, [esp + 0x24]
push ebx
lea eax, [esp + 0x38]
push edx
push eax
mov ebp, 0x100
push ebx
push ecx
mov dword [esp + 0x38], ebp
call esi
test eax, eax
jne 0x40be41
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040f000
cmp eax, ebx
jne 0x40bdcf
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x38], ebp
call esi
test eax, eax
je 0x40be0d
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40be54
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
push 0x41c354
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40be6f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x40be7e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x138]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp ebp, ebx
pop esi
je 0x40bea4
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x124]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret

Function at 0x40bec0
Capabilities:
Delete registry value

Disassembly:
mov edx, dword [esp + 8]
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40beee
xor eax, eax
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x40bf05
xor eax, eax
ret
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret
Function at 0x40bf40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x411f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString_2
push 0xff
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
xor edi, edi
mov dword [esp + 0x10], 0xff
call sub.MFC42.DLL_CString::GetBuffer
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push edi
push 0x41970c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c015
mov eax, dword [esp + 0xc]
mov edi, esi
mov ecx, eax
dec eax
mov edx, ecx
mov dword [esp + 0xc], eax
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push 0x419704
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea edx, [esp + 0x14]
push 1
push edx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
lea ecx, [esp + 0x14]
mov edi, eax
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x40c360
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push esi
lea eax, [esp + 0x10]
push edi
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40c3ae
mov edi, dword [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret 0x18
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40c40c
mov edi, dword [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x18
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
ret 0x18
Function at 0x40d050
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4120d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], ebx
call sub.MFC42.DLL_CString::MakeUpper
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x40d1b1
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x128
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
mov byte [esp + 0x144], 1
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40d19a
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x10]
call fcn.0041030a
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::MakeUpper
mov edx, dword [esp + 0x14c]
push ebx
push edx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find_2
cmp eax, 0xffffffff
jne 0x40d131
lea eax, [esp + 0x14]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
cmp eax, ebx
je 0x40d19a
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x10]
call fcn.0041030a
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::MakeUpper
mov edx, dword [esp + 0x14c]
push ebx
push edx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find_2
cmp eax, 0xffffffff
je 0x40d0f0
mov eax, dword [esp + 0x1c]
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x40d1a1
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x144], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40d1ca
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov byte [esp + 0x144], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x13c
ret 4

Function at 0x40d360
Capabilities:
Create thread
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x412108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0x41c354
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
mov ecx, esi
mov dword [esp + 0x10], 0
call fcn.0040bf40
cmp eax, 7
pop esi
jl 0x40d3d7
push 0x41c55c
push 0
push 0
push 0x408560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41c558], eax
push eax
lea eax, [esp + 4]
push 0x41b0e4
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0xc]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40d400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x412168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], ebx
call sub.MFC42.DLL_CStdioFile::CStdioFile
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 1
call sub.MFC42.DLL_CException::CException
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString_2
push ebx
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 3
mov dword [esp + 0x18], 0x413e34
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.0041030a
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 4
call sub.MFC42.DLL_CString::CString_2
push 0x41b10c
lea eax, [esp + 0x14]
push 0x419588
push eax
mov byte [esp + 0x50], 5
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ebx
push 0x3042
push ecx
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
je 0x40d596
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
mov byte [esp + 0x44], 6
xor esi, esi
lea edx, [esp + 0xc]
lea ecx, [esp + 0x28]
push edx
call sub.MFC42.DLL_CStdioFile::ReadString
cmp eax, ebx
jne 0x40d4df
cmp esi, ebx
jne 0x40d588
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0xc]
push eax
push ecx
inc esi
call edi
add esp, 8
test eax, eax
je 0x40d4c5
mov edx, dword [esp + 0x28]
push ebx
push ebx
lea ecx, [esp + 0x30]
call dword [edx + 0x30]
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x28]
push eax
call sub.MFC42.DLL_CStdioFile::WriteString
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CStdioFile::Close
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 4
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x14], 0x413e34
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0x413e20
mov byte [esp + 0x44], bl
call fcn.00410610
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CStdioFile::Close
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 4
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x14], 0x413e34
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0x413e20
mov byte [esp + 0x44], bl
call fcn.00410610
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x40f000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x41237b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x134]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x40f078
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
je 0x40f068
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x40f08a
jmp 0x40f07c
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x40f125
push ecx
jmp 0x40f11f
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x40f0f0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.0040f000
mov ebx, eax
cmp ebx, edi
jne 0x40f141
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x40f0b2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x40f103
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x134]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x40f125
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x40f150
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40f127
Function at 0x40f330
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
lea eax, [esp + 0x14]
push edi
push eax
push 0x20019
push 0
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f35d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
je 0x40f394
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push eax
mov ecx, esi
call fcn.0040f5f0
lea ecx, [esp + 0x24]
lea edx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x20]
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x40f3dc
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
push ebp
call edi
mov ecx, esi
call fcn.0040f630
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
call fcn.0040f530
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x40f410
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
lea eax, [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40f440
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x10]
push esi
push edi
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call edi
push ebx
call edi
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
ret
Function at 0x4028b4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4028e3
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403b3c
jmp 0x402901
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0040283c
mov edi, eax
test ebx, ebx
je 0x402901
cmp dword [esi], 0
je 0x402901
dec ebx
jmp 0x4028ea
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402a94
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x483040], 0x8088405
inc edx
mov dword [0x483040], edx
mul edx
mov eax, edx
ret

Function at 0x402c44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402cdc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402cbc
xor eax, eax
push ebp
push 0x402cb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402cf8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402cbc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret