joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c540
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
push 0x10dc25c
push eax
call fcn.010948d0
add esp, 8
mov esi, eax
push ebx
call fcn.0101c56c

Function at 0x101e780
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x38
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
push 0x10dd8d4
push 8
call fcn.0100dab0
add esp, 8
push ebx
call fcn.0101e7ab
Function at 0x1023310
Capabilities:
Print debug messages
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
push 0x10ddad8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call fcn.01023328

Function at 0x102e240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xb8]
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0xcc]
push esi
push edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
push ebx
call fcn.0102e299
Function at 0x1037fc0
Capabilities:
Read .ini file
Read file on windows

Disassembly:
push ebp
push esi
push edi
push 0x10dc25c
push ebx
call fcn.010948d0
add esp, 8
mov esi, eax
push ebx
call fcn.01037fd9
Function at 0x104d970
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x400
push esi
push edi
mov edi, eax
mov esi, 0xdc
push ebx
call 0x104d985
jmp 0x104d98a
pushal
call 0x104d990
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104d9a3
jmp 0x104d9a8
pushal
call 0x104d9ae
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
xor edx, edx
lea ecx, [ecx]
mov eax, edx
push ebx
call 0x104d9c8
jmp 0x104d9cd
pushal
call 0x104d9d3
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov ecx, 8
test al, 1
je 0x104da10
shr eax, 1
xor eax, 0xedb88320
push ebx
call 0x104d9f6
jmp 0x104d9fb
pushal
call 0x104da01
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
jmp 0x104da30
shr eax, 1
push ebx
call 0x104da18
jmp 0x104da1d
pushal
call 0x104da23
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
dec ecx
test ecx, ecx
jg 0x104d9e5
mov dword [esp + edx*4 + 8], eax
push ebx
call 0x104da3f
jmp 0x104da44
pushal
call 0x104da4a
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
inc edx
cmp edx, 0x100
jl 0x104d9c0
or eax, 0xffffffff
push ebx
call 0x104da6d
jmp 0x104da72
pushal
call 0x104da78
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
movzx ecx, byte [edi]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [esp + ecx*4 + 8]
dec esi
push ebx
call 0x104da9e
jmp 0x104daa3
pushal
call 0x104daa9
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
inc edi
push ebx
call 0x104dabd
jmp 0x104dac2
pushal
call 0x104dac8
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
test esi, esi
jne 0x104da85
pop edi
not eax
pop esi
add esp, 0x400
ret
Function at 0x10521a0
Capabilities:
Check if file exists
Copy file
Create process on windows
Self delete
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x208
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push esi
push ebx
call fcn.010521bc
Function at 0x105fe10
Capabilities:
Create thread

Disassembly:
mov ecx, dword [0x10faebc]
push ebx
push esi
mov esi, eax
xor eax, eax
mov dword [ecx + 0x200], eax
mov dword [ecx + 0x204], eax
mov dword [ecx + 0x208], eax
push edi
mov dword [ecx + 0x20c], eax
push ebx
call 0x105fe3b
jmp 0x105fe40
pushal
call 0x105fe46
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
push 0x10faa0c
push eax
push esi
push 0x105df60
push eax
push eax
call fcn.01091530
add esp, 0x18
mov edi, eax
push ebx
call 0x105fe71
jmp 0x105fe76
pushal
call 0x105fe7c
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
push 0x10fad3c
push 0
push 0
push 0x103adc0
push 0
push 0
call fcn.01091530
add esp, 0x18
mov ebx, eax
push ebx
call 0x105feab
jmp 0x105feb0
pushal
call 0x105feb6
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
push 0x10faea4
push 0
push esi
push 0x105e040
push 0
push 0
call fcn.01091530
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
push eax
call esi
push ebx
call 0x105feeb
jmp 0x105fef0
pushal
call 0x105fef6
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
push edi
call esi
push ebx
call 0x105ff0c
jmp 0x105ff11
pushal
call 0x105ff17
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
push ebx
call esi
push ebx
call 0x105ff2d
jmp 0x105ff32
pushal
call 0x105ff38
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
mov eax, dword [0x10faebc]
mov ecx, dword [0x10faea4]
mov dword [eax + 0x17], ecx
push ebx
call 0x105ff59
jmp 0x105ff5e
pushal
call 0x105ff64
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
mov edx, dword [0x10faebc]
mov eax, dword [0x10faa0c]
mov dword [edx + 0x1b], eax
push ebx
call 0x105ff85
jmp 0x105ff8a
pushal
call 0x105ff90
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
mov ecx, dword [0x10faebc]
mov edx, dword [0x10fad3c]
mov dword [ecx + 0x1f], edx
push ebx
call 0x105ffb2
jmp 0x105ffb7
pushal
call 0x105ffbd
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
mov eax, dword [0x10faebc]
mov ecx, dword [0x10faea8]
mov dword [eax + 0x23], ecx
push ebx
call 0x105ffde
jmp 0x105ffe3
pushal
call 0x105ffe9
pop ebx
add ebx, 0xffffffa2
push 0xa11000
pop ebx
popal
pop ebx
pop ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1087f20
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10c7848
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10f5ca0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1087f78
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x50], 0
jne 0x1087f78
push pe_nt_image_headers32
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.01068e20
test eax, eax
je 0x1087f78
int3
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x50], 0
jne 0x1087f9a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1087ffd
lea ecx, [ebp - 0x10]
call fcn.010515a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x50]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x50]
mov edx, dword [edx]
mov eax, dword [edx + 0x94]
call eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.010073a0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.01066120
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.01007120
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x1090090
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10f5ca0]
jne 0x109009a
repz ret
jmp fcn.0109e710
Function at 0x10a9120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
cmp dword [ebp + 8], 0
setne al
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10a9158
push str._path___NULL_
push 0
push 0x50
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push 2
call fcn.01090630
add esp, 0x14
cmp eax, 1
jne 0x10a9158
int3
cmp dword [ebp - 8], 0
jne 0x10a9199
call fcn.0109bec0
mov dword [eax], 0
call fcn.0109be90
mov dword [eax], 0x16
push 0
push 0x50
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push str._access_s
push str._path___NULL_
call fcn.01098e20
add esp, 0x14
mov eax, 0x16
jmp 0x10a9271
mov edx, dword [ebp + 0xc]
and edx, 0xfffffff9
neg edx
sbb edx, edx
add edx, 1
mov dword [ebp - 0xc], edx
jne 0x10a91c9
push str.__amode___6____0_
push 0
push 0x51
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push 2
call fcn.01090630
add esp, 0x14
cmp eax, 1
jne 0x10a91c9
int3
cmp dword [ebp - 0xc], 0
jne 0x10a9207
call fcn.0109bec0
mov dword [eax], 0
call fcn.0109be90
mov dword [eax], 0x16
push 0
push 0x51
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push str._access_s
push str.__amode___6____0_
call fcn.01098e20
add esp, 0x14
mov eax, 0x16
jmp 0x10a9271
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10a9232
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0109bde0
add esp, 4
call fcn.0109be90
mov eax, dword [eax]
jmp 0x10a9271
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x10a923e
xor eax, eax
jmp 0x10a9271
mov eax, dword [ebp - 4]
and eax, 1
je 0x10a926f
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x10a926f
call fcn.0109bec0
mov dword [eax], 5
call fcn.0109be90
mov dword [eax], 0xd
call fcn.0109be90
mov eax, dword [eax]
jmp 0x10a9271
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5731b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00573140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00573140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00573140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00573140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x573bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x573c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x58587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x573c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x573c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x65592162
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x64a90f8a
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401930
Capabilities:
Check os version
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0x24
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x28]
mov ebx, 2
cmp eax, ebx
je 0x401977
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
or ecx, 0xffffffff
mov dword [0x42fde0], ecx
mov dword [0x42fde4], ecx
mov dword [0x42fde8], ecx
mov dword [0x42fdec], ecx
mov dword [0x42fdf0], ecx
mov dword [0x42fdf4], ecx
mov word [0x42fdf8], cx
xor eax, eax
mov ecx, 0x1a
mov edi, 0x42fd78
rep stosd dword es:[edi], eax
call fcn.004029d0
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [esp + 0x10], 0x5c3a41
mov byte [esp + 0x14], 0
xor ebp, ebp
lea ecx, [ecx]
mov dl, bl
lea eax, [esp + 0x10]
add dl, 0x41
push eax
mov byte [esp + 0x14], dl
call esi
cmp eax, 5
jne 0x4019ec
mov byte [ebp + 0x42fde0], bl
inc ebp
inc bl
cmp bl, 0x1a
jl 0x4019d0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x42fd78
mov edi, edi
mov eax, dword [esi]
test eax, eax
je 0x401a0f
push eax
call edi
mov dword [esi], 0
add esi, 4
cmp esi, 0x42fde0
jl 0x401a00
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401a30
Capabilities:
Get storage device properties

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41f1b8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esi*4 + 0x42fd78]
xor ebp, ebp
cmp edi, ebp
jne 0x401a89
mov al, byte [esi + 0x42fde0]
push ebp
push ebp
push 3
push ebp
push 3
push 0xc0000000
add al, 0x41
push 0x42f694
mov byte [0x42f698], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi*4 + 0x42fd78], eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x401aa2
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebp
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x3c]
push eax
push 8
xor edx, edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], edx
lea ecx, [esp + 0x20]
push ecx
push 0xc
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push edi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x58], ebp
call ebx
cmp eax, 1
je 0x401b08
call section..text
pop ebx
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 0x18]
push eax
call sub.MFC71.DLL_operator_new_1
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x18]
push ebp
lea ecx, [esp + 0x3c]
push ecx
push edx
push esi
push 0xc
lea eax, [esp + 0x30]
push eax
push 0x2d1400
push edi
mov dword [esp + 0x50], ebp
call ebx
mov edi, eax
call section..text
cmp edi, 1
je 0x401b64
push esi
call sub.MFC71.DLL_operator_delete_1
add esp, 4
pop ebx
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x20]
sub ecx, 0x24
cmp eax, ecx
ja 0x401bad
mov eax, dword [esi + 0xc]
cmp eax, ebp
je 0x401b85
mov ecx, dword [esp + 0x3c]
add eax, esi
push eax
call dword [0x42271c]
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x401b99
mov ecx, dword [esp + 0x40]
add eax, esi
push eax
call dword [0x42271c]
mov eax, dword [esi + 0x14]
cmp eax, ebp
je 0x401bad
mov ecx, dword [esp + 0x44]
add eax, esi
push eax
call dword [0x42271c]
push esi
call sub.MFC71.DLL_operator_delete_1
mov ecx, dword [esp + 0x2c]
add esp, 4
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4029d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41f25c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push edi
lea eax, [esp + 8]
push eax
push 0x20019
xor edi, edi
push edi
push str.SoftwareAheadShared
push SysStringLen
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402acf
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push edi
push edi
push str.DriveLocker
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x402ac4
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x42fe04], eax
je 0x402ac4
push esi
push str.DriveLockerInit
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x402ac3
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push 0x6d
lea ecx, [esp + 0xc]
mov dword [esp + 0x134], edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::LoadStringA]
push edi
push 0x42fe00
push 0x422ba4
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call esi
add esp, 0x14
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
pop esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x124]
pop edi
mov dword fs:[0], ecx
add esp, 0x12c
ret
Function at 0x403e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41f41e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push esi
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea ecx, [esp + 0xc]
mov dword [esp + 0x9c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea ecx, [esp + 0x44]
mov byte [esp + 0x9c], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
movzx esi, byte [esp + 0xa4]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
mov byte [esp + 0xac], 2
call fcn.00401a30
add esp, 0x10
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea eax, [esp + 0x68]
push str._s_s
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
mov al, byte [esp + 0xbc]
add esp, 0x10
test al, al
je 0x403f35
mov ecx, dword [esp + 0xa8]
push ecx
push esi
call fcn.00401d70
add esp, 8
mov dword [esp + 4], eax
mov esi, str.DVD_Speed
jmp 0x403f55
mov edx, dword [esp + 0xa8]
push edx
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.00402210
add esp, 0x10
mov esi, str.Speed
call sub.MFC71.DLL_AfxGetModuleState
mov edx, dword [esp + 4]
mov eax, dword [eax + 4]
push edx
push esi
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
call sub.MFC71.DLL_CWinApp::WriteProfileInt
lea ecx, [esp + 0x44]
mov byte [esp + 0x9c], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x9c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x28]
mov dword [esp + 0x9c], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x94]
pop esi
mov dword fs:[0], ecx
add esp, 0x9c
ret
Function at 0x4040e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41f469
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0xc]
call dword [0x4221d8]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::StringLength]
add esp, 4
push eax
push edi
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_5]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4043f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41f4c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x422750]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret