joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a40
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push edi
xor ebx, ebx
push ebx
push ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x402a6c
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
push esi
push edi
call dword [sym.imp.MSVCR71.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x402a89
pop esi
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x402aad
push esi
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
pop esi
pop edi
pop ebp
mov eax, ebx
mov edx, ebx
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x4169c4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
push esi
je 0x402a98
mov eax, dword [esp + 0x14]
mov dx, word [eax + 0x12]
mov cx, word [eax + 0x10]
mov word [esp + 0x1c], dx
mov dx, word [eax + 0x16]
mov ax, word [eax + 0x14]
mov word [esp + 0x1e], cx
mov word [esp + 0x20], dx
mov word [esp + 0x22], ax
call dword [sym.imp.MSVCR71.dll_free]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add esp, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4046f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4206dc]
sub esp, 0xc
test eax, eax
mov dword [0x4206d8], 0
je 0x40470c
xor eax, eax
add esp, 0xc
ret
push esi
push 0x4206e8
call dword [sym.imp.MSVCR71.dll_wcslen]
add esp, 4
test eax, eax
jne 0x4047a8
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 1
xor esi, esi
push esi
push str.CLSID0280750F_22B0_46fd_BCCA_99B3BF28765EInprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40478c
lea ecx, [esp + 0xc]
push ecx
push 0x4206e8
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40477d
cmp dword [esp + 8], 1
jne 0x40477d
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4047a8
mov eax, dword [0x4206d8]
test eax, eax
jle 0x40479e
mov word [0x4206da], 0x8007
mov eax, 0x80004005
pop esi
add esp, 0xc
ret
push 0x4206e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x4206dc], eax
je 0x40478c
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x404870
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x413aeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x2214
call fcn.00412d30
mov eax, dword [0x4205ac]
push ebx
push esi
push edi
push 0x4206c0
mov dword [esp + 0x2220], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, 1
mov dword [esp + 0x14], edi
mov eax, dword [0x4206dc]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x222c], esi
je 0x4048d7
cmp dword [0x4206e0], esi
jne 0x404a33
mov word [esp + 0x218], si
call fcn.004046f0
test eax, eax
jge 0x404908
push 0x2000
lea eax, [esp + 0x21c]
push str.This_program_requires_the_file_advrcntr2.dll__which_was_not_found_on_this_system.
push eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0xc
jmp 0x4049ad
mov ebx, dword [ebp + 8]
push ebx
call fcn.004047d0
add esp, 4
test eax, eax
jge 0x404a33
test bl, bl
mov dword [esp + 0x10], esi
je 0x404976
mov eax, dword [0x4206e0]
cmp eax, esi
jne 0x404959
mov eax, dword [0x4206dc]
cmp eax, esi
je 0x404976
push 6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x404950
push esi
call eax
add esp, 4
mov dword [0x4206e0], eax
jmp 0x404955
mov eax, dword [0x4206e0]
cmp eax, esi
je 0x404976
lea esi, [eax + 0x28]
push esi
mov edi, 2
call fcn.00404820
add esp, 4
test eax, eax
je 0x404974
call dword [esi]
mov dword [esp + 0x10], eax
xor esi, esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
push 0x1f40
push 0x28a0
push edi
push str.Fatal_Error:_r_nInstallation_corrupted___please_reinstall_NERO__r_n_r_nError_Code:__i____i____i____i_r_nParameters:__i____i____i_r_nSee_Doc4536
lea edx, [esp + 0x238]
push 0x2000
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x28
push 0x4206c0
mov dword [0x4206e0], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x41707c]
mov cx, word [0x417080]
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
xor eax, eax
mov ecx, 0x7e
lea edi, [esp + 0x1e]
rep stosd dword es:[edi], eax
push 0x100
lea edx, [esp + 0x1c]
push edx
push str.NeroSuppressProxyCheck
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x404a0d
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MSVCR71.dll__wtoi]
add esp, 4
test eax, eax
jne 0x404a2c
test byte [0x4206e4], 1
jne 0x404a2c
push 0x10
push str.Nero
lea ecx, [esp + 0x220]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0x80004005
jmp 0x404a40
push 0x4206c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x2224]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x221c]
call fcn.00412cbe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407a40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x413fc9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x84]
test eax, eax
jne 0x407af7
push esi
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
push 0x410
push 0x410
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MFC71U.DLL_CRecordset::GetBoundParamIndex]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_CDC::ReleaseAttribDC]
push 0x417efc
lea ecx, [esp + 0xc]
call dword [0x4160fc]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x407ae5
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorW]
test eax, eax
je 0x407ae5
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x84], eax
mov dword [edi + 0xf8], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x408640
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4140d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call sub.MFC71U.DLL_CWnd::CWnd
xor edi, edi
mov dword [esi], 0x4182f8
mov dword [esp + 0x20], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], 0x4177cc
lea ebx, [esi + 0x78]
mov ecx, ebx
mov byte [esp + 0x20], 1
call sub.MFC71U.DLL_CPropsetPropExchange::CPropsetPropExchange
lea ebp, [esi + 0x8c]
mov ecx, ebp
mov byte [esp + 0x20], 2
call sub.MFC71U.DLL_CStdioFile::CStdioFile
push 0xf
mov byte [esp + 0x24], 3
call dword [sym.imp.USER32.dll_GetSysColor]
push 8
mov dword [esi + 0x54], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push 0xffffffffffffffff
push edi
mov ecx, ebx
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0x74], edi
call sub.MFC71U.DLL_CObArray::SetSize
push 0xffffffffffffffff
push edi
mov ecx, ebp
call sub.MFC71U.DLL_CPtrArray::SetSize
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
push 0x410
push 0x411
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 4
call dword [sym.imp.MFC71U.DLL_CRecordset::GetBoundParamIndex]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_CDC::ReleaseAttribDC]
push 0x417efc
lea ecx, [esp + 0x14]
call dword [0x4160fc]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x408764
push 0x6a
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
cmp eax, edi
je 0x408764
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [esi + 0xa8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40aff0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4146ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call sub.MFC71U.DLL_CDialog::CDialog
xor ebx, ebx
mov dword [esi], 0x4188d0
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x74], ebx
lea edi, [esi + 0x80]
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
lea ecx, [esi + 0x84]
mov byte [esp + 0x1c], 2
call fcn.00408640
lea ecx, [esi + 0x134]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
lea ecx, [esi + 0x138]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_2]
lea ebp, [esi + 0x140]
mov ecx, ebp
mov byte [esp + 0x1c], 5
call sub.MFC71U.DLL_CWnd::CWnd
mov dword [ebp], 0x417c78
mov ebp, dword [esp + 0x24]
push ebp
mov ecx, edi
mov byte [esp + 0x20], 6
mov dword [esi + 0x78], ebx
mov byte [esi + 0x7c], bl
mov byte [esi + 0x7d], bl
mov byte [esi + 0x13c], bl
mov dword [esi + 0x194], 0x40
mov byte [esi + 0x198], bl
mov dword [esi + 0x19c], ebx
call dword [0x4163cc]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x28]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edx
push eax
mov dword [esp + 0x48], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x40b130
mov ecx, dword [esi + 0x74]
xor eax, eax
cmp ecx, ebx
je 0x40b0e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x74], ebx
cmp eax, ebx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x74], ecx
jne 0x40b130
lea edx, [esp + 0x28]
push edx
mov edx, dword [esi + 0x74]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebp
mov edi, 4
push edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x24], edi
jne 0x40b130
cmp eax, ebx
jne 0x40b130
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0x78]
cmp eax, ebx
je 0x40b141
cmp eax, 2
je 0x40b141
mov ebx, 1
mov eax, dword [esp + 0x30]
mov ecx, eax
shr ecx, 1
and cl, 1
and al, 1
mov byte [esi + 0x7d], al
pop edi
mov byte [esi + 0x7c], bl
mov byte [esi + 0x13c], cl
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x194], 1
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x40b180
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4146da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
mov ebp, ecx
mov dword [esp + 4], 0
mov al, byte [ebp + 0x7c]
test al, al
jne 0x40b2ed
mov al, byte [ebp + 0x13c]
test al, al
push ebx
mov ebx, dword [esp + 0x1c]
je 0x40b264
push esi
push edi
lea esi, [ebp + 0x138]
push ebx
mov ecx, esi
call dword [0x4163cc]
push 0x418a30
push 0x4177e0
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Replace]
lea edi, [ebp + 0x134]
push esi
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
push str._br_
push 0x4177e0
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Replace]
push 0x4177e0
push str._br_
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Replace]
push 0x4177e0
mov ecx, esi
call dword [0x4160fc]
push 0
push 0x3c
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CWnd::FilterToolTipMessage]
mov edi, eax
test edi, edi
jl 0x40b262
push edi
push 0x3e
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CWnd::FilterToolTipMessage]
cmp eax, edi
jle 0x40b250
sub eax, edi
inc eax
push eax
push edi
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CMDIFrameWnd::DelayUpdateFrameMenu]
push 0
push 0x3c
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CWnd::FilterToolTipMessage]
mov edi, eax
test edi, edi
jge 0x40b234
pop edi
pop esi
push ebp
call sub.MFC71U.DLL_AfxHelpEnabled
mov al, byte [ebp + 0x13c]
test al, al
je 0x40b27c
lea eax, [ebp + 0x138]
jmp 0x40b297
push ebx
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [eax]
push ecx
push edx
push eax
call sub.MFC71U.DLL_AfxMessageBox
mov dword [ebp + 0x78], eax
test byte [esp + 8], 1
pop ebx
je 0x40b2be
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov al, byte [ebp + 0x7c]
test al, al
mov eax, dword [ebp + 0x78]
je 0x40b2f0
cmp eax, 2
je 0x40b2ed
mov ecx, dword [ebp + 0x80]
mov edx, dword [ebp + 0x74]
push 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 0x78]
mov ecx, dword [esp + 8]
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x40bb90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x414728
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x14]
mov dword [esi + 0x10], ecx
push edx
lea ecx, [esi + 0x14]
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
add edi, 0x4c
push edi
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40f010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4149d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x14]
mov dword [esp + 8], esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40f2d2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx], 0xffffffff
mov eax, dword [0x4205ac]
mov dword [ebp - 4], eax
je 0x40f310
call fcn.0040f1f6
push 7
lea ecx, [ebp - 0x14]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40f310
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR71.dll__wtoi]
pop ecx
jmp 0x40f312
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.00412cbe
leave
ret

Function at 0x40f48f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4205ac]
push edi
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x40f4bd
mov edi, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x40f548
push esi
push edi
call dword [sym.imp.MSVCR71.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x40f4d8
mov edi, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x40f547
push esi
push edi
push 0
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40f4ff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4169c4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40f514
push esi
call dword [sym.imp.MSVCR71.dll_free]
mov edi, dword [ebp + 8]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x40f546
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f3a6
push esi
call dword [sym.imp.MSVCR71.dll_free]
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.00412cbe
leave
ret
Function at 0x412a83
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x41ad80
call fcn.00412e08
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x412ac3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412ac3
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x412adb
cmp eax, 0x20b
je 0x412ac8
mov dword [ebp - 0x1c], edi
jmp 0x412aef
cmp dword [ecx + 0x84], 0xe
jbe 0x412ac3
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x412ae9
cmp dword [ecx + 0x74], 0xe
jbe 0x412ac3
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4209e8], 0xffffffff
or dword [0x4209ec], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x420984]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x420980]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4209e4], eax
call fcn.00412e78
call fcn.00412f18
cmp dword [0x4205c8], edi
jne 0x412b4f
push fcn.00412f18
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00412f06
push 0x420038
push 0x420034
call sub.MSVCR71.dll__initterm
push 0x412ebc
call fcn.00412d02
mov eax, dword [0x42097c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x420978]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x412ba3
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x420030
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x412bcd
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x412c87
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x412c3c
cmp ax, di
je 0x412be3
cmp dword [ebp - 0x20], edi
jne 0x412c3c
mov ax, word [esi]
cmp ax, di
je 0x412bf8
cmp ax, 0x20
ja 0x412bf8
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x412be3
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x412c14
movzx eax, word [ebp - 0x54]
jmp 0x412c17
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.004135e8
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x412c34
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x412c81
cmp ax, 0x22
jne 0x412c4d
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x412bcd
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00412e43
ret
Function at 0x402a8c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404490
test esi, esi
jne 0x402ac2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404580
jmp 0x402ae0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029a0
mov edi, eax
test esi, esi
je 0x402ae0
cmp dword [ebx], 0
je 0x402ae0
dec esi
jmp 0x402ac9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403024
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45f008], 0x8088405
inc edx
mov dword [ebx + 0x45f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403040
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45f008], 0x8088405
inc edx
mov dword [ebx + 0x45f008], edx
fld qword [ebx + 0x45f058]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x4035ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45f010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403644
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403624
xor eax, eax
push ebp
push 0x40361d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403660
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403624
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45f010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45f010], ax
mov esp, ebp
pop ebp
ret

Function at 0x404314
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x463048], 0
je 0x404375
cmp word [0x46321c], 0xd7b2
jne 0x40433d
cmp dword [0x463224], 0
jbe 0x40433d
mov eax, 0x463218
call dword [0x463234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45f060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40439c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45f020], 0
jne 0x404391
push 0
push 0x45f080
push 0x45f060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret