joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3f80
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cd9cb
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4c417b
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x4c417b
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4c417b
push edi
call fcn.004c41a0
add esp, 4
test al, al
jne 0x4c3fe6
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xa1
jmp 0x4c4188
push edi
mov ecx, esi
call fcn.004c3ef0
test eax, eax
je 0x4c3ffa
push edi
mov ecx, esi
call fcn.004c42d0
call fcn.004c3630
mov eax, dword [edi]
push 0
push 0x42000000
push 3
push 0
push 3
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c4034
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x4c4188
push 0xa05c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x4c407b
mov ecx, dword [esi + 0x44]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov dl, byte [esi + 0x40]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push ecx
push ebp
push edx
push edi
push ebx
mov ecx, eax
call fcn.004c4920
mov edi, eax
jmp 0x4c407d
xor edi, edi
test edi, edi
mov dword [esp + 0x18], 0xffffffff
jne 0x4c40a2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xe
jmp 0x4c4188
mov eax, dword [esi + 4]
push 0
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
mov dword [esi + 4], eax
jne 0x4c40d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov ecx, edi
mov esi, eax
call fcn.004c4ba0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x4c4188
mov eax, dword [esi + 8]
test eax, eax
jne 0x4c4126
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
push 0x4c4dc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
jne 0x4c4118
push eax
mov ecx, edi
call fcn.004c4ba0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
mov eax, 0xa4
je 0x4c4188
call esi
jmp 0x4c4188
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x20]
test eax, eax
mov dword [esi + 0xc], edx
je 0x4c4169
mov eax, dword [esi + 4]
mov ecx, edi
push eax
call fcn.004c4c40
mov ebx, eax
test ebx, ebx
je 0x4c414b
push 0
mov ecx, edi
call fcn.004c4ba0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x4c4188
mov ecx, dword [esp + 0x28]
push esi
call fcn.004c3850
push edi
mov ecx, esi
call fcn.004c44e0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4c4188
push 0xa4
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xa4
jmp 0x4c4188
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0x57
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x18
Function at 0x4c41a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c41bc
test al, 0x10
je 0x4c41bc
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4c5b60
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0x6932d8
push 0
push esi
push 0x4c5c00
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [0x6932d4], eax
test eax, eax
je 0x4c5b99
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x6932d4]
test eax, eax
setne al
pop esi
ret
Function at 0x401261
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 8
call sub.MFC42.DLL_CString::Empty
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xc]
and edx, 0x10
test edx, edx
jne 0x4012c7
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
push 1
push 1
lea edx, [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
movsx eax, byte [ebp - 4]
cmp eax, 0xa
je 0x4012af
movsx ecx, byte [ebp - 4]
cmp ecx, 0xd
jne 0x4012b6
mov eax, 1
jmp 0x4012df
mov dl, byte [ebp - 4]
push edx
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.0040f7f2
jmp 0x401275
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00401fc0
test eax, eax
je 0x4012da
xor eax, eax
jmp 0x4012df
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402549
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x10c], ecx
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x4025c6
mov ecx, 0x415a4c
call fcn.00401fe0
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
mov ecx, 0x415a4c
call fcn.00401fe0
push eax
mov edx, dword [ebp - 0x104]
lea eax, [ebp + edx - 0x100]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x4025f4
mov ecx, 0x415a48
call fcn.00401fe0
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
mov ecx, 0x415a48
call fcn.00401fe0
push eax
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx + 0x43c], eax
mov edx, dword [ebp - 0x10c]
cmp dword [edx + 0x43c], 0
jne 0x40261e
jmp 0x402671
push str.S3Dsp_Initialize
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x402671
call dword [ebp - 0x108]
test eax, eax
jne 0x402661
mov edx, dword [ebp - 0x10c]
mov dword [edx + 0x440], 0
jmp 0x402671
mov eax, dword [ebp - 0x10c]
mov dword [eax + 0x440], 1
mov esp, ebp
pop ebp
ret
Function at 0x4063ba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00407c40
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4063d3
jmp 0x4064ea
cmp dword [0x415a54], 0
je 0x4063e1
jmp 0x4064ea
mov eax, dword [ebp - 8]
mov dword [eax + 0x3f0], 0
mov ecx, dword [ebp - 8]
call fcn.00406a09
push 0
call dword [sym.imp.USER32.dll_GetWindowDC]
mov dword [ebp - 0x10], eax
push 8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 4], eax
push 0xa
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3fc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3fc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3f8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3f4]
push ecx
push Ordinal_4
push 0x415a64
push 0x414688
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x415a54], eax
cmp dword [0x415a54], 0
jne 0x406486
jmp 0x4064ea
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3fc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3fc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3f8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3f4]
push eax
push 0xffffffffffffffff
mov ecx, dword [0x415a54]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [ebp - 8]
cmp dword [edx + 0x3f0], 0
jne 0x4064db
push 0
mov eax, dword [0x415a54]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4064ea
push 1
mov ecx, dword [0x415a54]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406766
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4146a8
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406805
mov dword [ebp - 0x14], 4
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push 0x4146c0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4067fb
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0
push 0
push str.WinHandle
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4067fb
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40680c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREeGalaxTouch
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4068b6
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 4
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push 0x4146f0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4068ac
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 0x4146fc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4068ac
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4068b8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4068bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41033a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
mov dword [ebp - 0x26c], ecx
push 0x414708
lea ecx, [ebp - 0x24]
call fcn.0040f978
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.00406766
test eax, eax
jne 0x4069d9
push 0x44
push 0
lea ecx, [ebp - 0x268]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x268], 0x44
lea edx, [ebp - 0x224]
push edx
call fcn.0040680c
add esp, 4
test eax, eax
je 0x4069b2
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x24]
call fcn.00401fe0
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x24]
call fcn.00401fe0
push eax
mov ecx, dword [ebp - 0x10]
lea edx, [ebp + ecx - 0x224]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x268]
push ecx
push 0
push 0
push 0x200
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4069d9
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x268]
push ecx
push 0
push 0
push 0x200
push 0
push 0
push 0
push str.eGalaxTouch.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x406fca
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4147fc
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4070ac
push 4
mov edx, dword [ebp - 0x10]
add edx, 0x3f0
push edx
push 4
push 0
push str.ButtonDisplay
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
push 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x3f4
push ecx
push 4
push 0
push str.ButtonLeft
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov eax, dword [ebp - 0x10]
add eax, 0x3f8
push eax
push 4
push 0
push str.ButtonTop
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov edx, dword [ebp - 0x10]
add edx, 0x3fc
push edx
push 4
push 0
push str.ButtonWidth
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x400
push ecx
push 4
push 0
push str.ButtonHeight
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40cabd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x415364
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40cb16
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8

Function at 0x40cbb0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41075d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40cd20
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41085d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0x13
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40d5e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4109c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00401ec0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x411d58
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40ec20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x415800
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40ecbf
mov dword [ebp - 0x14], 4
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push 0x415818
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40ecb5
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0
push 0
push 0x415828
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40ecb5
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40f43b
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410ced
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0x368
push eax
push 4
mov ecx, dword [ebp - 0x14]
push ecx
push 0x40f2ca
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x36c], eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::Empty
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x36c]
push ecx
push str.CreateWaveOutThread_:_m_hWaveOutThread__0x_x__n
lea edx, [ebp - 0x10]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x36c], 0
je 0x40f4d0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x36c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40f4ed
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x370]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x370], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret