joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b1f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.00411960
add esp, 0xc
mov dword [ebp - 0x210], 0
test esi, esi
jne 0x44b24b
push str.DriverBaseInfo::DeleteFromRegistry:_Got_bad_configName_param
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push 2
lea eax, [ebp - 0x20c]
push eax
push 0x104
push dword [ebp + 0xc]
push esi
call fcn.0044d6b0
add esp, 0x18
test eax, eax
je 0x44b23a
push ebx
push edi
lea eax, [ebp - 0x20c]
mov ebx, 1
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x210]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
test edi, edi
jne 0x44b2ae
push str.DriverBaseInfo::DeleteFromRegistry:_Deleted_info_for_driver__S
push 2
call fcn.00446b80
add esp, 0xc
jmp 0x44b2dc
cmp edi, 2
jne 0x44b2c3
push str.DriverBaseInfo::DeleteFromRegistry:_No_info_for_driver__S_to_delete
push edi
call fcn.00446b80
add esp, 0xc
jmp 0x44b2dc
lea eax, [ebp - 0x20c]
push eax
push str.DriverBaseInfo::DeleteFromRegistry:_Failed_to_delete__S_info_for_driver__S
push edi
push 1
call fcn.00447040
add esp, 0x14
xor ebx, ebx
push 0
push str.SOFTWAREVMware__Inc.VMware_Drivers
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00453e50
add esp, 0xc
test eax, eax
je 0x44b306
push str.SOFTWAREVMware__Inc.VMware_Drivers
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00452ed0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x44b6e0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497b50
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00411960
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00411960
add esp, 0x18
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x44b768
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.BaseDriverManager::DeleteServiceSystemFile:_Failed_to_get_system_directory
push eax
push 1
call fcn.00447040
add esp, 0xc
jmp 0x44b84f
cmp dword [esi + 0x7c], 8
lea eax, [esi + 0x68]
jb 0x44b773
mov eax, dword [eax]
push eax
push str.drivers
lea eax, [ebp - 0x420]
push eax
push str._s_s_s
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00419510
lea eax, [ebp - 0x218]
mov dword [ebp - 0x424], esp
mov ecx, esp
push eax
call fcn.00442fe0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004491c0
add esp, 0x18
test eax, eax
je 0x44b84f
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x218]
je 0x44b80f
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x44b7fb
lea eax, [ebp - 0x218]
push eax
push str.BaseDriverManager::DeleteServiceSystemFile:_Requested_delayed_delete_for__S__reboot_required
push 2
call fcn.00446b80
add esp, 0xc
jmp 0x44b84f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x218]
push ecx
push str.BaseDriverManager::DeleteServiceSystemFile:_ERROR:_Failed_to_request_delayed_delete__S
jmp 0x44b844
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x44b832
lea eax, [ebp - 0x218]
push eax
push str.BaseDriverManager::DeleteServiceSystemFile:_Deleted_the_driver_sys_file__S
push 2
call fcn.00446b80
add esp, 0xc
jmp 0x44b84f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x218]
push ecx
push str.BaseDriverManager::DeleteServiceSystemFile:_ERROR:_Failed_to_delete__S
push eax
push 1
call fcn.00447040
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 4
Function at 0x44bbb0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x2c], 8
push edi
lea edi, [esi + 0x18]
mov eax, edi
jb 0x44bbc5
mov eax, dword [edi]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x44bbcf
mov ecx, dword [esi]
push eax
push ecx
push dword [esi + 0x30]
push dword [esi + 0x34]
push str.PendingRebootFileOp::DoPendingFileOpImpl:_FileOp__d_flgs__u__S_____S
push 2
call fcn.00446b80
add esp, 0x18
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x44bbf0
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x44bbfa
mov eax, dword [esi]
push dword [esi + 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x44bc3d
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [edi + 0x14], 8
mov ebx, eax
jb 0x44bc1a
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x44bc22
mov esi, dword [esi]
push edi
push esi
push str.PendingRebootFileOp::DoPendingFileOpImpl:_Failed_op___S_______S_
push ebx
push 1
call fcn.00447040
add esp, 0x14
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x44ceb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x94]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0x90
push 0
push eax
mov dword [ebp - 0x98], 0x94
call fcn.00411960
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp + 0x14]
test eax, eax
je 0x44cf3a
cmp dword [ebp - 0x94], 6
jae 0x44cf3a
cmp dword [esi + 0x18], 0
je 0x44cf18
cmp dword [ecx + 0x18], 0
jne 0x44cf3a
push str.BaseDriverManager::IsSameDriverAndPresent:_Pre_Vista_OS_and_either_one_or_both_drivers_are_non_WHQL
push 2
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
cmp eax, dword [ecx + 8]
jne 0x44cf52
mov eax, dword [esi + 0xc]
cmp eax, dword [ecx + 0xc]
jne 0x44cf52
mov eax, dword [esi + 0x10]
cmp eax, dword [ecx + 0x10]
je 0x44cf68
sbb eax, eax
inc eax
test eax, eax
je 0x44cf70
mov eax, dword [esi + 4]
cmp eax, dword [ecx + 4]
je 0x44cf77
mov eax, str.DriverVersionInfo::IsSameAs:_Custom_action_versions_dont_match
jmp 0x44cf84
mov eax, dword [esi + 0x14]
cmp eax, dword [ecx + 0x14]
jae 0x44cf59
mov eax, str.DriverVersionInfo::IsSameAs:_File_versions_dont_match_or_older
jmp 0x44cf84
mov eax, dword [esi + 0x18]
cmp eax, dword [ecx + 0x18]
je 0x44cfae
mov eax, str.DriverVersionInfo::IsSameAs:_WHQL_status_doesnt_match
push eax
push 2
call fcn.00446b80
push str.BaseDriverManager::IsSameDriverAndPresent:_Driver_file_versions_dont_match
push 2
call fcn.00446b80
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
cmp word [esi + 0x1c], 0
jne 0x44cfd7
push str.BaseDriverManager::IsSameDriverAndPresent:_No_inf_name_was_recorded_for_prior_driver__treating_as_changed
push 2
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.00450f20
add esp, 8
test eax, eax
jne 0x44d007
push str.BaseDriverManager::IsSameDriverAndPresent:_Driver_versions_matched_but_registry_wasnt_confirmed
push 2
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push edi
push esi
push ebx
call fcn.0044a3e0
add esp, 0xc
test eax, eax
jne 0x44d038
push str.BaseDriverManager::IsSameDriverAndPresent:_Not_all_devices_are_using_the_driver_recorded_in_registry
push 2
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x44e270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
dec esi
neg esi
mov dword [ebp - 8], 0
push edi
mov edi, dword [ebp + 0x10]
sbb esi, esi
add esi, 3
lea ecx, [esi + esi]
sub eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44e2dd
push ebx
cmp eax, 2
jne 0x44e2ce
push str.DriverBaseInfo::ReadMultiszFromRegistry:_No_registry_value__S
push eax
call fcn.00446b80
add esp, 0xc
jmp 0x44e2f6
push str.DriverBaseInfo::ReadMultiszFromRegistry:_Failed_to_query_value__S
push eax
push 1
call fcn.00447040
jmp 0x44e2f3
mov eax, dword [ebp - 8]
cmp eax, 7
je 0x44e30f
push ebx
push eax
push str.DriverBaseInfo::ReadMultiszFromRegistry:_Bad_value_type__u_for_value__S
push 1
call fcn.00446b80
add esp, 0x10
mov ecx, dword [ebp - 0xc]
xor eax, eax
shr ecx, 1
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 4], eax
nop dword [eax]
add eax, ecx
xor edx, edx
inc ecx
mov word [edi + eax*2], dx
cmp ecx, esi
jae 0x44e332
mov eax, dword [ebp - 4]
jmp 0x44e320
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x434], ebx
push ebx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov word [edi + 0x1c], ax
mov word [edi + 0x224], ax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x499490]
call esi
cmp eax, 1
mov ecx, 0x8007139f
cmove eax, ecx
test eax, eax
jns 0x44e3d5
push str.LegacyDriverManager::ReadNewDriverInfoFromPackage:_Ops_not_allowed
push eax
push 1
lfence
call fcn.00446d00
add esp, 0xc
jmp 0x44e4ce
cmp dword [ebx + 0x130], 0
lea eax, [ebx + 0x130]
mov dword [ebp - 0x43c], eax
lfence
je 0x44e3f5
push eax
mov ecx, edi
jmp 0x44e4c9
add ebx, 0xcc
mov ecx, ebx
cmp dword [ebx + 0x14], 8
jb 0x44e405
mov ecx, dword [ebx]
mov esi, dword [ebp - 0x434]
push ecx
add esi, 0xcc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lfence
cmp eax, 0xffffffff
jne 0x44e444
cmp dword [esi + 0x14], 8
jb 0x44e428
mov esi, dword [esi]
push esi
push str.LegacyDriverManager::ReadNewDriverInfoFromPackage:_Cant_find__S_driver_inf_file
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
call fcn.00446e90
add esp, 0x10
jmp 0x44e4ce
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x438], 0
jb 0x44e456
mov esi, dword [esi]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.0044b0b0
add esp, 0xc
mov ecx, edi
push eax
call fcn.00449d60
cmp dword [edi], 0
lfence
jne 0x44e4a9
mov eax, dword [ebp - 0x434]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x44e48e
mov eax, dword [eax]
cmp dword [ebx + 0x14], 8
jb 0x44e496
mov ebx, dword [ebx]
push eax
push ebx
push str.LegacyDriverManager::ReadNewDriverInfoFromPackage:_Couldnt_parse_INF__S_for__S_device.
push 1
call fcn.00446b80
add esp, 0x10
jmp 0x44e4ce
mov ecx, dword [ebp - 0x434]
mov eax, dword [ebp - 0x438]
mov dword [edi + 4], 0x4c4731
push edi
mov dword [ecx + 0x12c], eax
mov ecx, dword [ebp - 0x43c]
call fcn.00449d60
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 4
Function at 0x450660
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x450672
mov eax, dword [esi]
cmp dword [esi + 0x2c], 8
lea edi, [esi + 0x18]
mov ecx, edi
jb 0x45067f
mov ecx, dword [edi]
push eax
push ecx
push dword [esi + 0x30]
push dword [esi + 0x34]
push str.PendingRebootFileOp::UndoPendingFileOpImpl:_FileOp__d_flgs__u__S_____S
push 2
call fcn.00446b80
add esp, 0x18
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x4506a0
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4506aa
mov eax, dword [edi]
push dword [esi + 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4506ed
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x14], 8
mov ebx, eax
jb 0x4506ca
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x4506d2
mov edi, dword [edi]
push esi
push edi
push str.PendingRebootFileOp::UndoPendingFileOpImpl:_Failed_op___S_______S_
push ebx
push 1
call fcn.00447040
add esp, 0x14
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x451fc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 0x10]
push 0x208
push 0
push eax
call fcn.00411960
add esp, 0xc
mov dword [ebp - 0x210], 0
test esi, esi
jne 0x452020
push str.DriverBaseInfo::WriteToRegistry:_Got_bad_configName_param
push 1
call fcn.00446b80
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push 2
lea eax, [ebp - 0x20c]
push eax
push 0x104
push dword [ebp + 0xc]
push esi
call fcn.0044d6b0
add esp, 0x18
test eax, eax
je 0x45200e
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x452050
sub ecx, edx
push ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4520b7
push edi
push esi
push str.DriverBaseInfo::WriteToRegistry:_Failed_to_set__S_driver_value__S
push ebx
push 1
call fcn.00447040
add esp, 0x14
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x454fc0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call fcn.00411960
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa], ax
mov dword [ebp - 8], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push edx
movzx ecx, di
mov dword [ebp - 0x11c], ecx
push eax
movzx ecx, bx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x118], ecx
xor ecx, ecx
push 0x23
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb esi, esi
neg esi
cmp edi, 6
jbe 0x455198
test esi, esi
jne 0x455198
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0xffffffff
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4550c2
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_
push str.DInfo_AtLeastOsVersion:_Couldnt_open__S
push eax
push 8
call fcn.00447040
add esp, 0x10
jmp 0x455186
lea eax, [ebp - 0x124]
mov dword [ebp - 0x124], 4
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push str.CurrentMajorVersionNumber
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45516c
cmp dword [ebp - 0x124], 4
jne 0x45516c
cmp dword [ebp - 0x12c], 4
jne 0x45516c
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push str.CurrentMinorVersionNumber
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x455165
cmp dword [ebp - 0x124], 4
jne 0x455165
cmp dword [ebp - 0x12c], 4
jne 0x455165
cmp dword [ebp - 0x130], edi
ja 0x45515e
jne 0x45515a
cmp dword [ebp - 0x134], ebx
jae 0x45515e
xor esi, esi
jmp 0x455186
mov esi, 1
jmp 0x455186
push str.CurrentMinorVersionNumber
jmp 0x455171
push str.CurrentMajorVersionNumber
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_
push str.DInfo_AtLeastOsVersion:_Couldnt_query__S_S
push eax
push 8
call fcn.00447040
add esp, 0x14
mov eax, dword [ebp - 0x128]
cmp eax, 0xffffffff
je 0x455198
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x457140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push esi
push esi
push str.DriverMgmt_GetInfRegistryEntries
mov dword [ebp - 0x230], edi
mov ebx, 1
mov dword [ebp - 0x224], edi
call fcn.00447210
add esp, 0x10
test edi, edi
jne 0x4571a6
push str.DriverMgmt_GetInfRegistryEntries:_Bad_input_parameteres_to_GetInfRegistryEntries__
push ebx
call fcn.00446b80
add esp, 8
call fcn.00446aa0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
mov dword [edi], esi
push eax
push 0
push 1
call fcn.004579c0
add esp, 0xc
test eax, eax
je 0x457375
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00411960
add esp, 0xc
mov dword [ebp - 0x21c], 0x105
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x218], 4
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
mov dword [ebp - 0x22c], esi
test eax, eax
je 0x45725f
cmp eax, 0xea
jne 0x4572f6
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
push str.DriverMgmt_GetInfRegistryEntries:_buffer_too_small__name__d_data__d
push 1
call fcn.00446b80
add esp, 0x10
jmp 0x4571c3
mov eax, dword [ebp - 0x220]
cmp eax, 4
je 0x457286
push eax
lea eax, [ebp - 0x210]
push eax
push str.DriverMgmt_GetInfRegistryEntries:_value__S_has_unsupported_type:__d
push 1
call fcn.00446b80
add esp, 0x10
jmp 0x4571c3
push 0xc
call fcn.0047ee60
mov esi, eax
add esp, 4
test esi, esi
je 0x45732d
mov eax, dword [ebp - 0x224]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [ebp - 0x224], esi
mov dword [eax], esi
lea eax, [ebp - 0x210]
push eax
call fcn.004834a4
add esp, 4
mov dword [esi + 4], eax
test eax, eax
je 0x45732d
mov ecx, dword [ebp - 0x228]
mov dword [esi + 8], ecx
push dword [ebp - 0x228]
push eax
push str.DriverMgmt_GetInfRegistryEntries:_read_inf__S_with_attr_0x_08x
push 2
call fcn.00446b80
mov esi, dword [ebp - 0x22c]
add esp, 0x10
jmp 0x4571c3
cmp eax, 0x103
je 0x45731b
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
push str.DriverMgmt_GetInfRegistryEntries:_inf_enum_failed_with__d_name__d
push eax
push 1
call fcn.00447040
add esp, 0x14
xor ebx, ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x457375
jmp 0x45734a
push str.DriverMgmt_GetInfRegistryEntries:_Failed_to_alloc_mem_for_entry
push 1
call fcn.00446b80
add esp, 8
xor ebx, ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [edi]
test edi, edi
je 0x457369
push dword [edi + 4]
mov esi, dword [edi]
call fcn.0047ee40
push edi
call fcn.0047ee40
add esp, 8
mov edi, esi
test esi, esi
jne 0x457350
mov eax, dword [ebp - 0x230]
mov dword [eax], 0
call fcn.00446aa0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x45cfa0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.0045fd60
add esp, 8
mov edi, eax
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
mov esi, eax
call fcn.0047ee40
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x45cfd0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.0045fd60
add esp, 8
mov edi, eax
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
mov esi, eax
call fcn.0047ee40
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x45d000
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x24]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x20]
push 0x1fe
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.00411960
push 0x1fe
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], 0xff
push 0
push eax
call fcn.00411960
add esp, 0x18
mov dword [ebp - 0x410], 0xff
xor ecx, ecx
lea eax, [ebp - 0x410]
push esi
mov esi, dword [ebp - 0x414]
test esi, esi
cmove eax, ecx
cmp dword [ebp - 0x40c], ecx
push eax
lea eax, [ebp - 0x404]
cmove eax, ecx
push eax
push edi
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x45d10e
push dword [ebp - 0x418]
mov eax, dword [ebp - 0x408]
push dword [ebp - 0x41c]
add eax, eax
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0045cd60
mov ecx, dword [ebp - 0x40c]
add esp, 0x10
test ecx, ecx
je 0x45d10e
test esi, esi
je 0x45d10e
mov eax, dword [ebp - 0x410]
push esi
push ecx
add eax, eax
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.0045cd60
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret