joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427a40
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d2238
push eax
mov dword fs:[0], esp
sub esp, 0x10
lea eax, [esp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
push eax
push 0x2001f
push 0
push str.software
mov edi, ecx
push 0x80000001
call esi
test eax, eax
jne 0x427b34
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push eax
push str.SmartCarve43
push edx
call esi
test eax, eax
jne 0x427b34
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push str.EnableUser
push ecx
call esi
test eax, eax
jne 0x427b34
mov edx, dword [0x87a768]
mov dword [esp + 8], edx
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x164c]
push eax
lea ecx, [esp + 0xc]
push 0x619450
push ecx
call fcn.005ad17a
mov edx, dword [esp + 0x14]
add esp, 0xc
lea ecx, [esp + 8]
mov eax, dword [edx - 8]
push eax
push eax
call fcn.005b4ba6
push eax
mov eax, dword [esp + 0x14]
push 4
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.005b4761
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x42b810
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x18
push ebx
push esi
lea eax, [esp + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild qword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0xc]
push ecx
fstp qword [esp + 0x20]
call esi
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
sub eax, edi
sbb ecx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
fild qword [esp + 0x14]
fdiv qword [esp + 0x1c]
fcomp qword [esp + 0x28]
fnstsw ax
test ah, 1
jne 0x42b83e
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x44cae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d4150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
mov esi, ecx
mov ecx, dword [0x880a9c]
mov dword [esp + 0x1c], eax
push edi
lea edx, [esp + 0x20]
push edi
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x2c], ecx
push 1
push 2
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], edi
call fcn.005b8029
mov dword [esp + 0x30], edi
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.005b7738
mov ecx, dword [esp + 0x50]
mov ebx, eax
push ecx
mov ecx, esi
call fcn.00464840
fdivr qword [0x880b18]
fmul qword [esi + 0x78]
call fcn.00530020
mov edx, dword [esi + 0x80]
mov ecx, edi
add eax, edx
lea edx, [esp + 0x18]
push eax
push edx
call fcn.005b7b1a
mov eax, dword [esp + 0x58]
mov ecx, esi
push eax
call fcn.00464840
fdivr qword [0x880b18]
fmul qword [esi + 0x78]
call fcn.00530020
mov edx, dword [esi + 0x80]
mov ecx, edi
add eax, edx
push eax
call fcn.005b7b66
mov ecx, esi
call fcn.00464840
fdivr qword [0x880b20]
fmul qword [esi + 0x78]
call fcn.00530020
mov edx, dword [esi + 0x84]
mov ecx, dword [esp + 0x4c]
add eax, edx
lea edx, [esp + 0x14]
push eax
push ecx
push edx
mov ecx, edi
call fcn.005b7b1a
mov ecx, esi
call fcn.00464840
fdivr qword [0x880b20]
fmul qword [esi + 0x78]
call fcn.00530020
add eax, dword [esi + 0x84]
push eax
mov eax, dword [esp + 0x58]
push eax
mov ecx, edi
call fcn.005b7b66
push ebx
mov ecx, edi
call fcn.005b7738
mov dword [esp + 0xc], vtable.CGdiObject.0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 1
call fcn.005b7fc3
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0x24
Function at 0x4548e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.005cb95c
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4548fa
lea ecx, [eax + 0x368]
jmp fcn.004a4240
ret
Function at 0x45c2e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
cmp eax, ecx
mov ebx, eax
jl 0x45c306
mov ebx, ecx
cmp eax, ecx
mov edi, eax
jg 0x45c30e
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
cmp eax, edx
mov ecx, eax
jl 0x45c31c
mov ecx, edx
cmp eax, edx
jg 0x45c322
mov eax, edx
sub esp, 0x10
mov edx, esp
mov dword [edx], ebx
mov dword [edx + 4], ecx
mov ecx, esi
mov dword [edx + 8], edi
mov dword [edx + 0xc], eax
lea eax, [esp + 0x30]
push eax
call fcn.0044cfa0
push 0x11
xor edi, edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x45c354
mov ebx, 2
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x45c364
or ebx, 1
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x20]
movsx ecx, bx
push ecx
lea ecx, [eax + 0x58]
push edx
push ecx
lea ecx, [eax + 0x614]
call fcn.00479b50
mov ecx, esi
call fcn.0045f910
cmp eax, 1
jb 0x45c470
lea edx, [esp + 0x58]
mov ecx, esi
push edx
mov dword [esi + 0x2f4], edi
call fcn.00453f50
mov ecx, dword [eax]
mov dword [esi + 0x100], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x104], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x108], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x10c], edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x110], ecx
mov edx, dword [eax + 0x14]
mov dword [esi + 0x114], edx
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x118], ecx
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x11c], edx
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x120], ecx
mov edx, dword [eax + 0x24]
mov dword [esi + 0x124], edx
mov ecx, dword [eax + 0x28]
mov dword [esi + 0x128], ecx
mov edx, dword [eax + 0x2c]
mov dword [esi + 0x12c], edx
mov ecx, dword [eax + 0x30]
mov dword [esi + 0x130], ecx
mov edx, dword [eax + 0x34]
mov dword [esi + 0x134], edx
fld qword [esi + 0x11c]
fadd qword [esi + 0x100]
fmul qword [0x5e7c18]
fstp qword [esi + 0x138]
fld qword [esi + 0x124]
fadd qword [esi + 0x108]
fmul qword [0x5e7c18]
fstp qword [esi + 0x140]
fld qword [esi + 0x12c]
fadd qword [esi + 0x110]
fmul qword [0x5e7c18]
fstp qword [esi + 0x148]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x2710
mov dword [esi + 0x100], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x118], eax
mov dword [esi + 0x11c], edi
mov dword [esi + 0x124], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x120], edi
mov dword [esi + 0x128], edi
mov dword [esi + 0x130], edi
mov dword [esi + 0x134], eax
mov dword [esi + 0x2f4], edi
mov dword [esi + 0x2f8], edi
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, esi
call fcn.00454200
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.0045cd10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46c560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5376
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
push esi
push edi
xor ebx, ebx
lea edi, [ebp + 0x1c]
push 0x20
mov ecx, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi], ebx
call fcn.0041b410
lea ecx, [edi + 0xc]
push 0x20
mov dword [esp + 0x30], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx], ebx
call fcn.0041b410
mov eax, 1
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
lea esi, [edi + 0x2c]
push 0x20
mov ecx, esi
mov dword [esp + 0x30], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi], ebx
call fcn.0041b410
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x28], ebx
mov eax, dword [esi]
mov edi, str.UTF_8
mov ecx, edi
mov dword [esi + 8], ebx
test ecx, ecx
mov byte [esp + 0x2c], 2
mov byte [eax], bl
mov dword [esp + 0x18], edi
je 0x46c703
mov cl, byte [str.UTF_8]
mov eax, 0x637bd9
cmp cl, bl
je 0x46c616
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c60f
mov ecx, dword [esi + 8]
sub eax, str.UTF_8
dec eax
mov edx, eax
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], edx
lea edx, [ecx + edx + 2]
cmp eax, edx
ja 0x46c6de
shr eax, 5
inc eax
mov ebp, eax
shl ebp, 5
add ebp, ecx
mov ecx, dword [esp + 0x1c]
add ebp, ecx
cmp ebp, 0x20
ja 0x46c64f
mov ebp, 0x20
mov edi, dword [esi]
cmp edi, ebx
jne 0x46c680
push ebp
call fcn.005b449a
mov ecx, ebp
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
mov dword [esi + 4], ebp
mov dword [esi + 8], ebx
mov byte [eax], bl
jmp 0x46c6d6
push ebp
mov dword [esp + 0x14], edi
call fcn.005b449a
mov edx, edi
add esp, 4
mov dword [esi], eax
lea ecx, [ebp - 1]
cmp byte [edx], bl
je 0x46c6ac
mov edx, ecx
dec ecx
test edx, edx
jbe 0x46c6ac
mov dl, byte [edi]
mov byte [eax], dl
mov dl, byte [edi + 1]
inc eax
inc edi
cmp dl, bl
jne 0x46c698
mov byte [eax], bl
mov edi, dword [esi]
mov eax, edi
mov dword [esi + 4], ebp
mov cl, byte [eax]
inc eax
test cl, cl
je 0x46c6c3
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c6bc
sub eax, edi
dec eax
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
push eax
call fcn.005b44c3
add esp, 4
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add eax, ecx
mov cl, byte [str.UTF_8]
cmp cl, bl
je 0x46c6fa
mov byte [eax], cl
mov cl, byte [edi + 1]
inc eax
inc edi
cmp cl, bl
jne 0x46c6ef
mov ecx, dword [esp + 0x1c]
mov byte [eax], bl
add dword [esi + 8], ecx
lea ecx, [ebp + 0x54]
mov dword [esp + 0x2c], 3
call fcn.0047ef40
mov ecx, dword [esp + 0x24]
pop edi
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x13ec], ebx
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x13f4], ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x470030
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x47008c
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x470086
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x470063
pop edi
pop esi
ret
cmp byte [eax], 0x54
jne 0x47007f
cmp byte [eax + 1], 0x41
jne 0x47007f
cmp byte [eax + 2], 0x4c
jne 0x47007f
cmp byte [eax + 3], 0x46
jne 0x47007f
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
ret
Function at 0x4842c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, 0x10
call fcn.0054a8e0
test eax, eax
je 0x484334
mov ecx, eax
call fcn.00548df0
mov ebp, eax
mov eax, dword [ebp]
mov esi, dword [ebp + 4]
mov dword [esp + 0x14], eax
xor eax, eax
test esi, esi
je 0x484334
jmp 0x4842f8
mov eax, dword [esp + 0x10]
mov edi, dword [esi + 8]
test esi, esi
jne 0x484304
mov esi, dword [ebp + 4]
jmp 0x484307
mov esi, dword [esi + 4]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
ja 0x484334
test edi, edi
je 0x484330
mov ecx, edi
call fcn.0054a0f0
test eax, eax
je 0x484330
mov edx, dword [edi]
push 0
push 0
mov ecx, edi
call dword [edx + 0x18]
add ebx, eax
test esi, esi
jne 0x4842f4
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x48443a
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebx + 1]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
jne 0x484378
pop edi
pop esi
pop ebp
mov eax, 0xc0000000
pop ebx
add esp, 0xc
ret 4
mov ecx, ebx
mov edx, ebx
shr ecx, 0x18
mov eax, ebx
mov byte [esi + 4], cl
mov ecx, dword [esp + 0x20]
mov byte [esi], 0x54
shr edx, 0x10
shr eax, 8
mov byte [esi + 1], 0x41
mov byte [esi + 2], 0x4c
mov byte [esi + 3], 0x46
mov byte [esi + 5], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
mov ebp, 0x10
call fcn.0054a8e0
test eax, eax
je 0x484424
mov ecx, eax
call fcn.00548df0
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov dword [esp + 0x10], ecx
xor ecx, ecx
test ebx, ebx
mov dword [esp + 0x20], eax
je 0x484424
jmp 0x4843d8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov edi, dword [ebx + 8]
test ebx, ebx
jne 0x4843e4
mov ebx, dword [eax + 4]
jmp 0x4843e7
mov ebx, dword [ebx + 4]
mov eax, dword [esp + 0x10]
inc ecx
cmp ecx, eax
mov dword [esp + 0x14], ecx
ja 0x484420
test edi, edi
je 0x48441c
mov ecx, edi
call fcn.0054a0f0
test eax, eax
je 0x48441c
mov edx, dword [edi]
push 0
push 0
mov ecx, edi
call dword [edx + 0x18]
mov edx, dword [edi]
lea ecx, [esi + ebp]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x18]
add ebp, eax
test ebx, ebx
jne 0x4843d0
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
Function at 0x48a8f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d715b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x14
call fcn.005b449a
mov ebx, eax
mov eax, dword [esp + 0x3c]
mov ebp, 1
push 4
mov dword [ebx], ebp
mov dword [ebx + 4], eax
mov dword [ebx + 0x10], ebp
mov dword [ebx + 8], ebp
call fcn.005b449a
push 0x14
mov dword [ebx + 0xc], eax
call fcn.005b449a
mov edi, eax
add esp, 0xc
mov dword [edi + 0x10], ebp
mov ebp, dword [esp + 0x30]
mov ecx, ebp
mov dword [edi], 2
mov dword [edi + 4], 0
call fcn.00426a20
mov ecx, ebp
mov dword [esp + 0x30], eax
call fcn.0054a8e0
push ebp
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.0047f520
mov ecx, dword [ebx + 0xc]
mov esi, eax
push 0x15a4
mov dword [esp + 0x1c], esi
mov dword [ecx], esi
call fcn.005b449a
add esp, 4
mov dword [esp + 0x38], eax
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x24], ecx
je 0x48a9a6
mov ecx, eax
call fcn.00544b10
mov dword [esp + 0x38], eax
jmp 0x48a9aa
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov edx, dword [esi]
push 0x20
push 0
push eax
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call dword [edx + 0x1c]
mov esi, dword [esp + 0x38]
push 0
push 0
mov ecx, esi
call fcn.00547d80
lea ecx, [eax*4]
mov dword [edi + 8], eax
push ecx
call fcn.005b449a
add esp, 4
mov ecx, esi
mov dword [edi + 0xc], eax
push 0
call fcn.00547260
mov esi, eax
test esi, esi
je 0x48aa43
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esi]
inc eax
push eax
mov dword [esp + 0x34], eax
call fcn.00549f60
mov edx, dword [esi]
mov eax, dword [esp + 0x14]
push edx
push eax
mov ecx, ebp
call fcn.0054aec0
mov ecx, dword [edi + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
push 0
mov dword [ecx + eax], edx
mov ecx, dword [esp + 0x3c]
add eax, 4
push esi
mov dword [esp + 0x18], eax
call fcn.00547400
mov esi, eax
test esi, esi
jne 0x48a9fe
mov eax, dword [esp + 0x30]
mov ecx, ebp
push eax
call fcn.0054a880
mov esi, dword [esp + 0x38]
push 0
mov ecx, esi
call fcn.00548150
test esi, esi
je 0x48aa68
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
mov ecx, dword [esp + 0x18]
push 0
call fcn.0054a100
mov eax, dword [esp + 0x34]
test eax, eax
je 0x48aa9c
mov eax, dword [esp + 0x2c]
push ebx
lea esi, [eax + 0x58]
lea ebp, [eax + 0x1a0c]
push esi
mov ecx, ebp
call fcn.00526d60
push edi
push esi
mov ecx, ebp
call fcn.00526d60
jmp 0x48aaab
push ebx
call fcn.005b44c3
push edi
call fcn.005b44c3
add esp, 8
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
Function at 0x4c62b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d9e34
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x819]
mov dword [esp + 0x14], 0
call fcn.005af4a5
mov eax, dword [0x87a768]
lea edi, [esi + 0x82d]
mov dword [edi], eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x28]
mov dword [esi + 0xd], eax
mov dword [esi + 0x811], ecx
mov ecx, dword [esp + 0x20]
lea eax, [esi + 0x11]
push edx
push eax
mov byte [esp + 0x1c], 2
mov dword [esi], method.CCommandLineInfo.virtual_0
mov dword [esi + 9], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 0x30]
push 0x880da0
mov dword [esi + 0x815], ecx
mov ecx, edi
mov dword [esi + 0x831], 0
mov byte [esi + 8], 0
call fcn.005b491f
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x4cea30
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5da92b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
push esi
lea eax, [esp + 0xc]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push str.HARDWAREDEVICEMAPSERIALCOMM
mov dword [esp + 0x34], ecx
push 0x80000002
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4cebce
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0x28], 1
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x2c]
push edx
push ecx
lea edx, [esp + 0x20]
push edi
lea ecx, [esp + 0x68]
mov eax, ebp
push edx
mov edx, dword [esp + 0x2c]
push ecx
push eax
push edx
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x44], 0x14
inc ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
jne 0x4cebc1
cmp dword [esp + 0x24], edi
jbe 0x4cea84
cmp dword [esp + 0x14], edi
jbe 0x4cea84
lea eax, [esp + 0x58]
push eax
call fcn.005302ce
push str.DeviceVCP
mov ebx, eax
call fcn.005302ce
add esp, 8
cmp eax, ebx
jge 0x4ceb03
mov ecx, ebx
lea edi, [esp + eax*2 + 0x58]
sub ecx, eax
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor edi, edi
lea ecx, [esp + 0x58]
push str.DeviceVCP
push ecx
call fcn.00530381
add esp, 8
test eax, eax
jne 0x4cea84
lea edx, [esp + 0x30]
push edx
call fcn.005302ce
mov ax, word [esp + 0x3a]
mov cx, word [esp + 0x3c]
mov dx, word [esp + 0x3e]
mov dword [esp + 0x20], edi
mov word [esp + 0x20], ax
mov ax, word [esp + 0x40]
mov word [esp + 0x22], cx
mov ecx, dword [0x87a768]
mov word [esp + 0x24], dx
mov word [esp + 0x26], ax
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x20]
mov dword [esp + 0x26c], edi
push edx
call fcn.00530a15
add esp, 8
push eax
push 0x73dc40
lea eax, [esp + 0x18]
push str._s_d
push eax
call fcn.005ad17a
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x3c]
add esp, 0x10
mov eax, esi
inc esi
push ecx
push eax
mov eax, dword [edx + 0xd4]
push 0x14a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x10]
mov dword [esp + 0x268], 0xffffffff
call fcn.005b4761
jmp 0x4cea84
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
mov ecx, dword [esp + 0x258]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x25c
ret
Function at 0x4d30e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5db2eb
push eax
mov dword fs:[0], esp
sub esp, 0x250
push ebp
mov ebp, ecx
push esi
push 0
mov eax, dword [ebp + 0xb4]
push 0
push 0x14b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
push 0x20019
push esi
push str.HARDWAREDEVICEMAPSERIALCOMM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d3299
push ebx
push edi
xor edi, edi
mov dword [esp + 0x28], 1
lea edx, [esp + 0x24]
lea ecx, [esp + 0x30]
push edx
lea edx, [esp + 0x2c]
push ecx
push edx
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x68]
mov eax, edi
push ecx
push edx
push eax
mov eax, dword [esp + 0x34]
inc edi
push eax
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x44], 0x14
mov dword [esp + 0x4c], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4d328c
mov eax, dword [esp + 0x24]
test eax, eax
jbe 0x4d3146
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x4d3146
lea ecx, [esp + 0x58]
push ecx
call fcn.005302ce
push str.DeviceVCP
mov ebx, eax
call fcn.005302ce
add esp, 8
cmp eax, ebx
jge 0x4d31d0
mov ecx, ebx
lea edi, [esp + eax*2 + 0x58]
sub ecx, eax
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x2c]
lea edx, [esp + 0x58]
push str.DeviceVCP
push edx
call fcn.00530381
add esp, 8
test eax, eax
jne 0x4d3146
lea eax, [esp + 0x30]
push eax
call fcn.005302ce
mov cx, word [esp + 0x3a]
mov dx, word [esp + 0x3c]
xor eax, eax
mov dword [esp + 0x20], eax
mov word [esp + 0x20], cx
mov cx, word [esp + 0x3e]
mov word [esp + 0x22], dx
mov dx, word [esp + 0x40]
mov word [esp + 0x24], cx
mov ecx, dword [0x87a768]
mov word [esp + 0x26], dx
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x20]
mov dword [esp + 0x26c], eax
push edx
call fcn.00530a15
add esp, 8
push eax
push 0x73dc40
lea eax, [esp + 0x18]
push str._s_d
push eax
call fcn.005ad17a
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp + 0xb4]
add esp, 0x10
mov eax, esi
inc esi
push ecx
push eax
push 0x14a
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x10]
mov dword [esp + 0x268], 0xffffffff
call fcn.005b4761
jmp 0x4d3146
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
push 0
mov ecx, ebp
call fcn.005b3071
mov ecx, dword [esp + 0x258]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x25c
ret