joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d422
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.0040c5e2
mov esi, dword [0x467040]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d8]
push eax
push 0
push 0
push str.SyncBusinessCards
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d4]
push eax
push 0
push 0
push str.SyncCalendarItems
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d0]
push eax
push 0
push 0
push str.SyncEmailMessages
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12cc]
push eax
push 0
push 0
push str.SyncNotes
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x12dc
push edi
push 0
push 0
push str.PreferredProfile
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40d54e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040c5e2
lea eax, [ebp - 4]
push eax
add esi, 0x12cc
push esi
push 0
push 0
push str.ObexThrottleBytes
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [0x467040]
pop esi
leave
ret 4

Function at 0x40d629
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x51a]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x46bdb4
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x418]
push eax
push ebx
push ebx
push str.BDAddress
push dword [ebp + 8]
mov dword [ebp - 4], 6
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x41e]
push eax
push ebx
push ebx
push str.BDDevClass
push dword [ebp + 8]
mov dword [ebp - 4], 3
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x421]
push eax
push ebx
push ebx
push str.BDName
push dword [ebp + 8]
mov dword [ebp - 4], 0xf8
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x734]
push eax
push ebx
push ebx
push str.UUID
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x73c]
push eax
push ebx
push ebx
push str.SecurityID
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x740]
push eax
push ebx
push ebx
push str.SecurityLevel
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x738]
mov dword [ebp - 4], 4
push eax
push ebx
push ebx
push 0x46bd3c
push dword [ebp + 8]
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x724]
push eax
push ebx
push ebx
push str.ClassID
push dword [ebp + 8]
mov dword [ebp - 4], 0x10
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x744
push edi
push ebx
push ebx
push str.UseMsDevice
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40d76f
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x51a]
push edi
call fcn.0043ada3
mov ebx, dword [esp + 0x18]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
mov edi, dword [0x46703c]
push 1
xor ebp, ebp
push ebp
push 0x46bdb4
push ebx
call edi
push 6
lea eax, [esi + 0x418]
push eax
push 3
push ebp
push str.BDAddress
push ebx
call edi
push 3
lea eax, [esi + 0x41e]
push eax
push 3
push ebp
push str.BDDevClass
push ebx
call edi
lea ebp, [esi + 0x421]
push ebp
call fcn.00439690
pop ecx
inc eax
push eax
push ebp
push 1
push 0
push str.BDName
push ebx
call edi
push 4
pop ebp
push ebp
lea eax, [esi + 0x734]
push eax
push ebp
push 0
push str.UUID
push ebx
call edi
push ebp
lea eax, [esi + 0x73c]
push eax
push ebp
push 0
push str.SecurityID
push ebx
call edi
push ebp
lea eax, [esi + 0x740]
push eax
push ebp
push 0
push str.SecurityLevel
push ebx
call edi
push ebp
lea eax, [esi + 0x738]
push eax
push ebp
push 0
push 0x46bd3c
push ebx
call edi
push 0x10
lea eax, [esi + 0x724]
push eax
push 3
push 0
push str.ClassID
push ebx
call edi
push ebp
add esi, 0x744
push esi
push ebp
push 0
push str.UseMsDevice
push ebx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x40fc99
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push str.Calling_CBTRecoveryScreenCfg_GetAll
mov edi, ecx
call fcn.0040b42c
mov esi, dword [0x467040]
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.Computer
push dword [ebp + 8]
mov ebx, 0x208
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x620]
push eax
push 0
push 0
push str.StandardKeyboard
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x828]
push eax
push 0
push 0
push str.StandardMouse
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xa30]
push eax
push 0
push 0
push str.StandardKeyboardAndMouse
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xc38]
push eax
push 0
push 0
push str.StandardMouseFailedParing
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xe40]
push eax
push 0
push 0
push str.StandardKeyboardFailedParing
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1048]
push eax
push 0
push 0
push str.ZeroTouchKeyboard
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1250]
push eax
push 0
push 0
push str.ZeroTouchMouse
push dword [ebp + 8]
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1458]
push eax
push 0
push 0
push str.ZeroTouchKeyboardAndMouse
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1660]
push eax
push 0
push 0
push str.ZeroTouchMouseFailedPairing
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1868]
push eax
push 0
push 0
push str.ZeroTouchKeyboardFailedPairing
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x1a70
push edi
push 0
push 0
push str.AnimateForSearching
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41006b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.SDLG_LEFT
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x41c]
push eax
push 0
push 0
push str.SDLG_TOP
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x420]
push eax
push 0
push 0
push str.SDLG_SETTING
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x424]
push eax
push 0
push 0
push str.VDLG_LEFT
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x42c]
push eax
push 0
push 0
push str.VDLG_TOP
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x428]
push eax
push 0
push 0
push str.VDLG_RIGHT
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x430]
push eax
push 0
push 0
push str.VDLG_BTTOM
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
add edi, 0x434
push edi
push 0
push 0
push str.VDLG_SETTING
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41035b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.UseInquiryFilters
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x424]
push eax
push 0
push 0
push str.PeriodicInquiry
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x41c]
push eax
push 0
push 0
push str.InquiryMode
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x420]
push eax
push 0
push 0
push str.InquiryDuration
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x434]
push eax
push 0
push 0
push str.InquiryMaxResults
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x42c]
push eax
push 0
push 0
push str.AutoDiscovery
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x428]
push eax
push 0
push 0
push str.PeriodicInquiryRetryTime
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
lea eax, [edi + 0x430]
push eax
push 0
push 0
push str.InquirySupportedWithConnsUp
push dword [ebp + 8]
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x438
push edi
push 0
push 0
push 0x46d2dc
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x410632
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x418]
push eax
xor ebx, ebx
push ebx
push ebx
push str.Type
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x51c]
push eax
push ebx
push ebx
push str.MajorClass
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x520]
push eax
push ebx
push ebx
push str.MinorClass
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x41c]
push eax
push ebx
push ebx
push str.BdAddr
push dword [ebp + 8]
mov dword [ebp - 4], 6
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x422
push edi
push ebx
push ebx
push str.BdName
push dword [ebp + 8]
mov dword [ebp - 4], 0xf8
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x410892
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x41c]
push eax
push 0
push 0
push str.AllowOthersToDiscover
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.WhoAllowedToConnect
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x420]
push eax
push 0
push 0
push str.InquiryScanMode
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x424]
push eax
push 0
push 0
push str.InquiryScanType
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x428]
push eax
push 0
push 0
push str.InquiryScanInterval
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x42c]
push eax
push 0
push 0
push str.InquiryScanWindow
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x430]
push eax
push 0
push 0
push str.PageScanType
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
lea eax, [edi + 0x434]
push eax
push 0
push 0
push str.PageScanInterval
push dword [ebp + 8]
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x438
push edi
push 0
push 0
push str.PageScanWindow
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x410aca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x518]
push eax
xor ebx, ebx
push ebx
push ebx
push str.MajorClass
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x51c]
push eax
push ebx
push ebx
push str.MinorClass
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x418]
push eax
push ebx
push ebx
push str.BdAddr
push dword [ebp + 8]
mov dword [ebp - 4], 6
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x41e
push edi
push ebx
push ebx
push str.BdName
push dword [ebp + 8]
mov dword [ebp - 4], 0xf8
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x411069
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x418]
push edi
call fcn.0043ada3
mov ebx, dword [esp + 0x18]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
mov edi, dword [0x46703c]
push 1
push 0
push 0x46d9d8
push ebx
call edi
lea ebp, [esi + 0x620]
push ebp
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebp
push 1
push 0
push str.BTWVERS
push ebx
call edi
push 4
pop ebp
push ebp
lea eax, [esi + 0x828]
push eax
push ebp
push 0
push str.StartPort
push ebx
call edi
lea eax, [esi + 0x82c]
push eax
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [esi + 0x82c]
push eax
push 1
push 0
push str.BT_EXCHG_FLDR
push ebx
call edi
lea eax, [esi + 0xa34]
push eax
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [esi + 0xa34]
push eax
push 1
push 0
push str.BT_NET_CONN_NAME
push ebx
call edi
lea eax, [esi + 0xc3c]
push eax
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [esi + 0xc3c]
push eax
push 1
push 0
push str.CustomLogoBitmap
push ebx
call edi
push ebp
lea eax, [esi + 0x104c]
push eax
push ebp
push 0
push str.ShowUnplugDeviceDlg
push ebx
call edi
lea eax, [esi + 0xe44]
push eax
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [esi + 0xe44]
push eax
push 1
push 0
push str.DisplayName
push ebx
call edi
push ebp
lea eax, [esi + 0x1050]
push eax
push ebp
push 0
push str.ServicePack
push ebx
call edi
push 8
lea eax, [esi + 0x1054]
push eax
push 3
push 0
push str.LastNonUpgradeInstallTime
push ebx
call edi
push ebp
lea eax, [esi + 0x105c]
push eax
push ebp
push 0
push str.LangID
push ebx
call edi
lea eax, [esi + 0x1060]
push eax
call fcn.0043ada3
pop ecx
inc eax
inc eax
push eax
lea eax, [esi + 0x1060]
push eax
push 3
push 0
push str.ERIM
push ebx
call edi
lea eax, [esi + 0x1268]
push eax
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [esi + 0x1268]
push eax
push 1
push 0
push str.DeviceID
push ebx
call edi
push ebp
lea eax, [esi + 0x1470]
push eax
push ebp
push 0
push str.SmartDongle
push ebx
call edi
push ebp
lea eax, [esi + 0x1474]
push eax
push ebp
push 0
push str.BVRP_MPT
push ebx
call edi
lea eax, [esi + 0x1478]
push eax
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [esi + 0x1478]
push eax
push 1
push 0
push str.VERSION
push ebx
call edi
push ebp
lea eax, [esi + 0x1680]
push eax
push ebp
push 0
push str.DriverInstallMask
push ebx
call edi
push ebp
lea eax, [esi + 0x1684]
push eax
push ebp
push 0
push str.ProfilePack
push ebx
call edi
push ebp
lea eax, [esi + 0x1688]
push eax
push ebp
push 0
push str.InstallState
push ebx
call edi
push ebp
lea eax, [esi + 0x168c]
push eax
push ebp
push 0
push str.Code
push ebx
call edi
push ebp
lea eax, [esi + 0x1690]
push eax
push ebp
push 0
push str.EasyPairIcon
push ebx
call edi
push ebp
lea eax, [esi + 0x1694]
push eax
push ebp
push 0
push str.DisablePreFirstRun
push ebx
call edi
push ebp
add esi, 0x1698
push esi
push ebp
push 0
push str.EnableWin7Help
push ebx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x411366
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.InstallSendToExplorer
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x41c]
push eax
push 0
push 0
push str.InstallSendToIE
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x420]
push eax
push 0
push 0
push str.InstallSendToNotes
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x424]
push eax
push 0
push 0
push str.InstallSendToOffice
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x428
push edi
push 0
push 0
push str.InstallSendToWAB
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4114ba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x467040]
push edi
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.Flags
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x41c
push edi
push 0
push 0
push 0x46db68
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
pop edi
pop esi
leave
ret 4

Function at 0x411592
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x41c]
push eax
lea eax, [esi + 0x20c]
push 0x46bdd4
push eax
call fcn.0043ae27
mov edi, dword [0x467040]
add esp, 0xc
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x418]
push eax
push 0
push 0
push str.RefCount
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x420
push esi
push 0
push 0
push str.HwPort
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x412b48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, ecx
lea eax, [esi + 0x41e]
push eax
xor edi, edi
push edi
push edi
push str.OAPPAuthenticationUserId
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call fcn.0040bd06
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x626]
push eax
push edi
push edi
push str.OAPPAuthenticationPassword
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call fcn.0040bd06
add esp, 0x30
lea eax, [ebp - 4]
push eax
add esi, 0x838
push esi
push edi
push edi
push str.AutoAuthorize
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [0x467040]
pop edi
pop esi
leave
ret 4
Function at 0x412deb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.SPPPromptForClose
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x41c]
push eax
push 0
push 0
push str.DUNPromptForClose
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x420]
push eax
push 0
push 0
push str.LAPPromptForClose
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x424]
push eax
push 0
push 0
push str.FAXPromptForClose
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x428]
push eax
push 0
push 0
push str.HSPPromptForClose
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x434]
push eax
push 0
push 0
push str.AVPromptForClose
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x42c]
push eax
push 0
push 0
push str.HAGPromptForClose
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
lea eax, [edi + 0x430]
push eax
push 0
push 0
push str.HIDPromptForClose
push dword [ebp + 8]
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x438]
push eax
push 0
push 0
push str.SPPPromptForConnected
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x43c]
push eax
push 0
push 0
push str.DUNPromptForConnected
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x440]
push eax
push 0
push 0
push str.LAPPromptForConnected
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x444]
push eax
push 0
push 0
push str.FAXPromptForConnected
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x448]
push eax
push 0
push 0
push str.HSPPromptForConnected
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x454]
push eax
push 0
push 0
push str.AVPromptForConnected
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x44c]
push eax
push 0
push 0
push str.HAGPromptForConnected
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x450
mov dword [ebp - 4], ebx
push edi
push 0
push 0
push str.HIDPromptForConnected
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 4