joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ae20
Capabilities:
Check if file exists
Delete file
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x506054]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [esp + 0x10]
push eax
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [esp + 0x14], 0
jl 0x40af96
jg 0x40ae71
cmp dword [esp + 0x10], 0x500000
jbe 0x40af96
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x40ae95
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
jne 0x40ae95
mov dword [ebx + 4], 0xffffffff
push 5
lea edi, [ebx + 8]
push edi
push str._s__d.bak
lea eax, [esp + 0x22c]
push 0x104
push eax
call fcn.0040bf20
add esp, 0x14
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 4
push esi
push edi
push str._s__d.bak
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.0040bf20
add esp, 0x14
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40af22
lea eax, [esi + 1]
push eax
push edi
push str._s__d.bak
lea eax, [esp + 0x22c]
push 0x104
push eax
call fcn.0040bf20
add esp, 0x14
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
dec esi
test esi, esi
jg 0x40aec8
push edi
push str._s_1.bak
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.0040bf20
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp dword [ebx + 4], 0xffffffff
jne 0x40af72
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x40af96
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40af87
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 2
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004364d3
mov esp, ebp
pop ebp
ret

Function at 0x40ba80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40badb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40badb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40bac8
cmp esi, edx
jae 0x40badb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40bab6
cmp esi, edx
jae 0x40badb
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x412b70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6b5e
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x30
mov byte [ebp - 0xbc], 0
mov esi, esp
mov dword [ebp - 0xb4], esi
call fcn.00418490
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x412bbf
lock inc dword [ecx + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 4], 0
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0xc0], ecx
call dword [sym.imp.MSVCP140.dll_private:_void___thiscall_Concurrency::task_continuation_context::constructor_void_]
push dword [ebp - 0xbc]
mov dword [esi + 0x20], 0
lea ecx, [ebp - 0xc8]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x18], 0
mov word [esi + 0x2c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004137b0
mov esi, dword [ebp - 0xc4]
add esp, 0x34
test esi, esi
je 0x412c60
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x412c60
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x412c60
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [0x50f35c]
test ecx, ecx
je 0x412cef
call fcn.0045fd40
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x50e588]
cmp eax, dword [ecx + 4]
jle 0x412cd1
push 0x50e588
call fcn.00436657
add esp, 4
cmp dword [0x50e588], 0xffffffff
jne 0x412cd1
push 0x210
push 0
push 0x50e378
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.0040a390
push 0x4be580
call fcn.00436969
add esp, 4
push 0x50e588
call fcn.0043660d
add esp, 4
push str._ChromaSDKWebSocketServer__Websocket_server_started
push 0x282
push 0x4ee7d8
push 3
push 0x50e378
call fcn.0040a5d0
add esp, 0x14
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x412d56
push str.Service_has_started
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0xb4], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
Function at 0x412d80
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6bae
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x30
mov byte [ebp - 0xbc], 0
mov esi, esp
mov dword [ebp - 0xb4], esi
call fcn.00418490
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x412dcf
lock inc dword [ecx + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 4], 0
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0xc0], ecx
call dword [sym.imp.MSVCP140.dll_private:_void___thiscall_Concurrency::task_continuation_context::constructor_void_]
push dword [ebp - 0xbc]
mov dword [esi + 0x20], 0
lea ecx, [ebp - 0xc8]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x18], 0
mov word [esi + 0x2c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00413870
mov esi, dword [ebp - 0xc4]
add esp, 0x34
test esi, esi
je 0x412e70
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x412e70
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x412e70
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [0x50f35c]
test ecx, ecx
je 0x412f01
push 1
call fcn.0045f670
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x50e588]
cmp eax, dword [ecx + 4]
jle 0x412ee3
push 0x50e588
call fcn.00436657
add esp, 4
cmp dword [0x50e588], 0xffffffff
jne 0x412ee3
push 0x210
push 0
push 0x50e378
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.0040a390
push 0x4be580
call fcn.00436969
add esp, 4
push 0x50e588
call fcn.0043660d
add esp, 4
push str._ChromaSDKWebSocketServer__Websocket_server_stopped
push 0x28f
push 0x4ee7d8
push 3
push 0x50e378
call fcn.0040a5d0
add esp, 0x14
push dword [0x50e624]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x412f74
push str.Service_was_stopped
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0xb4], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
Function at 0x412f90
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6b5e
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x30
mov byte [ebp - 0xbc], 0
mov esi, esp
mov dword [ebp - 0xb4], esi
call fcn.00418490
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x412fdf
lock inc dword [ecx + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 4], 0
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0xc0], ecx
call dword [sym.imp.MSVCP140.dll_private:_void___thiscall_Concurrency::task_continuation_context::constructor_void_]
push dword [ebp - 0xbc]
mov dword [esi + 0x20], 0
lea ecx, [ebp - 0xc8]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x18], 0
mov word [esi + 0x2c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00413930
mov esi, dword [ebp - 0xc4]
add esp, 0x34
test esi, esi
je 0x413080
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x413080
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x413080
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [0x507dc4]
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0x50e62c
push dword [0x50e628]
mov dword [0x50e640], eax
inc eax
mov dword [0x50e630], 6
mov dword [0x50e638], 0
mov dword [0x50e644], 0
mov dword [0x50e634], 1
mov dword [0x507dc4], eax
call esi
mov ecx, dword [0x50f35c]
test ecx, ecx
je 0x4130fb
push 1
call fcn.0045f670
push str._ChromaSDKWebSocketServer__Websocket_server_paused
push 0x29c
push 0x4ee7d8
push 3
call fcn.00405c50
push eax
call fcn.0040a5d0
add esp, 0x14
push 0x50e62c
push dword [0x50e628]
mov dword [0x50e630], 7
mov dword [0x50e638], 0
mov dword [0x50e644], 0
mov dword [0x50e634], 0x83
mov dword [0x50e640], 0
call esi
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4131a1
push str.Service_was_paused
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0xb4], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
Function at 0x4131c0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6b5e
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x30
mov byte [ebp - 0xbc], 0
mov esi, esp
mov dword [ebp - 0xb4], esi
call fcn.00418490
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41320f
lock inc dword [ecx + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 4], 0
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0xc0], ecx
call dword [sym.imp.MSVCP140.dll_private:_void___thiscall_Concurrency::task_continuation_context::constructor_void_]
push dword [ebp - 0xbc]
mov dword [esi + 0x20], 0
lea ecx, [ebp - 0xc8]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x18], 0
mov word [esi + 0x2c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004139f0
mov esi, dword [ebp - 0xc4]
add esp, 0x34
test esi, esi
je 0x4132b0
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4132b0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4132b0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [0x507dc4]
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0x50e62c
push dword [0x50e628]
mov dword [0x50e640], eax
inc eax
mov dword [0x50e630], 5
mov dword [0x50e638], 0
mov dword [0x50e644], 0
mov dword [0x50e634], 1
mov dword [0x507dc4], eax
call esi
mov ecx, dword [0x50f35c]
test ecx, ecx
je 0x41332b
push 1
call fcn.0045f670
push str._ChromaSDKWebSocketServer__Websocket_server_continued
push 0x2a9
push 0x4ee7d8
push 3
call fcn.00405c50
push eax
call fcn.0040a5d0
add esp, 0x14
push 0x50e62c
push dword [0x50e628]
mov dword [0x50e630], 4
mov dword [0x50e638], 0
mov dword [0x50e644], 0
mov dword [0x50e634], 0x83
mov dword [0x50e640], 0
call esi
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4133d1
push str.Service_has_resumed
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0xb4], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
Function at 0x415b90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6e40
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x415cbb
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x415cd5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push str.SoftwareRazer_Chroma_SDK
lea eax, [ebp - 0x21c]
push str._sServices_s
push eax
call fcn.0040b570
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
add esp, 0x10
mov dword [ebp - 0x220], 0
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x415c9c
push 1
push 0x50e618
push 3
push eax
push str.Status
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x415cbb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040bb00
int3
Function at 0x415d00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6e40
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [0x50e618], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x415e35
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x415e4f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push str.SoftwareRazer_Chroma_SDK
lea eax, [ebp - 0x21c]
push str._sServices_s
push eax
call fcn.0040b570
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
add esp, 0x10
mov dword [ebp - 0x220], 0
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x415e16
push 1
push 0x50e618
push 3
push eax
push str.Status
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x415e35
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040bb00
int3
Function at 0x415e80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6e40
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [0x50e618], 1
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x415fb5
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x415fcf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push str.SoftwareRazer_Chroma_SDK
lea eax, [ebp - 0x21c]
push str._sServices_s
push eax
call fcn.0040b570
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
add esp, 0x10
mov dword [ebp - 0x220], 0
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x415f96
push 1
push 0x50e618
push 3
push eax
push str.Status
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x415fb5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040bb00
int3
Function at 0x416000
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6e40
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [0x50e618], 2
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x416135
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x41614f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push str.SoftwareRazer_Chroma_SDK
lea eax, [ebp - 0x21c]
push str._sServices_s
push eax
call fcn.0040b570
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
add esp, 0x10
mov dword [ebp - 0x220], 0
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x416116
push 1
push 0x50e618
push 3
push eax
push str.Status
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x416135
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040bb00
int3
Function at 0x416180
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6e40
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [0x50e618], 3
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4162b5
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x4162cf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push str.SoftwareRazer_Chroma_SDK
lea eax, [ebp - 0x21c]
push str._sServices_s
push eax
call fcn.0040b570
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
add esp, 0x10
mov dword [ebp - 0x220], 0
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x416296
push 1
push 0x50e618
push 3
push eax
push str.Status
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4162b5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040bb00
int3