joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401eb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x4a0], ecx
mov ecx, 0x13
mov esi, str.SOFTWAREAtherosVistaAddOnSupported
lea edi, [ebp - 0x494]
rep movsd dword es:[edi], dword [esi]
push 0x1bc
xor esi, esi
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x448]
push esi
push ecx
mov dword [ebp - 0x49c], edx
mov dword [ebp - 0x498], eax
call fcn.0041d650
push 0x206
lea eax, [ebp - 0x28a]
xor edx, edx
push esi
push eax
mov dword [ebp - 0x4ac], esi
mov dword [ebp - 0x4b4], 8
mov word [ebp - 0x28c], dx
call fcn.0041d650
add esp, 0x18
push 0x40
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x4a4]
push edx
mov dword [ebp - 0x4bc], 4
mov dword [ebp - 0x4b0], esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x401fb6
lea eax, [ebp - 0x4a8]
push eax
push 1
push esi
lea ecx, [ebp - 0x494]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401fb6
mov eax, dword [ebp - 0x4a8]
push esi
push esi
push esi
push esi
lea edx, [ebp - 0x4ac]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x401fc8
mov ecx, dword [ebp - 0x4a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x4ac], esi
jbe 0x40206f
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ebx, [ebx]
push 0x208
lea edx, [ebp - 0x28c]
push 0
push edx
call fcn.0041d650
add esp, 0xc
lea eax, [ebp - 0x4bc]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
lea edx, [ebp - 0x4c0]
push edx
mov edx, dword [ebp - 0x4a8]
push 0
lea eax, [ebp - 0x4b4]
push eax
lea ecx, [ebp - 0x28c]
push ecx
push esi
push edx
mov dword [ebp - 0x4b4], 0x104
call edi
test eax, eax
jne 0x40205a
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.004157e0
add esp, 8
test eax, eax
jne 0x40205a
mov eax, 1
cmp dword [ebp - 0x4b8], eax
je 0x402069
inc esi
cmp esi, dword [ebp - 0x4ac]
jb 0x401fe0
jmp 0x40206f
mov dword [ebp - 0x4b0], eax
mov edx, dword [ebp - 0x4a8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4b0]
pop edi
xor ecx, ebp
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x403de0
Capabilities:
Create thread
Print debug messages

Disassembly:
add eax, 0xfffffffc
cmp eax, 0xe
ja case.default.0x403dfa
movzx eax, byte [eax + 0x403ed0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp dword [eax*4 + 0x403ec0]
push str.Enter_case_PBT_APMRESUMESUSPEND__n
call esi
cmp dword [0x436c54], 0
jne case.0x403dfa.7
push str.System_resume_from_S3_S4__n
call esi
call fcn.00408760
cmp eax, 0x14
je 0x403e3a
call fcn.00408760
cmp eax, 0x1e
je 0x403e3a
call fcn.00408760
cmp eax, 0x28
jne 0x403e4e
mov dword [0x436864], 0
mov dword [0x436860], 0
call fcn.00401380
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, 1
mov dword [0x436c54], eax
mov dword [0x436c48], eax
call esi
mov dword [0x436c4c], eax
call esi
mov dword [0x436c64], eax
pop esi
xor eax, eax
ret
push 0
push 0
push 0
push 0x4018d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x436c5c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.System_enter_S3_S4__n
mov dword [0x436c58], 1
mov dword [0x436c54], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
xor eax, eax
ret

Function at 0x403ee0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0x206
xor esi, esi
lea ecx, [ebp - 0x20a]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0x218], edi
mov word [ebp - 0x20c], ax
call fcn.0041d650
add esp, 0xc
cmp edi, esi
je 0x40401a
push ebx
push 0x208
lea edx, [ebp - 0x20c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov dword [ebp - 0x210], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
cmp ebx, esi
je 0x404007
push ebx
push 2
mov dword [ebp - 0x21c], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [ebp - 0x210]
mov edi, eax
push edi
push ebx
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0x42a840
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 0x214]
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx edx, dx
push edx
movzx eax, cx
mov ecx, dword [ebp - 0x218]
push eax
push str._d._d._d._d
push 0x104
push ecx
call fcn.00415638
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x405480
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
xor eax, eax
test edi, edi
je 0x4055f8
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.0041d650
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov word [ebp - 0x418], dx
call fcn.0041d650
add esp, 0xc
push 0x102
lea ecx, [ebp - 0x418]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x42b910
lea edx, [ebp - 0x210]
push 0x104
push edx
call fcn.00415b9a
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call fcn.00415b25
add esp, 0xc
push 0x42b910
lea edx, [ebp - 0x210]
push 0x104
push edx
call fcn.00415b25
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x42b914
call fcn.0040ca40
add esp, 8
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
push 2
push 0x10
push 0xf01ff
push str.AtherosSvc
push str.AtherosSvc
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x4055c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Install_service_failed_error_code___d_n
lea ecx, [esi + 1]
call fcn.00415320
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x41c]
push edx
push 1
push esi
mov dword [ebp - 0x41c], str.Atheros_BT_Stack_Service_Agent
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x405610
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xf01ff
push str.AtherosSvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
je 0x4056ad
lea ecx, [ebp - 0x228]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x406b90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 8], eax
cmp byte [ebp + 8], 0
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
push 0x50
lea eax, [ebp - 0x14c]
mov edi, ecx
push eax
je 0x406c0a
push 0xbb8
push 0
call esi
test eax, eax
je 0x406bf5
push 0x50
lea ecx, [ebp - 0xac]
push ecx
push 0xbb9
push 0
call esi
test eax, eax
je 0x406bf5
push 0x50
lea edx, [ebp - 0x1ec]
push edx
push 0xbba
push 0
call esi
test eax, eax
jne 0x406c58
mov eax, 2
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
push 0xbbb
push 0
call esi
test eax, eax
jne 0x406c32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 2
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
push 0x50
lea ecx, [ebp - 0xac]
push ecx
push 0xbbc
push 0
call esi
test eax, eax
je 0x406bf5
push 0x50
lea edx, [ebp - 0x1ec]
push edx
push 0xbbd
jmp 0x406bed
xor eax, eax
cmp byte [ebp + 8], al
lea ecx, [ebp - 0xac]
sete al
mov dword [ebp - 0x1f4], ecx
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x14c]
mov dword [ebp - 0x1f8], edx
mov edx, dword [ebp + 0x10]
inc eax
push edi
push edx
mov dword [ebp - 0x200], eax
lea eax, [ebp - 0x1ec]
push 0
mov edx, 0x406720
mov ecx, 2
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x1f0], eax
call fcn.0040f090
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x406d42
push str.failcode__EXIT_OK_n
call edi
mov eax, dword [ebp - 0x204]
test eax, eax
jne 0x406cfe
push 0xebf3
call fcn.00415d03
add eax, 0x20
push eax
call fcn.0040e6a0
add esp, 8
mov dword [0x436c78], 1
jmp 0x406d42
cmp dword [ebp - 0x1fc], 0
push eax
jne 0x406d27
push 0xecbc
call fcn.00415d03
add eax, 0x20
push eax
call fcn.0040e6a0
mov dword [0x436c78], 0
jmp 0x406d3f
push 0xecbb
call fcn.00415d03
add eax, 0x20
push eax
call fcn.0040e6a0
mov esi, 1
add esp, 0xc
push str.cmdDisableEnable_end_n
call edi
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x406f30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x18]
push esi
mov esi, 2
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], 0
je 0x406f76
mov eax, 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], esi
jl 0x406f62
mov ecx, dword [eax]
cmp word [ecx], 0
je 0x406f62
push edi
mov edi, dword [eax + 4]
cmp word [edi], 0
jne 0x406fa2
pop edi
mov eax, 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 0x104
jae 0x407080
test eax, eax
je 0x407080
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407080
push ebx
push str.newdev.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407069
push str.UpdateDriverForPlugAndPlayDevicesW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x407062
lea edx, [ebp - 0x20c]
push edx
push edi
push 0xeeae
call fcn.00415d03
add eax, 0x20
push eax
call fcn.0040e6a0
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 1
lea ecx, [ebp - 0x20c]
push ecx
push edi
push 0
call esi
test eax, eax
je 0x407062
push 0xeeb2
call fcn.00415d03
add eax, 0x20
push eax
call fcn.0040e6a0
xor edx, edx
add esp, 8
cmp dword [ebp - 0x214], edx
setne dl
mov dword [ebp - 0x210], edx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x210]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret

Function at 0x408410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x408428
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40845a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x408456
cmp esi, eax
jae 0x40845a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x408448
cmp esi, eax
jb 0x408460
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x408470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x4367d4
call fcn.00423d17
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x408524
test esi, esi
jne 0x408524
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x408508
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408502
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408502
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x4084f1
cmp esi, eax
jae 0x4084f5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4084e3
cmp esi, eax
jb 0x4084f9
xor eax, eax
jmp 0x408502
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x40852d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x4367d4
call fcn.00423d17
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x408495
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408610
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREAtherosVistaAddOn
push 0x80000002
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x408655
push str.GetCustomerDefineCod_Failed_open_SOFTWAREAtherosVistaAddOn_registry.__r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x42c0ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408690
push str.GetCustomerDefineCod_Failed_query_Cod.__r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x408760
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0041d650
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40880f
mov eax, dword [ebp - 0x110]
sub eax, 2
jne 0x40880f
cmp dword [ebp - 0x11c], 6
jne 0x40880f
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x4087d5
mov eax, 0xa
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x4087ed
mov eax, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x408805
mov eax, 0x1e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
cmp eax, 3
mov eax, 0x28
je 0x408814
mov eax, 0x29
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x408ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov ecx, 0x16
mov esi, str.SOFTWAREAtherosVistaAddOnSupportedDevice
lea edi, [ebp - 0x414]
rep movsd dword es:[edi], dword [esi]
push 0x1b0
xor esi, esi
lea ecx, [ebp - 0x3bc]
push esi
push ecx
mov dword [ebp - 0x424], eax
call fcn.0041d650
push 0x206
lea eax, [ebp - 0x20a]
xor edx, edx
push esi
push eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x428], 8
mov word [ebp - 0x20c], dx
call fcn.0041d650
add esp, 0x18
lea ecx, [ebp - 0x418]
push ecx
push 1
push esi
lea edx, [ebp - 0x414]
push edx
push 0x80000002
mov dword [ebp - 0x42c], 4
mov dword [ebp - 0x420], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408b91
mov ecx, dword [ebp - 0x418]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x41c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x408ba3
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x41c], esi
jbe 0x408c5d
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x408bc0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041d650
add esp, 0xc
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x430]
push eax
mov eax, dword [ebp - 0x418]
push 0
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x20c]
push edx
push esi
push eax
mov dword [ebp - 0x428], 0x104
call edi
test eax, eax
jne 0x408c2d
mov ecx, dword [ebp - 0x424]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00415ac5
add esp, 8
test eax, eax
jne 0x408c38
inc esi
cmp esi, dword [ebp - 0x41c]
jb 0x408bc0
jmp 0x408c5d
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x20c]
push eax
push ecx
push str.Find_the_vidpid__the_value_of_the_enum_pidvid_is__s__and_the_value_in_registry_is__s._n
call fcn.0040ca40
add esp, 0xc
mov dword [ebp - 0x420], 1
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
pop edi
xor ecx, ebp
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x408c80
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1c4
xor ebx, ebx
lea eax, [ebp - 0x3d4]
push ebx
mov ecx, 0x11
mov esi, str.SYSTEMCurrentControlSetEnumUSB
lea edi, [ebp - 0x418]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0041d650
add esp, 0xc
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x424], 8
mov word [ebp - 0x210], cx
call fcn.0041d650
add esp, 0xc
call fcn.004086b0
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x41c]
push eax
push 0x20019
push ebx
lea ecx, [ebp - 0x418]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408de8
mov eax, dword [ebp - 0x41c]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x420]
push edx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x408de8
xor esi, esi
cmp dword [ebp - 0x420], ebx
jbe 0x408de8
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop
push 0x208
lea ecx, [ebp - 0x210]
push 0
push ecx
call fcn.0041d650
mov ecx, dword [ebp - 0x41c]
add esp, 0xc
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x424]
push edx
lea eax, [ebp - 0x210]
push eax
push esi
push ecx
mov dword [ebp - 0x424], 0x104
call edi
test eax, eax
jne 0x408ddb
lea edx, [ebp - 0x210]
push edx
call fcn.00408ac0
add esp, 4
test eax, eax
je 0x408ddb
mov eax, dword [ebp - 0x428]
push eax
lea ecx, [ebp - 0x42c]
push ecx
mov ecx, dword [ebp - 0x41c]
lea edx, [ebp - 0x210]
call fcn.00408830
add esp, 8
mov ebx, eax
inc esi
cmp esi, dword [ebp - 0x420]
jb 0x408d60
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x408df9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0041558a
mov esp, ebp
pop ebp
ret

Function at 0x408e10
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
xor edi, edi
mov word [ebp - 0x20c], ax
call fcn.0041d650
add esp, 0xc
push edi
push 0x23
lea edx, [ebp - 0x20c]
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x408ea7
push str.AtherosAtherosServiceConfig.ini
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00415b25
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
push esi
push str.Operation
push str.operation
push str.AthService
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [edi + 1]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0041558a
mov esp, ebp
pop ebp
ret