joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100262fe
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.1002c1aa
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x1002633d
sub eax, 1
je 0x10026338
sub eax, 1
je 0x10026334
xor eax, eax
leave
ret
push 3
jmp 0x1002633f
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x10038147
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004ddd8
push 0x1004ddd0
push str.FlsAlloc
push 0x1e
call fcn.10037fb4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003817b
push dword [ebp + 8]
mov ecx, esi
call dword [0x100491b4]
call esi
jmp 0x10038181
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100381c5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004dde8
push 0x1004dde0
push str.FlsGetValue
push 0x20
call fcn.10037fb4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100381fc
push dword [ebp + 8]
mov ecx, esi
call dword [0x100491b4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1003e155
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1003e1f2
push ebx
push esi
call fcn.1003e11e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1003c821
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1003e19f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003e1f1
push edi
push eax
call fcn.10037cc5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1003e1bf
call fcn.10035f72
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003e1f0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1003c821
add esp, 0x20
test eax, eax
jne 0x1003e1de
push edi
call fcn.10035f72
jmp 0x1003e1e6
push ebx
call fcn.10035f72
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1003e1f5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1003e206
pop esi
ret
push ebx
push edi
push esi
call fcn.1003e11e
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10037cc5
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1003e22e
push ebx
push esi
push edi
call fcn.10028370
add esp, 0xc
push 0
call fcn.10035f72
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1003e5f2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003e243
Function at 0x10046330
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004635d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004635d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10018950
Capabilities:
Check http status code
Encode data using xor
Parse pe header

Disassembly:
mov eax, 0x1118
call fcn.10023ff0
push ebx
push ebp
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
xor ebp, ebp
push ebp
push ebp
stosw word es:[edi], ax
push ebp
push 4
push 0x100038a4
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
stosb byte es:[edi], al
call dword [fcn.10001250]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x14], esi
je 0x10018b01
mov eax, dword [esp + 0x112c]
push ebp
push 0x4000000
push ebp
push ebp
push eax
push esi
call dword [fcn.10001244]
mov ebx, eax
test ebx, ebx
je 0x10018af5
lea ecx, [esp + 0x20]
push ebp
lea edx, [esp + 0x20]
push ecx
push edx
push 0x20000013
push ebx
mov dword [esp + 0x34], 4
call dword [fcn.10001258]
test eax, eax
je 0x10018adc
cmp dword [esp + 0x1c], 0xc8
jne 0x10018adc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x128]
push eax
push 0x1000
push ecx
push ebx
call dword [0x1000125c]
test eax, eax
je 0x10018adc
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x10018a81
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 1
push edx
call fcn.1001c040
add esp, 4
test eax, eax
je 0x10018a71
lea eax, [esp + 0x24]
lea ecx, [esp + 0x158]
push eax
push ecx
call fcn.1001aa60
add esp, 8
test eax, eax
jne 0x10018adc
lea edx, [esp + 0x158]
push edx
jmp 0x10018a79
lea eax, [esp + 0x158]
push eax
call fcn.1001bfc0
add esp, 4
cmp ebp, dword [esp + 0x1134]
ja 0x10018adc
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10018af5
mov edx, dword [esp + 0x1130]
mov eax, ecx
lea esi, [esp + 0x128]
lea edi, [edx + ebp]
lea edx, [esp + 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
add ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x1000
push edx
push ebx
call dword [0x1000125c]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x10018a2d
mov edi, dword [0x10001248]
push ebx
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1118
ret
mov edi, dword [0x10001248]
push ebx
call edi
push esi
call edi
mov eax, dword [esp + 0x1130]
xor ecx, ecx
mov edx, 0x400
mov cx, word [eax]
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x3c], ecx
add ecx, eax
mov edi, dword [ecx]
add ecx, 4
xor edi, esi
dec edx
mov dword [ecx - 4], edi
jne 0x10018b1a
mov ecx, dword [eax + 0x3c]
mov byte [eax], 0x4d
mov byte [eax + 1], 0x5a
pop edi
mov byte [ecx + eax], 0x50
mov edx, dword [eax + 0x3c]
pop esi
mov byte [edx + eax + 1], 0x45
mov eax, dword [esp + 0x1130]
mov dword [eax], ebp
pop ebp
mov eax, 1
pop ebx
add esp, 0x1118
ret
Function at 0x10018b60
Capabilities:
Check http status code
Encode data using xor
Parse pe header

Disassembly:
mov eax, 0x1118
call fcn.10023ff0
push ebx
push ebp
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
xor ebp, ebp
push ebp
push ebp
stosw word es:[edi], ax
push ebp
push 4
push 0x100038a4
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
stosb byte es:[edi], al
call dword [fcn.10001250]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x14], esi
je 0x10018d11
mov eax, dword [esp + 0x112c]
push ebp
push 0x4000000
push ebp
push ebp
push eax
push esi
call dword [fcn.10001244]
mov ebx, eax
test ebx, ebx
je 0x10018d05
lea ecx, [esp + 0x20]
push ebp
lea edx, [esp + 0x20]
push ecx
push edx
push 0x20000013
push ebx
mov dword [esp + 0x34], 4
call dword [fcn.10001258]
test eax, eax
je 0x10018cec
cmp dword [esp + 0x1c], 0xc8
jne 0x10018cec
lea eax, [esp + 0x10]
lea ecx, [esp + 0x128]
push eax
push 0x1000
push ecx
push ebx
call dword [0x1000125c]
test eax, eax
je 0x10018cec
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x10018c91
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 1
push edx
call fcn.1001c130
add esp, 4
test eax, eax
je 0x10018c81
lea eax, [esp + 0x24]
lea ecx, [esp + 0x158]
push eax
push ecx
call fcn.1001aa60
add esp, 8
test eax, eax
jne 0x10018cec
lea edx, [esp + 0x158]
push edx
jmp 0x10018c89
lea eax, [esp + 0x158]
push eax
call fcn.1001c0b0
add esp, 4
cmp ebp, dword [esp + 0x1134]
ja 0x10018cec
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10018d05
mov edx, dword [esp + 0x1130]
mov eax, ecx
lea esi, [esp + 0x128]
lea edi, [edx + ebp]
lea edx, [esp + 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
add ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x1000
push edx
push ebx
call dword [0x1000125c]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x10018c3d
mov edi, dword [0x10001248]
push ebx
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1118
ret
mov edi, dword [0x10001248]
push ebx
call edi
push esi
call edi
mov eax, dword [esp + 0x1130]
xor ecx, ecx
mov edx, 0x400
mov cx, word [eax]
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x3c], ecx
add ecx, eax
mov edi, dword [ecx]
add ecx, 4
xor edi, esi
dec edx
mov dword [ecx - 4], edi
jne 0x10018d2a
mov ecx, dword [eax + 0x3c]
mov byte [eax], 0x4d
mov byte [eax + 1], 0x5a
pop edi
mov byte [ecx + eax], 0x50
mov edx, dword [eax + 0x3c]
pop esi
mov byte [edx + eax + 1], 0x45
mov eax, dword [esp + 0x1130]
mov dword [eax], ebp
pop ebp
mov eax, 1
pop ebx
add esp, 0x1118
ret
Function at 0x1001c780
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push esi
push edi
push 0
push 0
push 0
push 4
push 0x10004d0c
mov dword [esp + 0x1c], 0
call dword [fcn.10001250]
mov esi, eax
test esi, esi
je 0x1001c82e
mov eax, dword [esp + 0x14]
push 0
push 0x4000000
push 0
push 0
push eax
push esi
call dword [fcn.10001244]
mov edi, eax
test edi, edi
je 0x1001c821
lea ecx, [esp + 0xc]
push 0
lea edx, [esp + 0xc]
push ecx
push edx
push 0x20000013
push edi
mov dword [esp + 0x20], 4
call dword [fcn.10001258]
test eax, eax
je 0x1001c80d
mov eax, dword [esp + 8]
push edi
mov edi, dword [0x10001248]
cmp eax, 0x193
jne 0x1001c829
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 8
ret
push edi
mov edi, dword [0x10001248]
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edi, dword [0x10001248]
push 0
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x100208a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
mov dword [0x10036c20], eax
xor eax, eax
push esi
mov esi, ecx
mov ecx, dword [esp + 0x110]
mov dword [0x10036c04], esi
mov dword [0x10036c1c], ecx
mov dl, byte [eax + 0x100059d0]
xor dl, 0x88
mov byte [eax + 0x10036c08], dl
inc eax
cmp eax, 0x14
jb 0x100208c7
lea eax, [esp + 4]
push 0x104
push eax
push 0
call dword [fcn.100011cc]
lea ecx, [esp + 4]
push 0x5c
push ecx
call fcn.1001ab40
inc eax
push 0x10036c08
push eax
call fcn.1001aa60
add esp, 0x10
test eax, eax
je 0x10020993
lea edx, [esp + 4]
push edx
call fcn.1001bf10
mov eax, dword [0x100371d0]
add esp, 4
test eax, eax
je 0x10020936
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
call dword [fcn.100011d0]
mov ecx, esi
mov dword [0x100371d0], eax
call fcn.10020e40
test eax, eax
je 0x10020993
mov eax, dword [0x100059e4]
test eax, eax
je 0x10020984
push 0x28c
push 0
push 0x10036978
mov dword [0x100059e4], 0
mov dword [0x10037184], 0
call fcn.1001abf0
add esp, 0xc
mov ecx, esi
call fcn.10020cf0
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
xor eax, eax
pop esi
add esp, 0x104
ret 0xc
Function at 0x4031e0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x40320a
pop ecx
ret
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x403214
mov dword [ecx], eax
mov edx, dword [esp + 0x14]
test edx, edx
je 0x403224
push esi
mov esi, dword [esp + 4]
mov dword [edx], esi
pop esi
test ecx, ecx
jne 0x40322f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
Function at 0x403fb0
Capabilities:
Impersonate user

Disassembly:
sub esp, 0x588
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x19a]
mov word [esp + 0x198], bx
mov byte [esp + 0x94], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x95]
mov dword [esp + 0x30], ebx
rep stosd dword es:[edi], eax
mov ecx, 7
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x54]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x14], ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
call fcn.00403240
mov ebp, eax
cmp ebp, ebx
je 0x4041cb
push str.NvCplGetUserTokenAndName
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4041b3
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
lea ecx, [esp + 0x14]
push edx
push ecx
call eax
add esp, 0xc
cmp eax, 1
jne 0x4041b3
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x94]
push edx
lea ecx, [esp + 0x19c]
push eax
push ecx
call fcn.004103e7
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x30]
lea edx, [esp + 0x198]
push eax
push ecx
mov dword [esp + 0x38], 0x20
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], 1
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x4041b3
mov edx, dword [esp + 0x4c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
push edx
push 0x80000001
call edi
test eax, eax
jne 0x40418b
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0xc
push edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x64], 0x44
mov dword [esp + 0x6c], str.winsta0default
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [0x426958]
cmp eax, ebx
je 0x404133
call eax
cmp dword [esp + 0x18], eax
jne 0x40411d
call dword [0x426958]
cmp eax, 0xffffffff
jne 0x404133
push ebp
call fcn.00403260
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x588
ret
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x59c]
lea ecx, [esp + 0x50]
push eax
mov eax, dword [esp + 0x14]
push ecx
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push edx
push ebx
push eax
call fcn.00401000
test eax, eax
je 0x40417c
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
push ebx
push 0x80000001
call edi
mov esi, 1
jmp 0x40418d
xor esi, esi
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push ebp
call fcn.00403260
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x588
ret
push ebp
xor esi, esi
call fcn.00403260
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x588
ret
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x588
ret
Function at 0x4043c0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x404460
push ebp
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, 0x28
push 0
push 0
push 0
push 0
push 0
push str._SystemRoot__system32_nvsvc32.exe
push 1
push 2
push 0x110
push 0xf01ff
push str.NVIDIA_Driver_Helper_Service
push str.NVSvc
push ebx
dec esi
call edi
test eax, eax
jne 0x404449
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 0x430
jne 0x404452
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x4043f0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
push eax
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
mov eax, 0x427
pop ebx
ret

Function at 0x404470
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x24
push ebx
push edi
xor edi, edi
push 0xf003f
push edi
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0xc], ebx
je 0x404579
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xf01ff
push str.NVSvc
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, edi
je 0x404552
lea eax, [esp + 0x14]
push ebp
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x40450d
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, 0x64
mov eax, dword [esp + 0x1c]
dec ebx
cmp eax, 1
je 0x404502
push 0x64
call edi
lea ecx, [esp + 0x18]
push ecx
push esi
call ebp
test eax, eax
je 0x4044fb
test ebx, ebx
jne 0x4044dd
cmp dword [esp + 0x1c], 1
jne 0x404509
push 0x3e8
call edi
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
pop ebp
jne 0x404539
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
mov dword [esp + 0xc], eax
jne 0x404539
push 0x3e8
call edi
mov dword [esp + 0xc], 0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop esi
pop edi
pop ebx
add esp, 0x24
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
mov dword [esp + 0xc], eax
jne 0x404567
mov dword [esp + 0xc], edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop esi
pop edi
pop ebx
add esp, 0x24
ret
pop edi
mov eax, 0x427
pop ebx
add esp, 0x24
ret
Function at 0x404b20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
mov dword [esp + 8], 0x100
push eax
push 1
push 0
push 0x41e388
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop edi
je 0x404b7f
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x208
ret
mov eax, dword [esp]
test eax, eax
jne 0x404b8e
add esp, 0x208
ret
lea edx, [esp + 4]
lea ecx, [esp + 8]
push edx
push ecx
push 0
push 0
push str.LoadLimitedSID
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x404bc0
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x208
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x20c]
lea ecx, [esp + 8]
push ecx
push edx
call fcn.0041056e
add esp, 8
mov eax, 1
add esp, 0x208
ret

Function at 0x404bf0
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf003f
push 0
push 0x41e388
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404c28
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
test eax, eax
jne 0x404c32
pop ecx
ret
push str.LoadLimitedSID
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x404c51
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x404c70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp], 0
push eax
push 1
push 0
push 0x41e400
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404ca6
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp]
test eax, eax
jne 0x404cb2
add esp, 0xc
ret
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
push edx
push 0
push 0
push str.EnableThermalHistory
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x404ce1
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0xc
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0xc
ret

Function at 0x404d00
Capabilities:
Delete registry value

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
push esi
lea eax, [esp + 0x10]
push str.GPU_1d
push eax
call fcn.00410593
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push edi
call ebx
inc esi
cmp esi, 8
jb 0x404d12
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x404d40
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x41e400
push 0x80000002
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
call esi
test eax, eax
je 0x404d8d
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 4]
test eax, eax
jne 0x404d9c
xor eax, eax
pop esi
add esp, 0xc
ret
lea ecx, [esp + 8]
push 0
push ecx
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWARENVIDIA_CorporationGlobalNvSvcThermalHistory
push 0x80000002
call esi
test eax, eax
je 0x404dd2
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 8]
test eax, eax
jne 0x404dec
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 4]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.EnableThermalHistory
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x404e26
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call esi
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 8]
push edx
call fcn.00404d00
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call esi
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x404ef0
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf003f
push 0
push 0x41e400
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404ee2
mov eax, dword [esp]
test eax, eax
je 0x404ee2
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.EnableThermalHistory
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x404ec7
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWARENVIDIA_CorporationGlobalNvSvcThermalHistory
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
add esp, 8
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x404efd
jmp fcn.00404d40
jmp 0x404e60