joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428f6d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp - 8], 0
je 0x429089
cmp dword [ebp - 0xc], 0
je 0x429089
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
mov dword [ebp - 8], 0xffffffff
push 0x528e54
mov ecx, dword [ebp + 8]
push ecx
call fcn.00493b20
add esp, 8
test eax, eax
jne 0x42903c
mov edx, dword [0x5d3e24]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x528e64
lea ecx, [ebp - 0x114]
push ecx
call fcn.004936f0
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x114]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42903c
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 0
mov dword [ebp - 0x14], 1
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x429089
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x42908d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
push 0x528e6c
mov eax, dword [ebp + 8]
push eax
call fcn.00493b20
add esp, 8
test eax, eax
jne 0x429127
mov ecx, dword [0x5d3e24]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
lea eax, [ebp - 0x10c]
push eax
call fcn.004936f0
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42911d
mov eax, dword [ebp + 0x10]
push eax
call fcn.00493490
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x42916d
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00493490
add esp, 4
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x42a519
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.00410f70
mov ecx, eax
call fcn.0042ddd0
mov dword [ebp - 4], eax
xor eax, eax
mov al, byte [0x5d3fc5]
test eax, eax
je 0x42a54e
cmp dword [ebp - 4], 0
je 0x42a54e
xor ecx, ecx
mov cl, byte [0x5d4007]
test ecx, ecx
je 0x42a553
jmp 0x42a61f
cmp dword [0x5b8444], 1
jne 0x42a561
jmp 0x42a61f
mov dword [0x5b8444], 1
mov dword [0x5d400c], 1
push 0
mov edx, dword [0x5b7b8c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42a5c2
push 0
mov eax, dword [0x5b7bdc]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [0x5b7bdc]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5b7bdc], 0
mov ecx, 0x5b7b88
call fcn.0042daa0
call fcn.0042ce03
mov dword [0x5d4014], 0
push 0
push 0x8005
mov ecx, dword [ebp - 4]
call fcn.0042dc60
and eax, 8
test eax, eax
jne 0x42a61f
mov byte [0x5b8441], 0
mov ecx, dword [ebp - 8]
call fcn.0042c342
push 0x529078
push 0x52907c
push 0x529084
call fcn.0042908d
add esp, 0xc
push 0x529094
push 0x529098
push 0x5290a4
call fcn.0042908d
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x42c342
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc9d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
push 0
mov eax, dword [0x5b7bac]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42c46b
mov byte [0x5d5438], 1
push 0x52987c
push 0x529880
push 0x529888
call fcn.0042908d
add esp, 0xc
push 0x529898
lea ecx, [ebp - 0x18]
call fcn.004ad180
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.0042c094
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004ad2ef
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1c]
call fcn.004ad0c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004ad0c0
push 0
lea ecx, [ebp - 0x10]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x5298b0
call fcn.004448bb
add esp, 8
cmp dword [ebp - 0x14], 0
je 0x42c42c
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004449bf
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x42c402
push 1
mov ecx, dword [ebp - 0x20]
call fcn.0042898b
mov ecx, 0x5b7ba8
call fcn.0042daf0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
push 0x42690c
call fcn.004ac601
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004ad0c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42e490
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x42fa00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x10], 0x30
mov byte [ebp - 0xf], 0x31
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 0xc], 0x34
mov byte [ebp - 0xb], 0x35
mov byte [ebp - 0xa], 0x36
mov byte [ebp - 9], 0x37
mov byte [ebp - 8], 0x38
mov byte [ebp - 7], 0x39
mov byte [ebp - 6], 0x41
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0x43
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x45
mov byte [ebp - 1], 0x46
mov ecx, dword [ebp + 0x14]
push ecx
push 0x30
mov edx, dword [ebp + 0x10]
push edx
call fcn.00493430
add esp, 0xc
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov byte [eax], 0
mov ecx, dword [ebp + 0x18]
and ecx, 0xff
test ecx, ecx
je 0x42faca
mov dword [ebp - 0x14], 0
jmp 0x42fa86
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jge 0x42fac8
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
and edx, 0xf
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp + edx - 0x10]
mov byte [ecx + eax*2 + 1], dl
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp + ecx - 0x10]
mov byte [eax + edx*2], cl
jmp 0x42fa7d
jmp 0x42fb33
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 0x14], edx
jmp 0x42fade
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x42fb33
cmp dword [ebp - 0x18], 0
jle 0x42fb33
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
and edx, 0xf
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x18]
mov dl, byte [ebp + edx - 0x10]
mov byte [ecx], dl
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x18]
mov cl, byte [ebp + ecx - 0x10]
mov byte [eax], cl
jmp 0x42fad5
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x437723
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push str.SystemCurrentControlSetControlComputerNameComputerName
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43776d
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.ComputerName
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x43777e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x108], 4
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea eax, [ebp - 0x100]
push eax
call fcn.00493600
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.00493610
add esp, 8
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x100]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x43780f
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push str.EnableDHCP
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x104]
mov esp, ebp
pop ebp
ret
Function at 0x438b76
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd208
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbe4
mov byte [ebp - 0xbd8], 1
lea ecx, [ebp - 0x10]
call fcn.00406f30
mov dword [ebp - 4], 0
push 0x5d4040
lea ecx, [ebp - 0x10]
call fcn.004ad249
push 4
lea eax, [ebp - 0xbe4]
push eax
lea ecx, [ebp - 0x10]
call fcn.004a93ee
mov dword [ebp - 0xbec], eax
mov ecx, dword [ebp - 0xbec]
mov dword [ebp - 0xbf0], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xbf0]
push edx
lea ecx, [ebp - 0x10]
call fcn.004ad1f9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbe4]
call fcn.004ad0c0
lea ecx, [ebp - 0xbdc]
call fcn.00406f30
mov byte [ebp - 4], 2
cmp dword [0x5d4000], 1
jne 0x438c39
cmp dword [0x5d400c], 2
jne 0x438c39
mov eax, dword [0x5d3e24]
push eax
push 0x530eb0
lea ecx, [ebp - 0xbdc]
push ecx
call fcn.004a988a
add esp, 0xc
jmp 0x438c57
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x5d3e24]
push eax
push 0x530ec4
lea ecx, [ebp - 0xbdc]
push ecx
call fcn.004a988a
add esp, 0x10
lea edx, [ebp - 0xbd4]
push edx
lea ecx, [ebp - 0xbdc]
call fcn.00406f50
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0xbcc], eax
cmp dword [ebp - 0xbcc], 0
jne 0x438d5d
push 5
push 0
lea eax, [ebp - 0xbc8]
push eax
call fcn.00493430
add esp, 0xc
mov dword [ebp - 0xbe0], 0xbb8
mov dword [ebp - 0xbd0], 3
lea ecx, [ebp - 0xbe0]
push ecx
lea edx, [ebp - 0xbc8]
push edx
lea eax, [ebp - 0xbd0]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xbd4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsx eax, byte [ebp - 0xbc8]
cmp eax, 0x59
jne 0x438d13
movsx ecx, byte [ebp - 0xbc7]
cmp ecx, 0x76
jne 0x438d13
movsx edx, byte [ebp - 0xbc6]
cmp edx, 0x65
jne 0x438d13
movsx eax, byte [ebp - 0xbc5]
cmp eax, 0x73
jne 0x438d13
movsx ecx, byte [ebp - 0xbc4]
cmp ecx, 4
je 0x438d1c
mov byte [ebp - 0xbd8], 0
jmp 0x438d34
push 0x440
lea edx, [ebp - 0xbc2]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004930f0
add esp, 0xc
movsx ecx, byte [ebp - 0xbc3]
cmp ecx, 1
jne 0x438d48
mov edx, dword [ebp + 0xc]
mov byte [edx], 1
jmp 0x438d4e
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xbd4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x438d64
mov byte [ebp - 0xbd8], 0
mov dl, byte [ebp - 0xbd8]
mov byte [ebp - 0xbe8], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbdc]
call fcn.004ad0c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004ad0c0
mov al, byte [ebp - 0xbe8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x438e19
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd233
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7ec
lea ecx, [ebp - 0x10]
call fcn.00406f30
mov dword [ebp - 4], 0
push 0x5d4040
lea ecx, [ebp - 0x10]
call fcn.004ad249
push 4
lea eax, [ebp - 0x7f0]
push eax
lea ecx, [ebp - 0x10]
call fcn.004a93ee
mov dword [ebp - 0x7f4], eax
mov ecx, dword [ebp - 0x7f4]
mov dword [ebp - 0x7f8], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x7f8]
push edx
lea ecx, [ebp - 0x10]
call fcn.004ad1f9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7f0]
call fcn.004ad0c0
lea ecx, [ebp - 0x7ec]
call fcn.00406f30
mov byte [ebp - 4], 2
cmp dword [0x5d4000], 1
jne 0x438ed5
cmp dword [0x5d400c], 2
jne 0x438ed5
mov eax, dword [0x5d3e24]
push eax
push 0x530ef0
lea ecx, [ebp - 0x7ec]
push ecx
call fcn.004a988a
add esp, 0xc
jmp 0x438ef3
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x5d3e24]
push eax
push 0x530f04
lea ecx, [ebp - 0x7ec]
push ecx
call fcn.004a988a
add esp, 0x10
lea edx, [ebp - 0x7e8]
push edx
lea ecx, [ebp - 0x7ec]
call fcn.00406f50
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0
jne 0x438fae
mov byte [ebp - 0x7e0], 0x59
mov byte [ebp - 0x7df], 0x76
mov byte [ebp - 0x7de], 0x65
mov byte [ebp - 0x7dd], 0x73
mov byte [ebp - 0x7dc], 4
mov eax, dword [ebp + 0xc]
and eax, 0xff
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x7db], al
push 0x440
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x7da]
push edx
call fcn.004930f0
add esp, 0xc
push 0x446
lea eax, [ebp - 0x7e0]
push eax
push 3
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x7e8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x7e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7ec]
call fcn.004ad0c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004ad0c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43f46a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd316
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7fc
mov byte [ebp - 0x7f0], 1
lea ecx, [ebp - 0x10]
call fcn.00406f30
mov dword [ebp - 4], 0
push 0x5d4040
lea ecx, [ebp - 0x10]
call fcn.004ad249
push 4
lea eax, [ebp - 0x7fc]
push eax
lea ecx, [ebp - 0x10]
call fcn.004a93ee
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
mov dword [ebp - 0x808], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x808]
push edx
lea ecx, [ebp - 0x10]
call fcn.004ad1f9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7fc]
call fcn.004ad0c0
lea ecx, [ebp - 0x7f4]
call fcn.00406f30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x5d3e24]
push ecx
push str.SoftwareRtWLan_sACMProfile_s
lea edx, [ebp - 0x7f4]
push edx
call fcn.004a988a
add esp, 0x10
lea eax, [ebp - 0x7ec]
push eax
lea ecx, [ebp - 0x7f4]
call fcn.00406f50
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0
jne 0x43f5c4
push 0x7d0
push 0
lea ecx, [ebp - 0x7e0]
push ecx
call fcn.00493430
add esp, 0xc
mov dword [ebp - 0x7f8], 0x7d0
mov dword [ebp - 0x7e8], 3
lea edx, [ebp - 0x7f8]
push edx
lea eax, [ebp - 0x7e0]
push eax
lea ecx, [ebp - 0x7e8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x7ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x7d0
lea ecx, [ebp - 0x7e0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004930f0
add esp, 0xc
mov eax, dword [ebp - 0x7ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f5cb
mov byte [ebp - 0x7f0], 0
mov cl, byte [ebp - 0x7f0]
mov byte [ebp - 0x800], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7f4]
call fcn.004ad0c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004ad0c0
mov al, byte [ebp - 0x800]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x440017
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov byte [ebp - 0x14], 1
mov eax, dword [ebp + 8]
push eax
push str.LOCKED_STA_ADDRESS_d
lea ecx, [ebp - 0x14c]
push ecx
call fcn.004936f0
add esp, 0xc
mov edx, dword [0x5d3e24]
push edx
push 0x531970
lea eax, [ebp - 0x114]
push eax
call fcn.004936f0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x114]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 6
push 0
lea eax, [ebp - 8]
push eax
call fcn.00493430
add esp, 0xc
mov dword [ebp - 0x118], 6
mov dword [ebp - 0xc], 3
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4400cc
push 6
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004930f0
add esp, 0xc
mov byte [ebp - 0x14], 1
jmp 0x4400d0
mov byte [ebp - 0x14], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x440155
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov byte [ebp - 0x14], 1
mov eax, dword [ebp + 8]
push eax
push str.SET_DATA_RATE_STA_d
lea ecx, [ebp - 0x14c]
push ecx
call fcn.004936f0
add esp, 0xc
mov edx, dword [0x5d3e24]
push edx
push 0x531998
lea eax, [ebp - 0x114]
push eax
call fcn.004936f0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x114]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 8
push 0
lea eax, [ebp - 8]
push eax
call fcn.00493430
add esp, 0xc
mov dword [ebp - 0x118], 8
mov dword [ebp - 0xc], 3
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44020a
push 8
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004930f0
add esp, 0xc
mov byte [ebp - 0x14], 1
jmp 0x44020e
mov byte [ebp - 0x14], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x440335
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd35a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x17c
mov byte [ebp - 0x28], 1
push 0x5d4040
lea ecx, [ebp - 0x14]
call fcn.004ad12e
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x14]
call fcn.004a93ee
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 0x188], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x188]
push edx
lea ecx, [ebp - 0x14]
call fcn.004ad1f9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.004ad0c0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x5d3e24]
push ecx
push 0x5319ac
lea edx, [ebp - 0x130]
push edx
call fcn.004936f0
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x130]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x440412
mov dword [ebp - 0x17c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004ad0c0
mov eax, dword [ebp - 0x17c]
jmp 0x44052b
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x16c], 0
cmp dword [ebp - 0x2c], 0
jne 0x4404fd
mov edx, dword [ebp - 0x170]
add edx, 1
mov dword [ebp - 0x170], edx
push 0x32
push 0
lea eax, [ebp - 0x168]
push eax
call fcn.00493430
add esp, 0xc
mov dword [ebp - 0x174], 6
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x134], 0x32
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push eax
push 0
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x168]
push edx
mov eax, dword [ebp - 0x170]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4404f8
lea edx, [ebp - 0x168]
cmp edx, 0x5d37d8
je 0x4404f8
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x4404e9
push 6
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x16c]
push edx
call fcn.004930f0
add esp, 0xc
mov eax, dword [ebp - 0x16c]
add eax, 6
mov dword [ebp - 0x16c], eax
jmp 0x440434
cmp dword [ebp - 0x24], 0
je 0x44050d
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x180], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004ad0c0
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret