joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e6b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43e6e3
push esi
call fcn.004417b0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43e6dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43e769
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43e752
mov eax, dword [esi + 8]
test eax, eax
je 0x43e707
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43e74e
cmp eax, 2
je 0x43e752
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43e6fa
cmp eax, 3
je 0x43e72d
cmp eax, 1
jne 0x43e6fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43e6fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43e6fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043e790
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43e778
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043e790
add esp, 4
pop esi
ret

Function at 0x45d509
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45d541
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045b5bd
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045b595
jmp 0x45d54d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45ebf7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45ec39
call fcn.004646b5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45ec39
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45ec30
xor eax, eax
jmp 0x45ec41
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045ec47
pop edi
pop esi
pop ebx
ret 4

Function at 0x464be5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x464c13
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x464c31
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00464b4b
jmp 0x464c31
mov eax, dword [esi + 0x14]
test eax, eax
je 0x464c31
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00464b4b
test edi, edi
mov eax, edi
jne 0x464c1b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4063c6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call fcn.00403aff
test eax, eax
je 0x40647c
call fcn.00403b1f
test eax, eax
jne 0x406400
push 6
pop eax
jmp 0x40656f
mov eax, dword [ebp + 0x10]
mov dword [0x49a2b4], edi
mov ebx, 0x49a18c
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [0x49a2b0], eax
mov eax, dword [0x49a198]
movsw word es:[edi], word [esi]
xor esi, esi
cmp eax, esi
je 0x40642b
push eax
call dword [0x467320]
cmp byte [ebp + 0x14], 0
lea eax, [ebp - 0x130]
push eax
push esi
mov dword [0x49a19c], 1
push ebx
je 0x40644b
push 0x4024b0
jmp 0x406450
push 0x4023f5
push esi
push esi
call fcn.00436914
add esp, 0x18
cmp eax, esi
jne 0x40646e
mov dword [0x49a2b0], esi
mov dword [0x49a19c], esi
push 3
jmp 0x4063fa
push eax
call dword [0x467350]
xor eax, eax
jmp 0x40656f
mov al, byte [esi]
mov byte [ebp - 0x16], al
mov al, byte [esi + 1]
mov byte [ebp - 0x15], al
mov al, byte [esi + 2]
mov byte [ebp - 0x14], al
mov al, byte [esi + 3]
push 3
mov byte [ebp - 0x13], al
lea ebx, [esi + 4]
lea eax, [ebp - 0x12]
push ebx
push eax
call fcn.00439860
push 3
add esi, 7
lea eax, [ebp - 0xf]
push esi
push eax
call fcn.00439860
push 6
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00439860
add esp, 0x24
xor esi, esi
push esi
cmp edi, esi
setne al
mov byte [ebp - 6], al
lea eax, [ebp - 0x134]
push eax
push 0x10d
lea eax, [ebp - 0x12c]
push eax
push 0x17
lea eax, [ebp - 0x1c]
push eax
push 0x2a0850
push dword [0x498014]
call dword [0x467354]
test eax, eax
jne 0x40651e
cmp byte [section..data], 1
jb 0x406517
call dword [0x467358]
push eax
push str.BTM_IF___BTM_StartInquiry_IOCtl_failed__Code:__d
push esi
call fcn.00421c1f
add esp, 0xc
push 9
jmp 0x4063fa
cmp word [ebp - 0x12c], si
je 0x406543
cmp word [ebp - 0x12c], 1
je 0x406543
cmp word [ebp - 0x12c], 2
jne 0x406568
cmp dword [0x49a2b0], esi
jne 0x406568
mov eax, dword [ebp + 0x10]
or dword [0x49a338], 0x20
cmp edi, esi
mov dword [0x49a2b0], eax
mov dword [0x49a2b8], edi
je 0x406563
or dword [0x49a338], 0x40
call fcn.00403f04
movzx eax, word [ebp - 0x12c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
leave
ret
Function at 0x4071ec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x498010], 0xffffffff
je 0x407210
xor eax, eax
inc eax
jmp 0x40731c
call fcn.00403aff
test eax, eax
jne 0x407208
push ebx
xor ebx, ebx
cmp dword [0x498014], 0xffffffff
mov dword [0x49a380], ebx
jne 0x407241
call fcn.00405035
push eax
mov dword [0x498014], eax
call fcn.004050de
pop ecx
mov dword [0x49a33c], eax
push edi
xor eax, eax
mov edi, 0x49a074
push 0x2c
stosd dword es:[edi], eax
push ebx
push 0x49a048
stosd dword es:[edi], eax
call fcn.00436a20
add esp, 0xc
cmp byte [ebp + 8], bl
pop edi
je 0x407318
push ebx
lea eax, [ebp - 0x11c]
push eax
push 0x10d
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
push 0x2a0840
push dword [0x498014]
call dword [0x467354]
test eax, eax
jne 0x4072a7
cmp byte [section..data], 1
jb 0x407314
call dword [0x467358]
push eax
push str.BTM_IF___IOCTL_BTM_REGISTER_failed__Code:__d
jmp 0x40730b
mov eax, dword [ebp - 0x112]
cmp eax, 0x30
mov byte [0x49a196], bl
jbe 0x4072d0
cmp byte [section..data], 1
jb 0x407314
push str.BTM_IF___IOCTL_BTM_REGISTER_failed
push ebx
call fcn.00421c1f
pop ecx
pop ecx
jmp 0x407314
mov dword [0x498010], eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push 0x40554f
push ebx
push ebx
call fcn.00436914
add esp, 0x18
cmp eax, ebx
mov dword [0x49a21c], eax
jne 0x407318
cmp byte [section..data], 1
jb 0x407314
call dword [0x467358]
push eax
push str.BTM_IF___Thread_creation_failed__Code:__d
push ebx
call fcn.00421c1f
add esp, 0xc
xor eax, eax
jmp 0x40731b
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004369c2
leave
ret
Function at 0x40b50a
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 0x28
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str.Widcomm_Bluetooth_Key_Container_Name
lea eax, [ebp - 4]
push eax
call dword [0x467010]
test eax, eax
jne 0x40b54a
mov esi, dword [0x467358]
call esi
push eax
call esi
push eax
push str.BtInitializeMachineKeyContainer:_CryptAcquireContext_failed.Error_d__0x_x__n
call fcn.0040b42c
add esp, 0xc
call esi
jmp 0x40b5a6
push 1
lea eax, [ebp - 0x18]
push eax
xor esi, esi
call dword [0x46701c]
test eax, eax
jne 0x40b56d
call dword [0x467358]
mov esi, eax
push esi
push esi
push str.BtInitializeMachineKeyContainer:_InitializeSecurityDescriptor_failed.Error_d__0x_x__n
jmp 0x40b591
push 4
lea eax, [ebp - 0x18]
push eax
push 8
push dword [ebp - 4]
call dword [0x467018]
test eax, eax
jne 0x40b599
call dword [0x467358]
mov esi, eax
push esi
push esi
push str.BtInitializeMachineKeyContainer:_CryptSetProvParam_failed.Error_d__0x_x__n
call fcn.0040b42c
add esp, 0xc
push 0
push dword [ebp - 4]
call dword [0x467014]
mov eax, esi
pop esi
leave
ret

Function at 0x40b5a9
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str.Widcomm_Bluetooth_Key_Container_Name
lea eax, [ebp - 4]
push eax
call dword [0x467010]
test eax, eax
jne 0x40b5e8
push esi
mov esi, dword [0x467358]
call esi
push eax
call esi
push eax
push str.BtInitializeUserKeyContainer:_CryptAcquireContext_failed.Error_d__0x_x__n
call fcn.0040b42c
add esp, 0xc
call esi
pop esi
leave
ret
push 0
push dword [ebp - 4]
call dword [0x467014]
xor eax, eax
leave
ret
Function at 0x40ba7c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov al, byte [ebp + 8]
neg al
mov byte [ebp - 1], 0
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x20
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str.Widcomm_Bluetooth_Key_Container_Name
lea eax, [ebp - 0x14]
push eax
call dword [0x467010]
test eax, eax
jne 0x40bac0
xor al, al
leave
ret
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push 4
pop ebx
push ebx
lea eax, [ebp + 8]
push esi
push eax
call fcn.00439860
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add esi, ebx
cmp eax, dword [ecx]
jne 0x40bb94
push edi
push ebx
lea edi, [eax - 4]
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.00439860
sub edi, ebx
lea eax, [edi - 4]
add esp, 0xc
add esi, ebx
cmp dword [ebp - 0xc], eax
ja 0x40bb93
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push dword [ebp - 0xc]
push esi
push dword [ebp - 0x14]
call dword [0x467038]
test eax, eax
je 0x40bb93
add esi, dword [ebp - 0xc]
sub edi, dword [ebp - 0xc]
push ebx
lea eax, [ebp - 8]
push esi
push eax
call fcn.00439860
add edi, 0xfffffffc
add esp, 0xc
cmp dword [ebp - 8], edi
jne 0x40bb93
push dword [ebp - 8]
call fcn.00439dca
mov edi, eax
test edi, edi
pop ecx
je 0x40bb93
push dword [ebp - 8]
add esi, ebx
push esi
push edi
call fcn.00439860
add esp, 0xc
lea eax, [ebp - 8]
push eax
push edi
push 0
push 1
push 0
push dword [ebp - 0x10]
call dword [0x467034]
test eax, eax
je 0x40bb88
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, dword [ebp - 8]
mov byte [ebp - 1], 1
xor edi, edi
mov dword [ecx], eax
test edi, edi
je 0x40bb93
push edi
call fcn.00439c78
pop ecx
pop edi
xor esi, esi
cmp dword [ebp - 0x10], esi
je 0x40bba4
push dword [ebp - 0x10]
call dword [0x467020]
cmp dword [ebp - 0x14], esi
je 0x40bbb3
push esi
push dword [ebp - 0x14]
call dword [0x467014]
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret
Function at 0x40bbba
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov ecx, dword [ebp + 0xb8]
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 0x104
mov dword [ebp - 0x6c], ecx
lea ecx, [ebp - 0x68]
push ecx
push 0xffffffffffffffff
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0xac]
push eax
push esi
push esi
mov dword [ebp - 0x7c], eax
call dword [0x467334]
lea eax, [ebp - 0x68]
push eax
call fcn.00439690
mov ecx, dword [ebp + 0xbc]
inc eax
lea ebx, [eax + ecx + 0xc]
push ebx
mov dword [ebp - 0x70], eax
call fcn.00439dca
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
jne 0x40bc38
push 0xe
pop eax
jmp 0x40bcee
push 4
lea eax, [ebp + 0xb4]
push eax
push edi
call fcn.00439860
push 4
lea eax, [ebp - 0x70]
push eax
lea esi, [edi + 4]
push esi
call fcn.00439860
push dword [ebp - 0x70]
lea eax, [ebp - 0x68]
push eax
add esi, 4
push esi
call fcn.00439860
add esi, dword [ebp - 0x70]
push 4
lea eax, [ebp + 0xbc]
push eax
push esi
call fcn.00439860
push dword [ebp + 0xbc]
add esi, 4
push dword [ebp - 0x6c]
push esi
call fcn.00439860
cmp dword [ebp - 0x74], 0x80000001
mov dword [ebp - 0x6c], edi
sete al
mov byte [ebp - 0x80], al
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
mov dword [ebp - 0x78], ebx
call fcn.0040b840
add esp, 0x48
test al, al
jne 0x40bcbd
mov ebx, 0x1770
xor esi, esi
jmp 0x40bcda
push dword [ebp - 0x78]
mov esi, dword [ebp - 0x6c]
push esi
push 3
push dword [ebp + 0xb0]
push dword [ebp - 0x7c]
push dword [ebp - 0x74]
call dword [0x46703c]
mov ebx, eax
push edi
call fcn.00439c78
test esi, esi
pop ecx
je 0x40bcec
push esi
call fcn.00439c78
pop ecx
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0xa0
leave
ret
Function at 0x40bd06
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xbc]
sub esp, 0x13c
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0xb8], eax
mov eax, dword [ebp + 0xcc]
push ebx
mov ebx, dword [ebp + 0xc4]
push esi
push edi
mov edi, dword [ebp + 0xc8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xd0]
xor esi, esi
push esi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0xd4]
push esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xd8]
push 0x104
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x4c]
push eax
push 0xffffffffffffffff
push edi
push esi
push esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
call dword [0x467334]
lea eax, [ebp - 0x58]
push eax
push esi
mov esi, dword [0x467040]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x50]
push edi
push ebx
call esi
test eax, eax
jne 0x40bef2
push dword [ebp - 0x58]
call fcn.00439dca
test eax, eax
pop ecx
mov dword [ebp - 0x64], eax
jne 0x40bda8
push 0xe
pop eax
jmp 0x40bef2
lea ecx, [ebp - 0x58]
push ecx
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x50]
push edi
push ebx
call esi
test eax, eax
mov dword [ebp - 0x50], eax
je 0x40bdd6
cmp eax, 0xea
jne 0x40bed7
mov dword [ebp - 0x50], 0x1771
jmp 0x40bed7
cmp dword [ebp - 0x6c], 3
mov dword [ebp - 0x50], 0x1771
jne 0x40bed7
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], eax
cmp ebx, 0x80000001
sete al
mov byte [ebp - 0x80], al
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x80]
call fcn.0040ba7c
add esp, 0xc
test al, al
jne 0x40be1f
and dword [ebp - 0x54], 0
jmp 0x40bed7
mov esi, dword [ebp - 0x68]
push 4
pop ebx
cmp esi, ebx
jb 0x40bed7
mov edi, dword [ebp - 0x54]
push ebx
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.00439860
add esi, 0xfffffffc
add esp, 0xc
add edi, ebx
cmp esi, ebx
jb 0x40bed7
push ebx
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.00439860
lea eax, [ebp - 0x4c]
push eax
call fcn.00439690
add esp, 0x10
inc eax
cmp dword [ebp - 0x5c], eax
jne 0x40bed7
sub esi, ebx
add edi, ebx
cmp esi, dword [ebp - 0x5c]
jb 0x40bed7
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.0043ab90
test eax, eax
pop ecx
pop ecx
jne 0x40bed7
sub esi, dword [ebp - 0x5c]
add edi, dword [ebp - 0x5c]
cmp esi, ebx
jb 0x40bed7
push ebx
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.00439860
sub esi, ebx
add esp, 0xc
add edi, ebx
cmp esi, dword [ebp - 0x70]
jne 0x40bed7
mov ebx, dword [ebp - 0x7c]
cmp esi, dword [ebx]
jbe 0x40beb2
mov dword [ebp - 0x50], 0xea
jmp 0x40bed7
mov eax, dword [ebp - 0x74]
and dword [ebp - 0x50], 0
test eax, eax
je 0x40bec2
mov ecx, dword [ebp - 0x78]
mov dword [eax], ecx
cmp dword [ebp - 0x60], 0
je 0x40bed5
push esi
push edi
push dword [ebp - 0x60]
call fcn.00439860
add esp, 0xc
mov dword [ebx], esi
push dword [ebp - 0x64]
call fcn.00439c78
cmp dword [ebp - 0x54], 0
pop ecx
je 0x40beef
push dword [ebp - 0x54]
call fcn.00439c78
pop ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp + 0xb8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0xbc
leave
ret
Function at 0x40c5e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x41c]
push eax
xor ebx, ebx
push ebx
push ebx
push str.UUID
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x418]
push eax
push ebx
push ebx
push str.DefaultRadio
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x430]
push eax
push ebx
push ebx
push str.Authorization
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x434]
push eax
push ebx
push ebx
push str.Authentication
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x438]
push eax
push ebx
push ebx
push str.Encryption
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x43c]
push eax
push ebx
push ebx
push str.SecurityId
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x440]
push eax
push ebx
push ebx
push 0x46b9d0
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea ecx, [ebp - 4]
lea eax, [edi + 0xa58]
push ecx
mov dword [ebp - 4], 0x50
push eax
push ebx
push ebx
push str.GUID
push dword [ebp + 8]
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x648]
push eax
push ebx
push ebx
push str.StatusDll
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x850]
push eax
push ebx
push ebx
push str.PropertiesDll
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [edi + 0xa58]
push eax
lea eax, [edi + 0x420]
push eax
call fcn.0040b704
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xaa8]
push eax
push ebx
push ebx
push str.Description
push dword [ebp + 8]
mov dword [ebp - 4], 0x820
call esi
test eax, eax
je 0x40c75a
xor eax, eax
jmp 0x40c75d
mov eax, dword [ebp - 4]
mov word [edi + eax*2 + 0xaa8], bx
lea eax, [ebp - 4]
push eax
add edi, 0x12c8
push edi
push ebx
push ebx
push 0x46b95c
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c8cf
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
mov eax, dword [ebp + 0x1c0]
push ebx
mov ebx, dword [ebp + 0x1b4]
push esi
push edi
mov edi, dword [ebp + 0x1b8]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], 0x20019
call fcn.0040bfd2
test eax, eax
je 0x40c91c
mov dword [ebp - 0x74], 0x20119
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x74]
mov eax, dword [ebp - 0x68]
xor esi, esi
push esi
push edi
push dword [eax + 0x414]
call dword [0x46700c]
test eax, eax
jne 0x40ca04
mov edi, dword [0x467044]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
push ebx
mov dword [ebp - 0x7c], esi
push esi
jmp 0x40c9e7
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x74]
push esi
push ebx
push dword [ebp - 0x64]
call dword [0x46700c]
test eax, eax
jne 0x40c9d8
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push str.UUID
push dword [ebp - 0x78]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x70], 4
call dword [0x467040]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push 0x46b9d0
push dword [ebp - 0x78]
mov dword [ebp - 0x70], 0x208
call dword [0x467040]
push dword [ebp - 0x78]
call dword [0x467004]
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp + 0x1bc]
jne 0x40c9d8
cmp dword [ebp - 0x80], esi
je 0x40ca23
push dword [ebp - 0x80]
lea eax, [ebp - 0x60]
push eax
call fcn.0043ad71
test eax, eax
pop ecx
pop ecx
je 0x40ca23
inc dword [ebp - 0x7c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 0x7c]
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], 0x104
call edi
test eax, eax
je 0x40c956
push dword [ebp - 0x64]
call dword [0x467004]
mov word [ebx], si
xor eax, eax
mov ecx, dword [ebp + 0x1a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0x1ac
leave
ret 0x10
push dword [ebp - 0x64]
call dword [0x467004]
xor eax, eax
inc eax
jmp 0x40ca09

Function at 0x40cef0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], 0x104
mov dword [ebp - 4], 0x20019
call fcn.0040bfd2
test eax, eax
je 0x40cf18
mov dword [ebp - 4], 0x20119
lea edi, [esi + 0x20c]
xor ebx, ebx
cmp dword [edi], ebx
jne 0x40cf48
push edi
push dword [ebp - 4]
lea eax, [esi + 4]
push ebx
push eax
push dword [esi + 0x214]
call dword [0x46700c]
test eax, eax
je 0x40cf48
mov dword [edi], ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov edi, dword [edi]
cmp edi, ebx
je 0x40cf3f
push ebx
push ebx
lea eax, [esi + 0x210]
mov ecx, dword [eax]
push ebx
lea edx, [ecx + 1]
push ebx
mov dword [eax], edx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push ecx
push edi
call dword [0x467044]
test eax, eax
jne 0x40cf3f
inc eax
jmp 0x40cf41
Function at 0x40d0b3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040c5e2
mov edi, dword [0x467040]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x12cc]
push eax
push 0
push 0
push str.ComPortNumber
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x12d0
push esi
push 0
push 0
push str.UserInstalled
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40d14b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040d0b3
mov edi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x12d4]
push eax
push 0
push 0
push str.RasConnection
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x14dc
push esi
push 0
push 0
push str.Status
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call edi
pop edi
pop esi
leave
ret 4

Function at 0x40d200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.0040d0b3
mov esi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d4]
push eax
xor ebx, ebx
push ebx
push ebx
push str.UserName
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14dc]
push eax
push ebx
push ebx
push str.Password
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x16e4]
push eax
push ebx
push ebx
push str.Autoconnect
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x16e8]
push eax
push ebx
push ebx
push str.RasConnection
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x18f0
push edi
push ebx
push ebx
push str.EnableAutoReconnect
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40d35a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040c5e2
lea eax, [ebp - 4]
push eax
add esi, 0x12cc
push esi
push 0
push 0
push str.OPPType
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [0x467040]
pop esi
leave
ret 4

Function at 0x40d3be
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040c5e2
lea eax, [ebp - 4]
push eax
add esi, 0x12cc
push esi
push 0
push 0
push str.PutImageToPrinterTimeout
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [0x467040]
pop esi
leave
ret 4