joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ec0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x206
lea ecx, [ebp - 0x20a]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], 8
mov word [ebp - 0x20c], ax
call fcn.0041d650
add esp, 0xc
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea edx, [ebp - 0x210]
push edx
push edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x408f3d
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
cmp eax, edi
jne 0x408f59
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
push ebx
mov dword [ebp - 0x21c], edi
cmp eax, edi
jbe 0x409022
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041d650
add esp, 0xc
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x20c]
push edx
push 0
push esi
mov dword [ebp - 0x218], 0x104
call ebx
test eax, eax
jne 0x409035
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x20c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409035
mov edx, dword [ebp - 0x214]
push edx
call fcn.00408ec0
mov edi, eax
mov eax, dword [ebp - 0x214]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x409009
push edi
push 0x300
lea ecx, [ebp - 0x20c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp eax, dword [ebp - 0x210]
jb 0x408f70
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
or eax, 0xffffffff
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x409050
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
push 0x206
lea ecx, [ebp - 0x20a]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x41c], 8
mov word [ebp - 0x20c], ax
call fcn.0041d650
add esp, 0xc
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea edx, [ebp - 0x424]
push edx
push edi
push edi
push edi
push esi
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4090ce
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x424]
cmp eax, edi
je 0x40928c
mov dword [ebp - 0x420], edi
jbe 0x40928c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041d650
mov eax, dword [ebp - 0x420]
add esp, 0xc
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x20c]
push edx
push eax
push esi
mov dword [ebp - 0x41c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x409272
lea ecx, [ebp - 0x418]
push ecx
push 0xf003f
push edi
lea edx, [ebp - 0x20c]
push edx
push esi
call ebx
test eax, eax
jne 0x409272
push 0x206
lea ecx, [ebp - 0x412]
push edi
push ecx
mov word [ebp - 0x414], ax
call fcn.0041d650
mov eax, dword [ebp - 0x418]
add esp, 0xc
lea edx, [ebp - 0x430]
push edx
push 0xf003f
push edi
push str.Command
push eax
call ebx
test eax, eax
jne 0x409232
mov eax, dword [ebp - 0x430]
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x414]
push edx
push edi
push edi
push edi
push eax
mov dword [ebp - 0x41c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409225
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x414]
call fcn.00409c80
mov ecx, dword [ebp - 0x428]
cmp dword [ecx - 0xc], edi
jl 0x409209
push str.Win7UI
push ecx
call fcn.00415ac5
mov ecx, dword [ebp - 0x428]
add esp, 8
cmp eax, edi
je 0x409209
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x409209
mov dword [ebp - 0x42c], 1
lea eax, [ecx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409225
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x42c], edi
je 0x409249
mov edx, dword [ebp - 0x418]
push edx
call fcn.00408ec0
add esp, 4
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x42c], edi
je 0x409272
push edi
push 0x300
lea ecx, [ebp - 0x20c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp eax, dword [ebp - 0x424]
jb 0x4090f0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x40a290
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42535b
mov eax, dword fs:[0]
push eax
mov eax, 0x10234
call fcn.00421620
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edi, edx
mov dword [ebp - 0x10240], esi
mov dword [ebp - 0x1023c], edi
cmp eax, ecx
je 0x40a30b
mov edx, dword [ebp - 0x10240]
push edx
push ecx
call fcn.0040c7d0
mov edi, dword [esi + 4]
add esp, 8
mov dword [ebp - 0x10238], eax
call fcn.0040b980
mov eax, dword [ebp - 0x10238]
mov edi, dword [ebp - 0x1023c]
mov dword [esi + 4], eax
xor ecx, ecx
push 0xfffc
push ecx
lea edx, [ebp - 0x10216]
push edx
mov word [ebp - 0x10218], cx
call fcn.0041d650
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.0041d650
mov eax, 8
add esp, 0x18
lea edx, [ebp - 0x10218]
mov dword [ebp - 0x10238], edx
cmp dword [ebx + 0x14], eax
jb 0x40a35c
mov ebx, dword [ebx]
cmp dword [edi + 0x14], eax
jb 0x40a365
mov eax, dword [edi]
jmp 0x40a367
mov eax, edi
push ebx
push 0x7fff
lea ecx, [ebp - 0x10218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x1023c], eax
cmp eax, edi
jbe 0x40a461
nop
mov edx, dword [ebp - 0x10238]
cmp word [edx], di
jne 0x40a440
mov ax, word [ebp + ebx*2 - 0x10218]
mov word [ebp + esi*2 - 0x218], ax
xor ecx, ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x10220], 7
mov dword [ebp - 0x10224], edi
mov word [ebp - 0x10234], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a3d1
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x10234]
call fcn.0040b550
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0x10240]
mov ecx, esi
call fcn.0040b060
or esi, 0xffffffff
mov dword [ebp - 4], esi
cmp dword [ebp - 0x10220], 8
jb 0x40a420
mov edx, dword [ebp - 0x10234]
push edx
call fcn.00416027
add esp, 4
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0041d650
mov eax, dword [ebp - 0x1023c]
add esp, 0xc
xor edi, edi
jmp 0x40a450
mov cx, word [ebp + ebx*2 - 0x10218]
mov word [ebp + esi*2 - 0x218], cx
add dword [ebp - 0x10238], 2
inc ebx
inc esi
cmp ebx, eax
jb 0x40a390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x40a600
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4252db
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov eax, dword [edi]
mov ebx, ecx
mov ecx, dword [edi + 4]
mov dword [ebp - 0x44c], edi
cmp eax, ecx
je 0x40a664
mov edx, dword [ebp - 0x450]
push edx
push ecx
call fcn.0040c7d0
mov edi, dword [edi + 4]
add esp, 8
mov esi, eax
call fcn.0040b980
mov eax, dword [ebp - 0x44c]
mov dword [eax + 4], esi
push 0x206
xor edi, edi
lea edx, [ebp - 0x216]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x218], cx
call fcn.0041d650
add esp, 0xc
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x454], 0x104
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x448], edi
jb 0x40a6a2
mov ebx, dword [ebx]
lea eax, [ebp - 0x448]
push eax
push 0x20019
push edi
push ebx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a85c
lea ecx, [ebp - 0x464]
push ecx
lea edx, [ebp - 0x468]
push edx
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x470]
push ecx
lea edx, [ebp - 0x478]
push edx
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x440]
push edx
mov edx, dword [ebp - 0x448]
push edi
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x218]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x440]
cmp eax, edi
je 0x40a85c
mov dword [ebp - 0x444], edi
jbe 0x40a85c
jmp 0x40a735
xor edi, edi
lea eax, [ebp - 0x464]
push eax
mov eax, dword [ebp - 0x444]
push edi
push edi
push edi
lea ecx, [ebp - 0x458]
push ecx
mov ecx, dword [ebp - 0x448]
lea edx, [ebp - 0x420]
push edx
push eax
push ecx
mov dword [ebp - 0x458], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
jne 0x40a85c
xor edx, edx
lea eax, [ebp - 0x420]
mov word [ebp - 0x43c], dx
mov dword [ebp - 0x428], 7
mov dword [ebp - 0x42c], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a795
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x43c]
call fcn.0040b550
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x428]
mov edx, dword [ebp - 0x43c]
mov esi, edx
cmp eax, 8
jae 0x40a802
lea esi, [ebp - 0x43c]
mov ecx, esi
mov edi, dword [ebp - 0x42c]
cmp eax, 8
lea ecx, [ecx + edi*2]
mov eax, edx
jae 0x40a7ea
lea eax, [ebp - 0x43c]
cmp eax, ecx
je 0x40a806
lea edx, [ebp - 0x450]
push esi
push edx
mov ebx, ecx
call fcn.0040c6a0
add esp, 8
jmp 0x40a80c
mov ecx, edx
jmp 0x40a7d4
mov dword [ebp - 0x450], esi
lea esi, [ebp - 0x43c]
call fcn.0040a160
mov edi, dword [ebp - 0x44c]
mov ecx, esi
call fcn.0040b060
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x428], 8
jb 0x40a843
mov eax, dword [ebp - 0x43c]
push eax
call fcn.00416027
add esp, 4
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp eax, dword [ebp - 0x440]
jb 0x40a733
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x40c120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push es
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040be39
fisttp dword [eax]
test dword [ebx + 0x50c0458d], 0xfffcc5e8
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.0040bdfe
add esp, 0x10
adc byte [ecx - 0x877b], cl
invalid
call fcn.0040be39
jo 0x40c1ea
sbb bh, ch
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040be49
push eax
push esi
push dword [ebp + 8]
call fcn.0040bdfe
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040be49
push eax
push esi
push dword [ebp + 8]
call fcn.0040bdfe
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040be49
push eax
push esi
push dword [ebp + 8]
call fcn.0040bdfe
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040be39
out 0xb0, eax
invalid
or al, ch
push cs
cld
invalid
Function at 0x40c6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040be49
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040bdfe
add esp, 0xc
invalid
invalid
invalid

Function at 0x40e740
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40e7bc
lea ecx, [ebp - 0x20]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40e782
mov edx, dword [ebp - 0x18]
push edx
jmp 0x40e7b6
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80010002
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret

Function at 0x40ec10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
sub esp, 8
mov eax, 0x1002
mov edx, 2
mul edx
seto cl
push esi
neg ecx
or ecx, eax
push ecx
call fcn.00416e13
mov esi, eax
add esp, 4
test esi, esi
jne 0x40ec40
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push eax
mov dword [ebp - 4], 0x2000
call ebx
test eax, eax
je 0x40ecc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40ecda
cmp dword [ebp - 8], 7
jne 0x40ecda
mov edi, dword [ebp - 4]
push esi
call fcn.00416027
mov eax, edi
shr eax, 1
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00416e13
mov esi, eax
add esp, 8
test esi, esi
je 0x40ece7
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push eax
call ebx
test eax, eax
jne 0x40ec68
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
push esi
mov dword [esi + eax*2], ecx
call fcn.0040e8c0
add esp, 4
test eax, eax
jne 0x40ece9
test esi, esi
je 0x40ece7
push esi
call fcn.00416027
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4113e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
push str.Enter_EnumerateHostController___n
lea ecx, [esi + 2]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00415320
add esp, 4
push str.Enter_EnumerateHostController___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
lea eax, [ebp - 0x14]
push eax
push 6
lea ecx, [ebp - 0xc]
push ecx
push esi
push esi
push 0x220408
push edi
call ebx
test eax, eax
jne 0x411455
push str.Enter_if___DeviceIoControl_sizeof_rootHubName___nBytes__NULL___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 0x14], eax
call fcn.004158a5
add esp, 4
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x411489
push str.Enter_if__rootHubNameW__NULL__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
push 0
lea edx, [ebp - 0x14]
push edx
push ecx
push eax
push 0
push 0
push 0x220408
push edi
call ebx
test eax, eax
jne 0x4114b4
push str.Enter_if___DeviceIoControl_nBytes__nBytes__NULL___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 0x10], esi
jmp 0x411521
mov edi, dword [ebp - 0x18]
add edi, 4
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4114c0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 0xa]
push edx
call fcn.004158a5
mov esi, eax
add esp, 4
test esi, esi
je 0x411521
push str.._
push 5
push esi
call fcn.00415b9a
mov eax, edi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4114f7
sub eax, edx
sar eax, 1
inc eax
push edi
push eax
lea eax, [esi + 8]
push eax
call fcn.00415b9a
add esp, 0xc
push esi
call fcn.00410ec0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0041586b
add esp, 4
test esi, esi
je 0x41153a
push esi
call fcn.0041586b
add esp, 4
push str.Leave_EnumerateHostController___n
mov ecx, 2
call fcn.00415320
add esp, 4
push str.Leave_EnumerateHostController___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x411980
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 0
push 0
push 0
push 0
push str.ForceHCResetOnResume
push ebx
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 4
call esi
xor ecx, ecx
cmp eax, 2
sete cl
push str.Start_to_write_reg_key___2_
mov edi, ecx
mov ecx, 4
call fcn.00415320
add esp, 4
lea edx, [ebp - 4]
push edx
push 0x2001f
push 0
push str.SOFTWAREATHEROSVistaAddOn
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411a6e
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push str.ResetKeyAddded
push edx
call esi
push str.Start_to_write_reg_key___3_
mov ecx, 4
call fcn.00415320
mov ecx, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.ResetKeyAddded
push ecx
mov dword [ebp - 8], 1
call esi
test edi, edi
je 0x411a5c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
push 0x104
push edx
push 1
push 0
push str.ForceResetKey
push eax
call esi
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push str.ForceHCResetOnResume
push ebx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], 4
test esi, esi
jne 0x41236f
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SOFTWAREATHEROSVistaAddOn
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4123db
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push eax
push eax
mov eax, dword [ebp - 8]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4123ca
mov ecx, dword [ebp - 4]
push esi
push ecx
push str.Read__d_from_reg__s__n
lea ecx, [eax + 2]
call fcn.00415320
mov edx, dword [ebp - 8]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push edx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4123f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push str.ControllerIndex
push eax
push str.Set_value__d_into_reg__s__n
mov ecx, 2
call fcn.00415320
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push str.SOFTWAREAtherosVistaAddOn
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41244d
push 4
lea edx, [ebp + 8]
push edx
push 4
push eax
mov eax, dword [ebp - 4]
push str.ControllerIndex
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret