joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41970b
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x20a4]
mov eax, 0x2124
call fcn.00439e90
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x20a0], eax
mov eax, dword [ebp + 0x20b4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20b0]
mov dword [ebp - 0x78], eax
movzx eax, byte [edi + 5]
push eax
movzx eax, byte [edi + 4]
push eax
movzx eax, byte [edi + 3]
mov esi, dword [ebp + 0x20ac]
push eax
movzx eax, byte [edi + 2]
push eax
movzx eax, byte [edi + 1]
push eax
movzx eax, byte [edi]
push eax
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi + 4]
push eax
movzx eax, byte [esi + 3]
mov ebx, dword [ebp + 0x20b8]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.SoftwareWIDCOMMBTConfigLinkKeys
lea eax, [ebp + 0x1e98]
push str._s_02x:_02x:_02x:_02x:_02x:_02x_02x:_02x:_02x:_02x:_02x:_02x
push eax
call fcn.0043a9d8
add esp, 0x3c
mov dword [ebp - 0x7c], 0x20006
call fcn.0040bfd2
test eax, eax
je 0x4197b2
mov dword [ebp - 0x7c], 0x20106
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
xor eax, eax
push eax
push dword [ebp - 0x7c]
push eax
push eax
push eax
lea eax, [ebp + 0x1e98]
push eax
push reloc.WS2_32.dll_bind
call dword [0x467008]
test eax, eax
jne 0x4198cc
push 0x10
push dword [ebp - 0x78]
push 3
push eax
push str.LinkKey
push dword [ebp - 0x74]
call fcn.0040bbba
add esp, 0x18
test eax, eax
je 0x419810
push dword [ebp - 0x74]
call dword [0x467004]
push edi
push esi
call fcn.004189df
pop ecx
pop ecx
jmp 0x4198cc
xor edi, edi
cmp ebx, edi
je 0x419839
cmp word [ebx], di
je 0x419839
push ebx
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 3
push edi
push str.PairedUserName
push dword [ebp - 0x74]
call dword [0x46703c]
push dword [ebp - 0x74]
call dword [0x467004]
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi + 4]
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
lea eax, [ebp + 0x1c90]
push str._02x:_02x:_02x:_02x:_02x:_02x
push eax
call fcn.0043a9d8
add esp, 0x20
lea eax, [ebp + 0x1c90]
push eax
lea ecx, [ebp - 0x70]
call fcn.00411806
lea ecx, [ebp - 0x70]
call fcn.0040c026
push 4
push dword [ebp - 0x78]
lea eax, [ebp + 0x4b1]
push eax
call fcn.00439860
add esp, 0xc
cmp ebx, edi
je 0x4198b3
lea eax, [ebp + 0x8e0]
push ebx
push eax
call fcn.0043ad55
pop ecx
pop ecx
jmp 0x4198ba
mov word [ebp + 0x8e0], di
lea ecx, [ebp - 0x70]
mov dword [ebp + 0x4c4], 1
call fcn.00418983
mov ecx, dword [ebp + 0x20a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0x20a4
leave
ret
Function at 0x41a629
Capabilities:
Create service
Modify service
Persist via windows service
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3d4]
sub esp, 0x454
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x3d0], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
xor edi, edi
mov ecx, ebx
call fcn.0041a5ec
test eax, eax
je 0x41a669
push 0x3e8
call dword [0x46732c]
inc edi
cmp edi, 5
jl 0x41a64d
cmp edi, 5
jne 0x41a676
xor eax, eax
inc eax
jmp 0x41a7a2
push 0xf003f
push esi
push esi
call dword [0x467064]
cmp eax, esi
mov dword [ebp - 0x44], eax
jne 0x41a6a3
push esi
push 0x49a450
push str.Couldnt_open_service_manager
push esi
call dword [0x4674e4]
xor eax, eax
jmp 0x41a7a2
push 0x104
lea eax, [ebp - 0x40]
push eax
push esi
call dword [0x467140]
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x40]
push eax
xor edi, edi
inc edi
push edi
push 2
push 0x10
push 0xf01ff
push str.Bluetooth_Service
mov ebx, 0x49a450
push ebx
push dword [ebp - 0x44]
call dword [0x46706c]
cmp eax, esi
mov dword [ebp - 0x48], eax
jne 0x41a6f6
push dword [ebp - 0x44]
call dword [0x46705c]
push esi
push ebx
push str.Couldnt_create_service
jmp 0x41a695
lea eax, [ebp - 0x4c]
push eax
push edi
push esi
push str.SoftwareWidcommBtConfigGeneral
push reloc.WS2_32.dll_bind
call dword [0x46700c]
test eax, eax
mov ebx, dword [0x467068]
jne 0x41a758
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x1c8]
push eax
push esi
push esi
push 0x4717a4
push dword [ebp - 0x4c]
mov dword [ebp - 0x54], 0x208
call dword [0x467040]
test eax, eax
jne 0x41a74f
lea eax, [ebp + 0x1c8]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
push edi
push dword [ebp - 0x48]
call ebx
push dword [ebp - 0x4c]
call dword [0x467004]
mov eax, 0xea60
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x68]
push eax
push 2
push dword [ebp - 0x48]
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 3
call ebx
push dword [ebp - 0x48]
mov esi, dword [0x46705c]
call esi
push dword [ebp - 0x44]
call esi
mov eax, edi
mov ecx, dword [ebp + 0x3d0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0x3d4
leave
ret
Function at 0x41a7ba
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
call fcn.0041a5ec
test eax, eax
jne 0x41a7cc
inc eax
jmp 0x41a866
push ebp
push edi
push 0xf003f
xor ebp, ebp
push ebp
push ebp
call dword [0x467064]
mov edi, eax
cmp edi, ebp
jne 0x41a7f9
push ebp
push 0x49a450
push str.Couldnt_open_service_manager
push ebp
call dword [0x4674e4]
xor eax, eax
jmp 0x41a864
push ebx
push esi
push 0x10020
mov ebx, 0x49a450
push ebx
push edi
call dword [0x467060]
mov esi, eax
cmp esi, ebp
jne 0x41a824
push edi
call dword [0x46705c]
push ebp
push ebx
push str.Couldnt_open_service
push ebp
jmp 0x41a85a
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [0x467074]
push esi
call dword [0x467070]
push esi
mov esi, dword [0x46705c]
mov ebp, eax
call esi
push edi
call esi
test ebp, ebp
je 0x41a850
xor eax, eax
inc eax
jmp 0x41a862
push 0
push ebx
push str.Service_could_not_be_deleted
push 0
call dword [0x4674e4]
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x1c
ret

Function at 0x41a86a
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push eax
call fcn.0043bd4b
xor esi, esi
add esp, 0xc
cmp dword [0x49a650], esi
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
je 0x41a8dd
push 0x49a450
push esi
call dword [0x467080]
mov edi, eax
cmp edi, esi
je 0x41a8ea
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 1
push esi
push esi
push esi
push 4
push edi
call dword [0x46707c]
push edi
call dword [0x467078]
jmp 0x41a8ea
lea eax, [ebp - 0x204]
push eax
call fcn.0043c019
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004369c2
leave
ret

Function at 0x41aad4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREWidcommInstall
push reloc.WS2_32.dll_bind
call dword [0x46700c]
test eax, eax
jne 0x41ab4e
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 0x471bf0
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call dword [0x467040]
test eax, eax
jne 0x41ab44
push esi
call fcn.0043ada3
cmp word [esi + eax*2 - 2], 0x5c
pop ecx
je 0x41ab37
push 0x46feb0
push esi
call fcn.0043ad2b
pop ecx
pop ecx
push str.btwinlog.txt
push esi
call fcn.0043ad2b
pop ecx
pop ecx
push dword [ebp - 4]
call dword [0x467004]
pop esi
leave
ret

Function at 0x41ac6b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push eax
push 2
push 0
push str.SoftwareWidcommBTConfigDebug
push reloc.WS2_32.dll_bind
call dword [0x46700c]
test eax, eax
jne 0x41acbc
and dword [ebp - 4], eax
cmp dword [ebp + 8], eax
je 0x41ac9b
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.LoggingEnabled
push dword [ebp - 8]
call dword [0x46703c]
push dword [ebp - 8]
call dword [0x467004]
leave
ret
Function at 0x41b124
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x25c]
push 0xfa
push eax
call fcn.0041b0d0
push str.Bluetooth_Device
push 0x3bf7
lea eax, [ebp - 0x68]
push 0x32
push eax
call fcn.0041b0d0
add esp, 0x20
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x260]
push eax
push 8
push dword [ebp + 0x10]
xor edi, edi
push edi
mov dword [ebp - 0x260], edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x41b1a8
mov eax, dword [ebp - 0x260]
cmp eax, edi
je 0x41b1a8
cmp dword [eax], edi
je 0x41b1a8
call dword [0x46716c]
mov dword [ebp + 0x10], eax
cmp esi, edi
jne 0x41b1b2
lea esi, [ebp - 0x264]
push 1
push esi
push edi
push dword [ebp + 0x14]
lea eax, [ebp - 0x25c]
push eax
call fcn.0043ada3
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0043ada3
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0x10]
push edi
call sub.WTSAPI32.dll_WTSSendMessageW
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004369c2
leave
ret
Function at 0x41b266
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x774]
sub esp, 0x7f4
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x770], eax
push esi
xor esi, esi
cmp dword [0x498738], 0xffffffff
jne 0x41b29a
cmp word [0x49a8a8], si
je 0x41b3d6
push edi
lea eax, [ebp + 0x780]
push eax
push dword [ebp + 0x77c]
lea eax, [ebp - 0x60]
push eax
call fcn.0043bd4b
mov edi, eax
lea eax, [ebp + 0x390]
push str.BTWDINS:
push eax
call fcn.0043b190
add esp, 0x14
push esi
push esi
push 0x3d7
lea eax, [ebp + 0x399]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x60]
push eax
push esi
push esi
call dword [0x467334]
add edi, 9
cmp dword [0x498738], 0xffffffff
mov word [ebp + 0x388], si
mov word [ebp + 0x38a], di
mov word [ebp + 0x38c], si
je 0x41b353
push 0x10
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.00436a20
add esp, 0xc
push dword [0x49a89c]
mov word [ebp - 0x70], 2
mov word [ebp - 0x6e], 0x2694
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x6c], eax
push 0x10
lea eax, [ebp - 0x70]
push eax
movzx eax, word [ebp + 0x38a]
push esi
add eax, 0x11
push eax
lea eax, [ebp + 0x388]
push eax
push dword [0x498738]
call dword [sym.imp.WS2_32.dll_sendto]
cmp word [0x49a8a8], si
je 0x41b3d5
push 0x471e18
push 0x49a8a8
call fcn.0043cad8
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x41b3d5
lea eax, [ebp - 0x80]
push eax
call dword [0x467170]
movzx eax, word [ebp - 0x72]
push eax
movzx eax, word [ebp - 0x74]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
push str._02d:_02d:_02d._03d
push edi
call fcn.0043c900
lea eax, [ebp - 0x60]
push eax
call fcn.0043ada3
add esp, 0x1c
cmp eax, esi
jle 0x41b3c2
add eax, eax
cmp word [ebp + eax - 0x62], 0xa
je 0x41b3c2
mov word [ebp + eax - 0x60], 0xa
mov word [ebp + eax - 0x5e], si
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.0043c858
push edi
call fcn.0043c7dc
add esp, 0xc
pop edi
mov ecx, dword [ebp + 0x770]
xor ecx, ebp
pop esi
call fcn.004369c2
add ebp, 0x774
leave
ret
Function at 0x41c47b
Capabilities:
Query or enumerate registry value
Set registry value
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 1
xor ebx, ebx
push ebx
push ebx
call dword [0x467064]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x30], edi
je 0x41c5d2
push esi
mov esi, dword [0x467060]
push 0x30
push str.WcesComm
push edi
call esi
push 0x30
push str.RapiMgr
push edi
mov dword [ebp - 0x28], eax
call esi
cmp dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], eax
je 0x41c5a7
cmp eax, ebx
je 0x41c5a7
mov esi, dword [0x467074]
lea eax, [ebp - 0x4c]
push eax
push 1
push dword [ebp - 0x28]
call esi
lea eax, [ebp - 0x4c]
push eax
push 1
push dword [ebp - 0x1c]
call esi
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindows_CE_Services
push reloc.WS2_32.dll_bind
call dword [0x46700c]
test eax, eax
jne 0x41c586
push 5
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
mov esi, str.Bluetooth
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
push ebx
mov esi, str.ConnectTypesAllowed
push esi
push dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 4
call dword [0x467040]
or dword [ebp - 0x20], 2
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push ebx
push esi
push dword [ebp - 0x24]
mov esi, dword [0x46703c]
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
push str.SerialPort
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x24]
call dword [0x467004]
jmp 0x41c591
push str.SetWMDevConn:_RegOpenKeyEx_Failed
call fcn.0041b266
pop ecx
mov esi, dword [0x467104]
push ebx
push ebx
push dword [ebp - 0x1c]
call esi
push ebx
push ebx
push dword [ebp - 0x28]
call esi
jmp 0x41c5ba
call dword [0x467358]
push eax
push str.SetWMDevConn:_Open_Service_Failed__d
call fcn.0041b266
pop ecx
pop ecx
push dword [ebp - 0x28]
mov esi, dword [0x46705c]
call esi
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x30]
call esi
pop esi
jmp 0x41c5e5
call dword [0x467358]
push eax
push str.SetWMDevConn:_Open_Service_Manager_Failed__d
call fcn.0041b266
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004369c2
leave
ret
Function at 0x41c5f3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
push str.CrtAdminProcInSession:_dwSessionId_d_n
mov byte [ebp - 1], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.0041b266
push dword [ebp + 0xc]
push str._ls_n
call fcn.0041b266
add esp, 0x10
lea eax, [ebp - 8]
push eax
push edi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
mov esi, dword [0x467350]
jne 0x41c654
call dword [0x467358]
push eax
push edi
push str.CrtAdminProcInSession:_WTSQueryUserToken_failed._sessionId_d_err_d_n
call fcn.0041b266
add esp, 0xc
jmp 0x41c72d
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x13
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
call dword [0x4670b8]
test eax, eax
mov ebx, dword [0x467358]
jne 0x41c689
call ebx
push eax
push edi
push str.CrtAdminProcInSession:_GetTokenInformation_failed._sessionId_d_err_d_n
call fcn.0041b266
add esp, 0xc
jmp 0x41c694
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 8]
call dword [0x4670b4]
test eax, eax
jne 0x41c6bb
call ebx
push eax
push edi
push str.CrtAdminProcInSession:_DuplicateTokenEx_failed._sessionId_d_err_d_n
jmp 0x41c647
push 0x40
lea eax, [ebp - 0x64]
push 0
push eax
mov dword [ebp - 0x68], 0x44
call fcn.00436a20
and dword [ebp - 0x24], 0
xor eax, eax
add esp, 0xc
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
xor eax, eax
push eax
push eax
push 0x10
push eax
push eax
push eax
push dword [ebp + 0xc]
push eax
push dword [ebp - 0xc]
call dword [0x467108]
test eax, eax
jne 0x41c710
call ebx
push eax
push dword [ebp + 8]
push str.CrtAdminProcInSession:_CreateProcessAsUser_failed._sessionId_d_err_d_n
jmp 0x41c647
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
push dword [ebp + 8]
push str.CrtAdminProcInSession:_CreateProcessAsUser_succeeded._sessionId_d_n
call fcn.0041b266
pop ecx
pop ecx
mov byte [ebp - 1], 1
cmp dword [ebp - 0xc], 0
je 0x41c738
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 8], 0
je 0x41c743
push dword [ebp - 8]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ceda
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1c0]
sub esp, 0x240
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x1bc], eax
push ebx
push esi
mov esi, dword [ebp + 0x1d0]
xor ebx, ebx
push 0x38
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], ebx
call fcn.00436a20
push esi
push dword [ebp + 0x1cc]
push dword [ebp + 0x1c8]
push str.SetNetMtu:_dwIpVer_d_dwMtu_d_wcsConnName_ls_n
call fcn.0041b266
push dword [ebp + 0x1cc]
lea eax, [ebp - 0x44]
push esi
push dword [ebp + 0x1c8]
mov dword [ebp - 0x80], 0x3c
push str.interface_ipv_d_set_subinterface___ls__mtu_d_storepersistent
push 0x100
push eax
mov dword [ebp - 0x7c], 0x40
mov dword [ebp - 0x70], str.netsh.exe
mov dword [ebp - 0x6c], eax
call fcn.0043aa88
add esp, 0x34
lea eax, [ebp - 0x80]
push eax
call dword [0x4673f0]
test eax, eax
jne 0x41cf82
call dword [0x467358]
push eax
push str._SetNetMtu:_ShellExecuteEx_failed._err_d_n
call fcn.0041b266
pop ecx
jmp 0x41cf91
cmp dword [ebp - 0x48], ebx
jne 0x41cf94
push str._SetNetMtu:_NULL_process_handle_n
call fcn.0041b266
pop ecx
jmp 0x41cfd5
push 0x4e20
push dword [ebp - 0x48]
call dword [0x467340]
mov esi, eax
cmp esi, ebx
je 0x41cfbf
call dword [0x467358]
push eax
push esi
push str._SetNetMtu:_WaitForSingleObject_returned__d._err_d_n
call fcn.0041b266
add esp, 0xc
jmp 0x41cfcc
push str.SetNetMtu:_succeeded_n
mov bl, 1
call fcn.0041b266
pop ecx
push dword [ebp - 0x48]
call dword [0x467350]
mov ecx, dword [ebp + 0x1bc]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0x1c0
leave
ret
Function at 0x41d42e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [0x467040]
test eax, eax
jne 0x41d496
cmp dword [ebp + 0x10], 1
je 0x41d46f
cmp dword [ebp + 0x10], 2
je 0x41d46f
push 0xd
pop eax
jmp 0x41d496
test edi, edi
mov eax, dword [ebp - 4]
je 0x41d490
test eax, eax
je 0x41d48c
test al, 1
jne 0x41d46a
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x41d490
jmp 0x41d46a
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x41df85
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x3f0]
sub esp, 0x470
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x3ec], eax
push ebx
mov ebx, dword [ebp + 0x3fc]
push esi
push edi
mov edi, dword [ebp + 0x3f8]
xor esi, esi
cmp edi, esi
je 0x41dfbb
mov dword [edi], 1
push 0x40e
lea eax, [ebp - 0x22]
push esi
push eax
mov word [ebp - 0x24], 0x5c
call fcn.00436a20
add esp, 0xc
push esi
push 0x26
lea eax, [ebp - 0x24]
push eax
push esi
call dword [0x4673e8]
lea eax, [ebp - 0x24]
push str.WIDCOMMBluetooth_Software_
push eax
call fcn.0043ad2b
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.0043ad2b
lea eax, [ebp - 0x24]
push eax
push str.ExecuteTraceLogCmd____cmd:__s_n
call fcn.0041b266
push 0x10
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x2c], esi
call fcn.00436a20
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00436a20
add esp, 0x30
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
push esi
mov dword [ebp - 0x80], ebx
call dword [0x46717c]
test eax, eax
jne 0x41e074
call dword [0x467358]
push eax
push str.ExecuteTraceLogCmd____CreateProcess___failed:__d_n
call fcn.0041b266
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x3ec]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0x3f0
leave
ret
cmp edi, esi
jne 0x41e08f
xor edi, edi
inc edi
push dword [ebp - 0x3c]
mov esi, dword [0x467350]
call esi
push dword [ebp - 0x38]
call esi
mov eax, edi
jmp 0x41e05c
mov ebx, 0xbb8
push ebx
push dword [ebp - 0x3c]
call dword [0x467340]
mov dword [ebp - 0x28], esi
push edi
push dword [ebp - 0x3c]
call dword [0x467188]
test eax, eax
jne 0x41e0ce
call dword [0x467358]
cmp eax, 0x103
jne 0x41e0d8
push 0x64
call dword [0x46732c]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x41e0a1
jmp 0x41e0d8
xor eax, eax
cmp dword [edi], esi
sete al
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x2c]
jmp 0x41e07b
Function at 0x41e6ea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x328], eax
push str.Bluetooth_Service::Control_Install__d_WIA_n
call fcn.0041b266
pop ecx
pop ecx
lea eax, [ebp - 0x320]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareWidcommBtConfig
push reloc.WS2_32.dll_bind
call dword [0x4670bc]
test eax, eax
je 0x41e746
push str.Bluetooth_Service::WIA_is_not_prepared_n
call fcn.0041b266
pop ecx
jmp 0x41e8c9
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push str.WIALocationInfo
push dword [ebp - 0x320]
mov dword [ebp - 0x324], 0x104
call dword [0x467050]
test eax, eax
je 0x41e791
push str.Bluetooth_Service::LocationInfo_is_not_prepared_n
call fcn.0041b266
pop ecx
push dword [ebp - 0x320]
call dword [0x467004]
jmp 0x41e8c9
push edi
xor eax, eax
mov byte [ebp - 0x10], 0
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xb]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0xf]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push str._x:_x:_x:_x:_x:_x
push eax
call fcn.0043c6e9
add esp, 0x20
cmp dword [ebp + 0xc], esi
je 0x41e81a
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x31c]
push eax
push esi
push esi
push str.WIAName
push dword [ebp - 0x320]
mov dword [ebp - 0x324], 0x208
call dword [0x467040]
test eax, eax
je 0x41e81a
push str.Bluetooth_Service::LocationInfo_is_not_prepared_n
call fcn.0041b266
pop ecx
push dword [ebp - 0x320]
call dword [0x467004]
jmp 0x41e8c8
push ebx
push dword [ebp - 0x320]
call dword [0x467004]
push 0x46ff1c
call dword [0x46712c]
mov ebx, eax
cmp ebx, esi
jne 0x41e83f
push str.Bluetooth_Service::BT2K_INS_does_not_exist_n
jmp 0x41e8ad
mov esi, dword [0x467118]
push str.BT2K_InstallBTWIA
push ebx
call esi
push str.BT2K_RemoveBTWIA
push ebx
mov edi, eax
call esi
test edi, edi
je 0x41e8b5
test eax, eax
je 0x41e8b5
cmp dword [ebp + 0xc], 0
je 0x41e87d
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x328]
call edi
add esp, 0xc
jmp 0x41e887
lea ecx, [ebp - 0x10]
push 1
push ecx
call eax
pop ecx
pop ecx
push ebx
mov esi, eax
call dword [0x467128]
test esi, esi
jne 0x41e8a8
call dword [0x467358]
push eax
push str.Bluetooth_Service::installation_failed_0x_x_n
call fcn.0041b266
pop ecx
jmp 0x41e8b2
push str.Bluetooth_Service::installation_done_n
call fcn.0041b266
pop ecx
jmp 0x41e8c7
push str.Bluetooth_Service::BT2K_INS_bad_n
call fcn.0041b266
pop ecx
push ebx
call dword [0x467128]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004369c2
leave
ret