joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402370
Capabilities:
Find taskbar

Disassembly:
sub esp, 0xb0
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_FindWindowW]
push edi
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x9c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x40], eax
push ebx
mov dword [esp + 0x48], eax
push str.Shell_TrayWnd
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], eax
mov dword [esp + 0xa0], 0x24
call ebp
lea ecx, [esp + 0x98]
push ecx
push 5
mov dword [esp + 0xa4], eax
call fcn.00401ce0
add esp, 8
lea edx, [esp + 0xa8]
lea eax, [esp + 0xc0]
lea ecx, [esp + 0x3c]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
jne 0x402592
lea edx, [esp + 0x38]
push edx
call fcn.00401de0
add esp, 4
test eax, eax
je 0x402592
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x74]
mov dword [esp + 0x70], ebx
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0xc4]
push 2
push eax
call fcn.00401d60
add esp, 8
mov edi, eax
push ebx
push str.Shell_TrayWnd
call ebp
lea ecx, [esp + 0x74]
mov esi, eax
push ecx
push edi
mov dword [esp + 0x7c], 0x28
call fcn.00401d20
add esp, 8
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x54]
lea edx, [esp + 0x14]
mov dword [esp + 0x50], ebx
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push esi
call fcn.00401fb0
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4024c2
push ebx
push str.Shell_TrayWnd
mov dword [esp + 0x58], 0x24
call ebp
mov dword [esp + 0x54], eax
lea eax, [esp + 0x50]
push eax
push 4
call fcn.00401ce0
lea ecx, [esp + 0x58]
mov dword [esp + 0x18], eax
push ecx
push 0xa
mov dword [esp + 0x80], ebx
call fcn.00401ce0
add esp, 0x10
lea edx, [esp + 0x2c]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x80]
mov ebp, dword [esp + 0x84]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
sub eax, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebp
je 0x402538
dec eax
je 0x402526
dec eax
je 0x402514
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
sub ebp, ecx
add ebp, eax
mov dword [esp + 0x20], ebp
jmp 0x402548
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
sub esi, ecx
add esi, eax
mov dword [esp + 0x1c], esi
jmp 0x402548
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
sub edx, ecx
add edx, eax
mov dword [esp + 0x28], edx
jmp 0x402548
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
sub ecx, edx
add ecx, eax
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x1c]
push eax
call fcn.00402190
add esp, 4
cmp edi, ebx
pop esi
je 0x402581
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
lea ecx, [esp + 0x4c]
mov eax, dword [esp + 0xc]
push ecx
push 0xa
mov dword [esp + 0x74], eax
call fcn.00401ce0
add esp, 8
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xb0
ret 0x10
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb0
ret 0x10
Function at 0x4031c0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4031ea
pop ecx
ret
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4031f4
mov dword [ecx], eax
mov edx, dword [esp + 0x14]
test edx, edx
je 0x403204
push esi
mov esi, dword [esp + 4]
mov dword [edx], esi
pop esi
test ecx, ecx
jne 0x40320f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
Function at 0x403f90
Capabilities:
Impersonate user

Disassembly:
sub esp, 0x588
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x19a]
mov word [esp + 0x198], bx
mov byte [esp + 0x94], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x95]
mov dword [esp + 0x30], ebx
rep stosd dword es:[edi], eax
mov ecx, 7
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x54]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x14], ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
call fcn.00403220
mov ebp, eax
cmp ebp, ebx
je 0x4041ab
push str.NvCplGetUserTokenAndName
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x404193
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
lea ecx, [esp + 0x14]
push edx
push ecx
call eax
add esp, 0xc
cmp eax, 1
jne 0x404193
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x94]
push edx
lea ecx, [esp + 0x19c]
push eax
push ecx
call fcn.0040f427
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x30]
lea edx, [esp + 0x198]
push eax
push ecx
mov dword [esp + 0x38], 0x20
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], 1
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x404193
mov edx, dword [esp + 0x4c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
push edx
push 0x80000001
call edi
test eax, eax
jne 0x40416b
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0xc
push edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x64], 0x44
mov dword [esp + 0x6c], str.winsta0default
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [0x4254d4]
cmp eax, ebx
je 0x404113
call eax
cmp dword [esp + 0x18], eax
jne 0x4040fd
call dword [0x4254d4]
cmp eax, 0xffffffff
jne 0x404113
push ebp
call fcn.00403240
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x588
ret
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x59c]
lea ecx, [esp + 0x50]
push eax
mov eax, dword [esp + 0x14]
push ecx
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push edx
push ebx
push eax
call fcn.00401000
test eax, eax
je 0x40415c
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
push ebx
push 0x80000001
call edi
mov esi, 1
jmp 0x40416d
xor esi, esi
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push ebp
call fcn.00403240
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x588
ret
push ebp
xor esi, esi
call fcn.00403240
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x588
ret
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x588
ret
Function at 0x4043a0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x404440
push ebp
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, 0x28
push 0
push 0
push 0
push 0
push 0
push str._SystemRoot__system32_nvsvc32.exe
push 1
push 2
push 0x110
push 0xf01ff
push str.NVIDIA_Driver_Helper_Service
push str.NVSvc
push ebx
dec esi
call edi
test eax, eax
jne 0x404429
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 0x430
jne 0x404432
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x4043d0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
push eax
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
mov eax, 0x427
pop ebx
ret

Function at 0x404450
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x24
push ebx
push edi
xor edi, edi
push 0xf003f
push edi
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0xc], ebx
je 0x404559
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xf01ff
push str.NVSvc
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, edi
je 0x404532
lea eax, [esp + 0x14]
push ebp
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x4044ed
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, 0x64
mov eax, dword [esp + 0x1c]
dec ebx
cmp eax, 1
je 0x4044e2
push 0x64
call edi
lea ecx, [esp + 0x18]
push ecx
push esi
call ebp
test eax, eax
je 0x4044db
test ebx, ebx
jne 0x4044bd
cmp dword [esp + 0x1c], 1
jne 0x4044e9
push 0x3e8
call edi
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
pop ebp
jne 0x404519
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
mov dword [esp + 0xc], eax
jne 0x404519
push 0x3e8
call edi
mov dword [esp + 0xc], 0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop esi
pop edi
pop ebx
add esp, 0x24
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
mov dword [esp + 0xc], eax
jne 0x404547
mov dword [esp + 0xc], edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop esi
pop edi
pop ebx
add esp, 0x24
ret
pop edi
mov eax, 0x427
pop ebx
add esp, 0x24
ret
Function at 0x404b00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
mov dword [esp + 8], 0x100
push eax
push 1
push 0
push 0x41d378
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop edi
je 0x404b5f
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x208
ret
mov eax, dword [esp]
test eax, eax
jne 0x404b6e
add esp, 0x208
ret
lea edx, [esp + 4]
lea ecx, [esp + 8]
push edx
push ecx
push 0
push 0
push str.LoadLimitedSID
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x404ba0
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x208
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x20c]
lea ecx, [esp + 8]
push ecx
push edx
call fcn.0040f5ae
add esp, 8
mov eax, 1
add esp, 0x208
ret

Function at 0x404bd0
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf003f
push 0
push 0x41d378
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404c08
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
test eax, eax
jne 0x404c12
pop ecx
ret
push str.LoadLimitedSID
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x404c31
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x404c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp], 0
push eax
push 1
push 0
push 0x41d3f0
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404c86
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp]
test eax, eax
jne 0x404c92
add esp, 0xc
ret
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
push edx
push 0
push 0
push str.EnableThermalHistory
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x404cc1
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0xc
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0xc
ret

Function at 0x404ce0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
push esi
lea eax, [esp + 0x10]
push str.GPU_1d
push eax
call fcn.0040f5d3
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push edi
call ebx
inc esi
cmp esi, 8
jb 0x404cf2
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x404d20
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x41d3f0
push 0x80000002
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
call esi
test eax, eax
je 0x404d6d
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 4]
test eax, eax
jne 0x404d7c
xor eax, eax
pop esi
add esp, 0xc
ret
lea ecx, [esp + 8]
push 0
push ecx
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWARENVIDIA_CorporationGlobalNvSvcThermalHistory
push 0x80000002
call esi
test eax, eax
je 0x404db2
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 8]
test eax, eax
jne 0x404dcc
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 4]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.EnableThermalHistory
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x404e06
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call esi
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 8]
push edx
call fcn.00404ce0
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call esi
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x404ed0
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf003f
push 0
push 0x41d3f0
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404ec2
mov eax, dword [esp]
test eax, eax
je 0x404ec2
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.EnableThermalHistory
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x404ea7
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWARENVIDIA_CorporationGlobalNvSvcThermalHistory
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
add esp, 8
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x404edd
jmp fcn.00404d20
jmp 0x404e40
Function at 0x405220
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x71c
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
xor ebp, ebp
push eax
push 3
push ebp
push str.SOFTWARENVIDIA_CorporationGlobalNvSvcThermalHistory
push 0x80000002
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40525d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x71c
ret
cmp dword [esp + 0x10], ebp
jne 0x405270
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x71c
ret
cmp dword [esp + 0x730], ebp
jbe 0x40534d
mov ecx, dword [esp + 0x734]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea esi, [ecx + 4]
test byte [esi + 0x1c], 0x10
je 0x40533a
push ebp
lea edx, [esp + 0x1c]
push str.GPU_1d
push edx
call fcn.0040f5d3
mov ecx, 0x1c2
xor eax, eax
lea edi, [esp + 0x30]
mov edx, dword [esp + 0x1c]
add esp, 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push 0
push 0
push 0
push ecx
push edx
call ebx
test eax, eax
jne 0x405313
mov eax, dword [esp + 0x14]
cmp eax, 0x708
ja 0x405263
lea edx, [esp + 0x72c]
lea ecx, [esp + 0x14]
sub edx, eax
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x24]
push 0
push eax
push ecx
call ebx
lea edx, [esp + 0x25]
push 0x707
lea eax, [esp + 0x28]
push edx
push eax
call fcn.0040f650
add esp, 0xc
mov cl, byte [esi]
lea edx, [esp + 0x24]
push 0x708
push edx
mov byte [esp + 0x733], cl
mov ecx, dword [esp + 0x18]
push 3
lea eax, [esp + 0x24]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x730]
inc ebp
add esi, 0x24
cmp ebp, eax
jb 0x40528d
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x71c
ret

Function at 0x405370
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x120
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
sub eax, dword [0x425588]
cmp eax, 0x7d0
jb 0x4053d3
mov esi, dword [esp + 0x130]
xor eax, eax
cmp esi, 8
ja 0x4053d8
push edi
mov ecx, 0x48
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00405170
add esp, 8
test eax, eax
pop edi
je 0x4053d3
lea ecx, [esp + 8]
push ecx
push esi
call fcn.00405220
add esp, 8
test eax, eax
je 0x4053d3
call ebx
mov dword [0x425588], eax
mov eax, 1
pop esi
pop ebx
add esp, 0x120
ret
Function at 0x4056e0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x100c
call fcn.0040f990
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x81a]
mov word [esp + 0x818], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x101c]
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
call fcn.0040f5ae
lea edx, [esp + 0x20]
push 0x4201a8
push edx
call fcn.0040f584
mov eax, dword [esp + 0x1030]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.0040f584
add esp, 0x18
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
je 0x405797
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x100c
ret
mov esi, dword [esp + 0x1024]
mov edx, dword [esp + 0xc]
push esi
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov edi, eax
mov eax, dword [esp + 0xc]
cmp edi, ebx
je 0x4057c9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x100c
ret
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ebx
lea edx, [esp + 0x28]
push ecx
push edx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40583a
cmp dword [esp + 0x10], ebx
jbe 0x40583a
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov eax, dword [esp + 0x10]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x20]
push ebx
lea edx, [esp + 0x828]
push ecx
mov ecx, dword [esp + 0x20]
dec eax
push edx
push eax
push ecx
mov dword [esp + 0x34], 0x800
call edi
lea edx, [esp + 0x818]
push esi
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.004056e0
mov eax, dword [esp + 0x1c]
add esp, 0xc
dec eax
mov dword [esp + 0x10], eax
jne 0x4057f3
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x100c
ret
Function at 0x405950
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x60
push esi
push edi
mov ecx, 0x15
mov esi, str.SOFTWARENVIDIA_CorporationGlobalNVTweak
lea edi, [esp + 0x10]
mov eax, dword [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [eax], 0xffffffff
mov ecx, dword [0x4298bc]
pop edi
cmp ecx, 1
mov dword [esp + 4], 0
mov dword [esp + 8], 4
pop esi
je 0x4059ed
push eax
mov eax, dword [0x4254b0]
push 0x207
push 0x95510933
push eax
call fcn.00404990
add esp, 0x10
lea ecx, [esp]
lea edx, [esp + 8]
push ecx
push 1
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp]
test eax, eax
je 0x4059ed
mov edx, dword [esp + 0x68]
lea ecx, [esp + 4]
push ecx
push edx
push 0
push 0
push str.ChangeBrightnessWithScreenSaver
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x60
ret
Function at 0x405ef0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
push edi
mov ecx, 0x18
mov esi, str.SOFTWARENVIDIA_CorporationGlobalNVTweakState
lea edi, [esp + 0xac]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x15
mov esi, str.SOFTWARENVIDIA_CorporationGlobalNVTweak
lea edi, [esp + 0x54]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xc
lea edi, [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xac]
push eax
push 1
push ebx
push ecx
push 0x80000002
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0x30
mov dword [esp + 0x30], 8
call esi
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x405fae
lea edx, [esp + 0x14]
lea ecx, [esp + 0x24]
push edx
push ecx
push ebx
push ebx
push str.SmartDimmerAPI
push eax
call edi
test eax, eax
jne 0x405fa7
mov eax, dword [esp + 0x2c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [0x420930], edx
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x10]
lea edx, [esp + 0x54]
push ecx
push 1
push ebx
push edx
push 0x80000002
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
call esi
mov eax, dword [esp + 0x10]
mov dword [0x425578], ebx
cmp eax, ebx
je 0x40600b
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push ebx
push str.SmartDimmerConfig
push eax
call edi
test eax, eax
jne 0x406004
mov eax, dword [esp + 0x18]
not eax
shr eax, 1
and eax, 1
mov dword [0x425578], eax
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0x1c]
mov dword [0x420938], edx
push ecx
mov dword [0x420934], eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
neg eax
sbb eax, eax
neg eax
mov dword [0x425574], eax
call fcn.00408550
push str.NVSmartDimmerEvent
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, ebx
je 0x406061
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret