joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aed0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov ebx, ecx
push edi
push ebx
push str._In_CAeMaintenanceMode::MaintenanceModeInitialize:_i_nState:__d
mov ecx, 0x93c690
mov esi, edx
call fcn.004015d0
add esp, 8
push ebx
push esi
call fcn.0041b000
cmp ebx, 1
jne 0x41af34
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAeFilterUpdateRegFile
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41af34
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x41af36
xor eax, eax
push eax
call fcn.0041b310
cmp ebx, 2
jne 0x41af9e
push esi
call fcn.0041cbc0
test eax, eax
je 0x41af6a
imul eax, eax, 0xea60
push 0x41d300
push eax
push 0
push 0
mov dword [0x539950], esi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x2c], eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0
call fcn.0041d860
test eax, eax
je 0x41afbc
mov edi, dword [esp + 0xc]
test edi, edi
je 0x41af93
add esi, 0x34
push esi
mov ecx, edi
call fcn.0041cfc0
push edi
call fcn.004d632b
add esp, 4
jmp 0x41afbc
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeInfoStartDateTime
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SYSTEMCurrentControlSetServicesAeFilterUpdateRegFile
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str._Out_CAeMaintenanceMode::MaintenanceModeInitialize
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x901c
call fcn.004ea5a0
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str._In_CAeMaintenanceMode::MaintenanceModeInitializeHelper
mov ecx, 0x93c690
mov dword [ebp - 0x901c], eax
call fcn.004015d0
add esp, 4
cmp dword [ebp + 0xc], 2
je 0x41b050
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 8
push str._CAeMaintenanceMode::MaintenanceModeInitializeHelper:_RegOpenKeyEx
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
lea ecx, [ebp - 0x900c]
push ecx
push 0x20019
xor esi, esi
push esi
push str.SYSTEMCurrentControlSetServicesAeFilterUpdateRegFile
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x900c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b03b
mov dword [ebp - 0x9014], esi
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x1fff
lea edi, [ebp - 0x8008]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [ebp - 0x9014]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x400
lea edi, [ebp - 0x9008]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9010]
push eax
lea ecx, [ebp - 0x9008]
push ecx
mov ecx, dword [ebp - 0x900c]
push 0
push 0
lea edx, [ebp - 0x9018]
push edx
lea eax, [ebp - 0x8008]
push eax
push esi
push ecx
mov dword [ebp - 0x9018], 0x3fff
mov dword [ebp - 0x9010], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
mov dword [ebp - 0x9014], esi
test eax, eax
jne 0x41b194
mov esi, dword [ebp - 0x9010]
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41b091
test esi, esi
je 0x41b163
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea eax, [ebp - 0x9008]
push eax
push esi
push ebx
call fcn.004d72e3
mov edx, dword [ebp - 0x901c]
add esp, 0xc
lea ecx, [ebx + 2]
push ecx
mov ecx, dword [edx + 8]
call fcn.0040f5a0
push ebx
call fcn.004d632b
add esp, 4
jmp 0x41b091
push esi
push str._CAeMaintenanceMode::MaintenanceModeInitializeHelper:_IOCTL_AE_ADD_UFL:_dwIndex_count_from_registry:__d
mov ecx, 0x93c690
call fcn.004015d0
mov eax, dword [ebp - 0x900c]
add esp, 8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._Out_CAeMaintenanceMode::MaintenanceModeInitializeHelper
mov ecx, 0x93c690
call fcn.004015d0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004d5564
mov esp, ebp
pop ebp
ret 8
Function at 0x41b1e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push str._In_CAeMaintenanceMode::MaintenanceModeHandler
mov ecx, 0x93c690
mov esi, eax
call fcn.004015d0
add esp, 4
push ebx
mov ecx, esi
call fcn.0041d4e0
push str.SOFTWAREFaronicsAntiExecutableMModeFileCreated
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str._In_CAeMaintenanceMode::MaintenanceModeHandlerHelper
mov ecx, 0x93c690
mov dword [esi + 0x30], 0
call fcn.004015d0
add esp, 4
cmp ebx, 2
jne 0x41b250
cmp dword [esi], ebx
je 0x41b255
push str.__MAINTENANCE_MODE__i_nState_____IsDriverInMaintenanceMode___
mov ecx, 0x93c690
call fcn.004015d0
mov edi, dword [esi + 8]
add esp, 4
call fcn.0040f0a0
mov dword [esi], ebx
cmp dword [esi], 2
jne 0x41b2cc
push str.__IsDriverInMaintenanceMode_____m_nDriverRunningMode___MODE_NOT_SET______bFailedToUpdAWL_
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
test ebx, ebx
jne 0x41b29f
push str._PROTECTION_OFF__i_nState
mov ecx, 0x93c690
call fcn.004015d0
mov edi, dword [esi + 8]
add esp, 4
call fcn.0040f1a0
mov edi, dword [esi + 8]
call fcn.0040f4a0
push str.SYSTEMCurrentControlSetServicesAeFilterUpdateRegFile
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x41b2cc
cmp ebx, 1
jne 0x41b2cc
push str._PROTECTION_ON__i_nState
mov ecx, 0x93c690
call fcn.004015d0
mov edi, dword [esi + 8]
add esp, 4
call fcn.0040f1a0
mov edi, dword [esi + 8]
call fcn.0040f4a0
push esi
call fcn.0041b3f0
push str._Out_CAeMaintenanceMode::MaintenanceModeHandlerHelper
mov ecx, 0x93c690
call fcn.004015d0
mov eax, dword [ebp + 8]
add esp, 4
push eax
mov eax, ebx
call fcn.0041c670
push str._Out_CAeMaintenanceMode::MaintenanceModeHandler
mov ecx, 0x93c690
mov dword [esi], ebx
call fcn.004015d0
add esp, 4
pop edi
mov eax, 1
pop esi
pop ecx
pop ebp
ret 4
Function at 0x41b310
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push str._In_CAeMaintenanceMode::MaintenanceModeHandlerHelper
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
cmp ebx, 2
jne 0x41b34b
cmp dword [esi], ebx
je 0x41b356
push str.__MAINTENANCE_MODE__i_nState_____IsDriverInMaintenanceMode___
mov ecx, 0x93c690
call fcn.004015d0
mov edi, dword [esi + 8]
add esp, 4
call fcn.0040f0a0
mov dword [esi], ebx
cmp dword [esi], 2
je 0x41b356
cmp dword [ebp + 8], 0
je 0x41b3cd
push str.__IsDriverInMaintenanceMode_____m_nDriverRunningMode___MODE_NOT_SET______bFailedToUpdAWL_
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
test ebx, ebx
jne 0x41b3a0
push str._PROTECTION_OFF__i_nState
mov ecx, 0x93c690
call fcn.004015d0
mov edi, dword [esi + 8]
add esp, 4
call fcn.0040f1a0
mov edi, dword [esi + 8]
call fcn.0040f4a0
push str.SYSTEMCurrentControlSetServicesAeFilterUpdateRegFile
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x41b3cd
cmp ebx, 1
jne 0x41b3cd
push str._PROTECTION_ON__i_nState
mov ecx, 0x93c690
call fcn.004015d0
mov edi, dword [esi + 8]
add esp, 4
call fcn.0040f1a0
mov edi, dword [esi + 8]
call fcn.0040f4a0
push esi
call fcn.0041b3f0
push str._Out_CAeMaintenanceMode::MaintenanceModeHandlerHelper
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
mov eax, 1
pop edi
pop ebp
ret 4
Function at 0x41b3f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe4f6
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x250], eax
xor ecx, ecx
push ebx
mov eax, 0x517384
lea esi, [ebp - 0x24c]
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x23c], ebx
mov word [ebp - 0x24c], cx
call fcn.004027c0
mov dword [ebp - 4], ebx
push 0x2b
mov eax, str.GlobalD854FDA4_5365_4bcc_B9E6_1EA3CCFC0BEA
call fcn.004027c0
xor edi, edi
jmp 0x41b470
push 0x1fe
lea eax, [ebp - 0x212]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x214], dx
call fcn.004da450
add esp, 0xc
push edi
lea ecx, [ebp - 0x214]
push 0x50ff30
push ecx
call fcn.004d7ee5
add esp, 0xc
push ebx
lea eax, [ebp - 0x24c]
xor edx, edx
push eax
or eax, 0xffffffff
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], dx
call fcn.004022e0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41b4e0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x230]
call fcn.004021b0
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x41b516
lea eax, [ebp - 0x230]
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, ebx
je 0x41b534
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x21c], 8
jb 0x41b54f
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.004d5559
add esp, 4
xor edx, edx
inc edi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], dx
cmp edi, 0x14
jb 0x41b470
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x238], 8
jb 0x41b591
mov eax, dword [ebp - 0x24c]
push eax
call fcn.004d5559
add esp, 4
xor ecx, ecx
mov word [ebp - 0x24c], cx
push str.Before_FillUpdateFileListFromReg__
mov ecx, 0x93c690
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x23c], ebx
call fcn.004015d0
mov esi, dword [ebp - 0x250]
add esp, 4
mov eax, esi
call fcn.0041bd70
push str.After_FillUpdateFileListFromReg__
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
push ebx
push ebx
push esi
push 0x41b620
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
Function at 0x41be40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x802]
push ecx
mov word [ebp - 0x804], ax
call fcn.004da450
add esp, 0xc
lea edx, [ebp - 0x804]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x41bf40
push esi
lea esi, [ebp - 0x804]
push edi
cmp word [esi], 0
je 0x41bf2b
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bea2
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov edi, eax
add esp, 4
test edi, edi
je 0x41bf07
mov edx, edi
mov eax, esi
sub edx, esi
jmp 0x41bee0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41bee0
lea eax, [ebx + 0x40]
push eax
mov ecx, ebx
call fcn.0041c310
test eax, eax
jne 0x41bf07
push edi
call fcn.004d632b
add esp, 4
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bf10
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
test esi, esi
jne 0x41be93
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.004d5564
mov esp, ebp
pop ebp
ret
Function at 0x41bf60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x9028
call fcn.004ea5a0
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x9010], esi
mov dword [ebp - 0x9020], eax
test eax, eax
jne 0x41bfa2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
push str._In_CAeMaintenanceMode::RegEnumAndToAddUFL
mov ecx, 0x93c690
call fcn.004015d0
lea edi, [esi + 0x58]
add esp, 4
mov dword [ebp - 0x9024], edi
call fcn.0041db20
lea edi, [esi + 0x68]
mov dword [ebp - 0x901c], edi
call fcn.0041db20
lea edi, [esi + 0x4c]
mov ebx, edi
call fcn.00409750
call fcn.00461f80
xor ebx, ebx
jmp 0x41bfe9
mov esi, dword [ebp - 0x9010]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x1fff
lea edi, [ebp - 0x800c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x400
lea edi, [ebp - 0x900c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9014]
push eax
lea ecx, [ebp - 0x900c]
push ecx
mov ecx, dword [ebp - 0x9020]
push 0
push 0
lea edx, [ebp - 0x9028]
push edx
lea eax, [ebp - 0x800c]
push eax
push ebx
push ecx
mov dword [ebp - 0x9028], 0x3fff
mov dword [ebp - 0x9014], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebx
test eax, eax
jne 0x41c0db
mov esi, dword [ebp - 0x9014]
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov edi, eax
add esp, 4
mov dword [ebp - 0x9018], edi
test edi, edi
je 0x41bfe3
test esi, esi
je 0x41c0b9
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 0x9018]
lea eax, [ebp - 0x900c]
push eax
push esi
push edi
call fcn.004d72e3
mov esi, dword [ebp - 0x9010]
add esp, 0xc
push edi
call fcn.0041c160
jmp 0x41bfe9
push ebx
push str._dwIndex_count_from_registry:__d
mov ecx, 0x93c690
call fcn.004015d0
mov ecx, dword [esi + 0x18]
push ecx
push str._m_FileCreatedList.size:__d
mov ecx, 0x93c690
call fcn.004015d0
mov edx, dword [esi + 0x24]
push edx
push str._m_FileUpdatedList.size:__d
mov ecx, 0x93c690
call fcn.004015d0
mov edi, dword [ebp - 0x9024]
add esp, 0x18
call fcn.0041db20
mov edi, dword [ebp - 0x901c]
call fcn.0041db20
push str._Out_CAeMaintenanceMode::RegEnumAndToAddUFL
mov ecx, 0x93c690
call fcn.004015d0
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
Function at 0x41c670
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push edi
cmp ebx, 2
jne 0x41c68f
cmp dword [ebp + 8], eax
jne 0x41c68f
cmp dword [esi], eax
jne 0x41c68f
xor eax, eax
pop edi
pop ebx
pop ecx
pop ebp
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeInfoScheduler
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x41c6b1
push eax
push 0
call dword [sym.imp.USER32.dll_KillTimer]
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeInfoAEMMDF
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi + 0x2c], 0
call edi
cmp ebx, 2
jne 0x41c704
cmp dword [ebp + 8], 1
jne 0x41c704
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0x330]
call fcn.0041c710
test eax, eax
je 0x41c704
test ebx, ebx
je 0x41c704
imul ebx, ebx, 0xea60
push 0x41d300
push ebx
push 0
push 0
mov dword [0x539950], esi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x2c], eax
pop edi
mov eax, 1
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x41ca50
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x41cba8
test edi, edi
je 0x41cba8
xor eax, eax
push 0x1fc
push eax
lea ecx, [ebp - 0x202]
push ecx
mov word [ebp - 0x204], ax
call fcn.004da450
add esp, 0xc
xor eax, eax
jmp 0x41caa0
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeInfoScheduler]
mov word [ebp + eax - 0x204], cx
add eax, 2
test cx, cx
jne 0x41caa0
lea edx, [ebp - 0x204]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x208]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
lea edx, [ebp - 0x204]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x20c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41cba8
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cb17
mov ecx, dword [ebp - 0x208]
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.StartDateTime
push ecx
call esi
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cb47
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [ebp - 0x208]
push edx
push edi
push 1
push 0
push str.EndDateTime
push eax
call esi
mov edx, dword [ebp - 0x208]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push str.DurationInMin
push edx
call esi
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
Function at 0x41cea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeInfoScheduler
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41cedb
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push str.StartDateTime
push edx
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x41cf37
shr eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x41cf37
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ebp - 8]
push 0
push 0
push str.StartDateTime
push eax
call esi
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push str.EndDateTime
push edx
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x41cf8c
shr eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x41cf8c
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ebp - 8]
push 0
push 0
push str.EndDateTime
push eax
call esi
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push edx
push 0
push 0
push str.DurationInMin
push eax
call esi
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41d320
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebx + 4]
push esi
push edi
add eax, 0x290
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebx + 4]
cmp byte [edx + 0x1fe], 0
mov ecx, dword [edx + 0x1e8]
mov dword [ebp - 0x14], ecx
jne 0x41d359
cmp byte [edx + 0x1ff], 0
jne 0x41d359
xor al, al
jmp 0x41d35b
mov al, 1
push 0
push 1
push 0
push 0
push 0
movzx eax, al
push 0
push 1
xor ecx, ecx
mov dword [ebp - 0x10], eax
call fcn.00434160
mov esi, dword [ebx + 4]
cmp byte [esi + 0x1fe], 0
jne 0x41d38f
cmp byte [esi + 0x1ff], 0
jne 0x41d38f
xor al, al
jmp 0x41d391
mov al, 1
movzx ecx, al
mov eax, dword [esi + 0x288]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x41d3df
mov edi, dword [ebx + 8]
call fcn.0040e3f0
mov eax, dword [ebx + 4]
cmp byte [eax + 0x1fe], 0
mov esi, dword [ebx + 8]
jne 0x41d3c8
cmp byte [eax + 0x1ff], 0
mov byte [ebp - 5], 0
je 0x41d3cc
mov byte [ebp - 5], 1
mov edi, dword [ebp - 5]
push edi
call fcn.0040a950
test eax, eax
je 0x41d3df
push edi
call fcn.0040a9c0
mov eax, dword [ebx + 4]
cmp byte [eax + 0x1fe], 0
jne 0x41d3f8
cmp byte [eax + 0x1ff], 0
mov byte [ebp - 1], 0
je 0x41d3fc
mov byte [ebp - 1], 1
mov esi, dword [eax + 0x1e8]
add eax, 0x290
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0xc]
cmp dword [ebp - 0x10], edx
je 0x41d423
mov eax, dword [ebx + 0xc]
movzx ecx, byte [ebp - 1]
push eax
call fcn.00422aa0
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebx + 0xc]
push esi
call fcn.00421970
cmp dword [ebp - 0x18], 0
je 0x41d49f
push str._In_CAeMaintenanceMode::MaintenanceModeHandlerHelper
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
cmp dword [ebx], 2
jne 0x41d487
push str.__IsDriverInMaintenanceMode_____m_nDriverRunningMode___MODE_NOT_SET______bFailedToUpdAWL_
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
push str._PROTECTION_ON__i_nState
mov ecx, 0x93c690
call fcn.004015d0
mov edi, dword [ebx + 8]
add esp, 4
call fcn.0040f1a0
mov edi, dword [ebx + 8]
call fcn.0040f4a0
push ebx
call fcn.0041b3f0
push str._Out_CAeMaintenanceMode::MaintenanceModeHandlerHelper
mov ecx, 0x93c690
call fcn.004015d0
add esp, 4
mov dword [ebx], 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeInfoScheduler
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x41d4c1
push eax
push 0
call dword [sym.imp.USER32.dll_KillTimer]
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeInfoAEMMDF
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebx + 0x2c], 0
call esi
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret