joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432c90
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
push 0x200
mov esi, ecx
lea eax, [esi + 0x10c]
push eax
push 3
xor ebp, ebp
push ebp
push str.DisplayLimits
push edi
call ebx
test eax, eax
je 0x432cdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DisplayLimits
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040a4a0
add esp, 0xc
jmp 0x432ce0
mov ebp, 1
push 0xe4
lea ecx, [esi + 0x4ac]
push ecx
push 3
push 0
push str.Device1
push edi
call ebx
test eax, eax
je 0x432d17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Device1
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040a4a0
add esp, 0xc
jmp 0x432d1c
mov ebp, 1
push 0xe4
lea edx, [esi + 0x590]
push edx
push 3
push 0
push str.Device2
push edi
call ebx
test eax, eax
je 0x432d53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Device2
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040a4a0
add esp, 0xc
jmp 0x432d58
mov ebp, 1
push 4
lea eax, [esi + 0x674]
push eax
push 4
push 0
push str.ProfileFlags
push edi
call ebx
test eax, eax
je 0x432d8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ProfileFlags
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040a4a0
add esp, 0xc
jmp 0x432d91
mov ebp, 1
push 0x1a0
lea ecx, [esi + 0x30c]
push ecx
push 3
push 0
push str.DeviceProfile
push edi
call ebx
test eax, eax
je 0x432e27
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeviceProfile
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040a4a0
add esp, 0xc
test ebp, ebp
je 0x432e1b
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], edx
push eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push 3
push 0
push str.Timestamp
push edi
call ebx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add esi, 0x678
mov dword [esi], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret 4
mov ebp, 1
jmp 0x432dca
Function at 0x43c0c0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x68
cmp dword [esp + 0x6c], 3
mov dword [esp], 0
jb 0x43c0e6
push str.bPostMessageToCCC:_ulAceCommand_out_of_range
call fcn.0040a4a0
add esp, 4
xor eax, eax
add esp, 0x68
ret 0xc
mov eax, dword [0x4a1560]
test eax, eax
je 0x43c0ff
push str.04874F40_A61B_405c_8206_7116B598FD8A
push eax
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
jne 0x43c116
push 0
push 0x43a670
mov dword [0x4a1560], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x4a1560]
test eax, eax
jne 0x43c134
push str.bPostMessageToCCC:_failed_to_get_CCC_window_handle
call fcn.0040a4a0
add esp, 4
xor eax, eax
add esp, 0x68
ret 0xc
mov eax, dword [esp + 0x74]
test eax, eax
push edi
je 0x43c149
mov eax, dword [esp + 0x74]
push eax
call fcn.0043a330
jmp 0x43c153
mov ecx, dword [esp + 0x74]
push ecx
call fcn.0043a2e0
mov edi, eax
add esp, 4
lea eax, [edi - 0x20]
cmp eax, 0xa
push esi
ja case.0x43c16c.35
movzx edx, byte [eax + 0x43c25c]
jmp dword [edx*4 + 0x43c254]
push str.bPostMessageToCCC:_PowerXpress_related_msg
call fcn.0040a4a0
push 0xc
call fcn.00460459
mov esi, eax
add esp, 8
test esi, esi
je case.0x43c16c.35
mov eax, dword [0x4a1560]
push edi
push 0x8486
push eax
lea ecx, [esp + 0x18]
push str.SendMessage_to__.8X_with_message_id:_.8X__lparam:__.8x
push ecx
call fcn.0045f139
lea edx, [esp + 0x20]
push edx
call fcn.00410a60
mov eax, dword [0x4a1560]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
push 0x43a6a0
mov dword [esi], eax
mov dword [esi + 4], 0x8486
mov dword [esi + 8], edi
call fcn.00424010
add esp, 0x2c
test eax, eax
je 0x43c1f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop edi
add esp, 0x68
ret 0xc
push esi
call fcn.004603a8
add esp, 4
mov edx, dword [0x4a1560]
push edi
push 0
push 0x8486
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x43c234
mov eax, dword [0x4a1560]
push eax
push str.bPostMessageToCCC:_PostMessage_success_ccc0x_x
call fcn.0040a4a0
add esp, 8
pop esi
mov eax, 1
pop edi
add esp, 0x68
ret 0xc
mov ecx, dword [0x4a1560]
push ecx
push str.bPostMessageToCCC:_PostMessage_failed_ccc0x_x
call fcn.0040a4a0
add esp, 8
pop esi
xor eax, eax
pop edi
add esp, 0x68
ret 0xc
Function at 0x440390
Capabilities:
Read file via mapping

Disassembly:
mov al, byte [esp + 0xc]
test al, al
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
mov bl, 1
push edi
jne 0x440418
push ebp
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x440401
cmp eax, 0xffffffff
je 0x440401
push edi
push str.CSharedDataBase::Init:_success_to_CreateFileMapping_for__s
call fcn.0040a4a0
mov eax, dword [esi + 4]
add esp, 8
push ebp
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
push edi
jne 0x44044d
push str.CSharedDataBase::Init:_failed_to_MapViewOfFile_for__s
call fcn.0040a4a0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push edi
push str.CSharedDataBase::Init:_failed_to_CreateFileMapping_for__s
call fcn.0040a4a0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x440436
cmp eax, 0xffffffff
je 0x440436
push edi
push str.CSharedDataBase::Init:_success_to_OpenFileMapping_for__s
jmp 0x4403ca
push edi
push str.CSharedDataBase::Init:_failed_to_OpenFileMapping_for__s
call fcn.0040a4a0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push str.CSharedDataBase::Init:_success_to_MapViewOfFile_for__s
call fcn.0040a4a0
add esp, 8
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 0xc
Function at 0x442690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc0
push esi
push edi
push 0xffffffffffffffff
mov ecx, 0x49ed18
call fcn.004156f0
test eax, eax
jne 0x4426d1
test dword [0x4910e8], 0x10000
je 0x4427c3
push str.PowerXpressCreateProcess:_failed_to_acquire_PX_mutex_lock
call fcn.0040a4a0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x49ed18
call fcn.00415680
test eax, eax
je 0x4427aa
xor eax, eax
mov ecx, 0x19
lea edi, [esp + 0x60]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
push ecx
push edx
push eax
lea ecx, [esp + 0x6c]
push str.Ati2evxx.exe__PowerXpress__d__d__d
push ecx
call fcn.0045f139
add esp, 0x14
xor edx, edx
xor eax, eax
mov dword [esp + 8], edx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x1c]
push ecx
push edx
push edx
push 0x20
push edx
push edx
push edx
mov dword [esp + 0x34], edx
lea edx, [esp + 0x80]
push edx
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [0x4910e8]
je 0x442790
test eax, 0x10000
je 0x442776
push str.PowerXpressCreateProcess:_create_PowerXpress_process_n
call fcn.0040a4a0
add esp, 4
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test eax, 0x10000
je 0x4427c3
push str.PowerXpressCreateProcess:_failed_to_create_PowerXpress_process_n
call fcn.0040a4a0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test dword [0x4910e8], 0x10000
je 0x4427c3
push str.PowerXpressCreateProcess:_failed_to_unlock_PX_mutex
call fcn.0040a4a0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4427d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2120
call fcn.0045f540
push ebx
push ebp
xor ebx, ebx
push esi
xor ebp, ebp
mov eax, str.dwm.exe
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4427f8
sub eax, edx
mov dword [esp + 0x20], eax
xor eax, eax
mov ecx, 0x400
lea edi, [esp + 0x1130]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0x1000
lea ecx, [esp + 0x1138]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x44292e
mov edi, dword [esp + 0x1c]
shr edi, 2
cmp edi, ebx
mov dword [esp + 0x24], edi
jbe 0x44292e
jmp 0x442850
mov edx, dword [esp + ebx*4 + 0x1130]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
xor edx, edx
cmp esi, edx
je 0x442925
xor eax, eax
mov dword [esp + 0x130], edx
mov ecx, 0x3ff
lea edi, [esp + 0x134]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x1000
lea ecx, [esp + 0x138]
push ecx
push esi
mov dword [esp + 0x28], edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x442916
mov eax, dword [esp + 0x18]
xor ebp, ebp
test eax, 0xfffffffc
jbe 0x442916
jmp 0x4428c0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x2c]
lea edx, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + ebp*4 + 0x134]
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x442904
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push str.dwm.exe
push edx
call fcn.00460171
add esp, 0xc
test eax, eax
je 0x442912
mov eax, dword [esp + 0x18]
inc ebp
shr eax, 2
cmp ebp, eax
jb 0x4428c0
jmp 0x442916
inc dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
inc ebx
cmp ebx, edi
jb 0x442850
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442940
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x3a8
mov eax, dword [esp + 0x3ac]
push ebp
push esi
xor ebp, ebp
push 8
push ebp
push ebp
push 0x486504
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov esi, eax
cmp esi, 0xffffffff
je 0x442b38
lea ecx, [esp + 0x1c8]
push ecx
push esi
mov dword [esp + 0x1d0], 0x11f
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailA]
test eax, eax
je 0x442b31
lea edx, [esp + 0x1c]
push edx
push ebp
push esi
mov dword [esp + 0x28], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x442b31
push ebx
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
push edi
mov edi, 4
nop
lea eax, [esp + 0x10]
push eax
push 0xc8
lea ecx, [esp + 0x2f8]
push ecx
lea edx, [esp + 0x20]
push edx
push 1
lea eax, [esp + 0x38]
push eax
push esi
call ebx
test eax, eax
jne 0x442a0e
test dword [0x4910e8], 0x10000
je 0x442a0e
push str.PowerXpressSetDesktopPreference:_fail_to_get_SPDRP_HARDWAREID
call fcn.0040a4a0
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0xc8
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x20]
push eax
push 9
lea ecx, [esp + 0x38]
push ecx
push esi
call ebx
test eax, eax
jne 0x442a4c
test dword [0x4910e8], 0x10000
je 0x442a4c
push str.PowerXpressSetDesktopPreference:_fail_to_get_SPDRP_DRIVER
call fcn.0040a4a0
add esp, 4
lea edx, [esp + 0x108]
push edx
push str.SYSTEMCurrentControlSetControlClass
lea eax, [esp + 0x48]
push str._s_s
push eax
call fcn.0045f139
mov eax, dword [0x4910e8]
add esp, 0x10
test eax, 0x10000
je 0x442a89
lea ecx, [esp + 0x40]
push ecx
push str.PowerXpressSetDesktopPreference:_registry:_s_n
call fcn.0040a4a0
add esp, 8
lea edx, [esp + 0x18]
push edx
push 0x2001f
push 0
lea eax, [esp + 0x4c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x442b0e
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.PXACAutoSwitch
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x442b0e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x3bc]
push edi
lea eax, [esp + 0x24]
push eax
push edi
push 0
push str.PXPreference
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x24]
push eax
inc ebp
push ebp
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x4429d0
pop edi
pop ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop esi
pop ebp
add esp, 0x3a8
ret
Function at 0x4471e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x491918]
sub esp, 0x114
cmp eax, 0xffffffff
jne 0x447287
lea eax, [esp + 0xc]
push eax
call fcn.0040b410
add esp, 4
test eax, eax
je 0x447282
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x18]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x447282
mov edx, dword [esp + 4]
lea eax, [esp]
push eax
push 0x491918
lea ecx, [esp + 0x10]
push ecx
push 0
push str.ExtEvent_VideoPlaybackCpuThrottle
push edx
mov dword [esp + 0x20], 4
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x447282
cmp dword [esp], 4
jne 0x447282
mov eax, dword [0x491918]
cmp eax, 0x64
jbe 0x447287
mov eax, 0x64
mov dword [0x491918], eax
add esp, 0x114
ret
mov eax, SysReAllocString
add esp, 0x114
ret
Function at 0x447ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x31c
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
push 2
push eax
push eax
push 0x4a13a4
mov dword [ecx + 8], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x447d91
lea edx, [esp + 0x140]
push edx
push ebx
mov dword [esp + 0x148], 0x11f
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailA]
test eax, eax
je 0x447d8a
lea eax, [esp + 0x24]
push eax
push 0
push ebx
mov dword [esp + 0x30], 0x1c
mov dword [esp + 0x18], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x447d8a
mov edi, edi
mov edx, dword [esp + 0x38]
push 0
push 0
push 0xc8
lea ecx, [esp + 0x26c]
push ecx
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ExA]
test eax, eax
jne 0x447cd2
push 0x20019
push 1
push eax
push 1
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
cmp esi, 0xffffffff
je 0x447cc5
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x3f
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x44]
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push eax
push 0
push 0x47e4ac
push esi
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x447cbc
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x40]
push ecx
push edx
call fcn.0045fb60
add esp, 8
test eax, eax
jne 0x447cfe
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x447cd2
push str.GetBDFNumberFromDeviceKey:_SetupDiOpenDevRegKey_function_fails_n
call fcn.0040a4a0
add esp, 4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x24]
inc eax
push ecx
push eax
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x447c20
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x15
lea edx, [esp + 0x38]
push edx
push ebx
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov eax, dword [esp + 0x14]
mov edi, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 4
mov dword [edi], eax
xor eax, eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 0x1c
lea ecx, [esp + 0x38]
push ecx
push ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov eax, dword [esp + 0x18]
mov edx, eax
shr edx, 0x10
and eax, 0xffff
push esi
mov dword [edi + 4], edx
mov dword [edi + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449f60
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x2001f
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x449fb2
mov edx, dword [esp]
push str.DALCurrentObjectData
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x449fa8
push str.RemoveLassoLastSelectedSettings:_Success_deleted__DALCurrentObjectData
call fcn.0040a4a0
add esp, 4
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x44b190
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x492164]
sub esp, 0xc
push edi
push 0
push eax
call fcn.00425350
mov edi, eax
add esp, 8
test edi, edi
je 0x44b279
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x44b275
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x44b26f
lea edx, [esp + 8]
push edx
push 0x2001f
push eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push str.SoftwareATI_Technologies_Inc._
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44b23a
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareATI_Technologies_Inc._
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44b268
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.VistaMobileInternalActionInprocess
push edx
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push edi
call ebx
pop ebx
pop edi
add esp, 0xc
ret

Function at 0x44b280
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x492164]
sub esp, 0xc
push esi
push 0
push eax
call fcn.00425350
mov esi, eax
add esp, 8
test esi, esi
je 0x44b329
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x44b325
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x44b31f
lea edx, [esp + 8]
push edx
push 0x2001f
push eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push str.SoftwareATI_Technologies_Inc._
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44b318
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
push str.VistaMobileInternalActionInprocess
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
call ebx
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x44b840
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
mov eax, dword [0x492164]
push ebx
push ebp
xor ebx, ebx
push ebx
push eax
mov dword [esp + 0x10], ebx
call fcn.00425350
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x44b94d
push ebp
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x44b946
mov eax, dword [0x489844]
mov edx, dword [0x489840]
push esi
push edi
mov ecx, 7
mov esi, str.SoftwareATIACESettingsEEU
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.XDNotification]
mov dword [esp + 0x2c], eax
mov eax, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], ecx
mov cx, word [0x489848]
mov dword [esp + 0x28], edx
mov dl, byte [0x48984a]
push eax
push 0x2001f
movsw word es:[edi], word [esi]
mov word [esp + 0x38], cx
mov byte [esp + 0x3a], dl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x44b93e
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x44b937
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push ebx
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b930
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop edi
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x44
ret

Function at 0x44be20
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.0044ba30
push 0
call fcn.0044c750
add esp, 8
jmp fcn.0044b280

Function at 0x44c750
Capabilities:
Enumerate gui resources

Disassembly:
push esi
movzx esi, byte [esp + 8]
push esi
call fcn.0044c680
add esp, 4
push esi
push 0x44c620
call dword [sym.imp.USER32.dll_EnumWindows]
pop esi
ret
Function at 0x44ea40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x9c], 0
push 0x94
push 0
lea eax, [ebp - 0x98]
push eax
call fcn.00460cd0
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x44eb71
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0xa0], edx
cmp dword [ebp - 0xa0], 0
je 0x44eb67
cmp dword [ebp - 0xa0], 1
je 0x44eb28
cmp dword [ebp - 0xa0], 2
je 0x44eab8
jmp 0x44eb71
cmp dword [ebp - 0x94], 5
jae 0x44eacd
mov dword [ebp - 0x9c], 4
jmp 0x44eb26
cmp dword [ebp - 0x94], 5
jne 0x44eaf5
mov dword [ebp - 0x9c], 7
cmp dword [ebp - 0x90], 0
jne 0x44eaf3
mov dword [ebp - 0x9c], 6
jmp 0x44eb26
cmp dword [ebp - 0x94], 6
jne 0x44eb07
cmp dword [ebp - 0x90], 1
je 0x44eb10
cmp dword [ebp - 0x94], 6
jbe 0x44eb1c
mov dword [ebp - 0x9c], 9
jmp 0x44eb26
mov dword [ebp - 0x9c], 8
jmp 0x44eb71
cmp dword [ebp - 0x94], 4
jne 0x44eb65
cmp dword [ebp - 0x90], 0xa
jne 0x44eb46
mov dword [ebp - 0x9c], 3
jmp 0x44eb65
cmp dword [ebp - 0x90], 0x5a
jne 0x44eb5b
mov dword [ebp - 0x9c], 5
jmp 0x44eb65
mov dword [ebp - 0x9c], 2
jmp 0x44eb71
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x9c]
mov esp, ebp
pop ebp
ret