joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bbc0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x68
cmp dword [esp + 0x6c], 3
mov dword [esp], 0
jb 0x43bbe6
push str.bPostMessageToCCC:_ulAceCommand_out_of_range
call fcn.0040aab0
add esp, 4
xor eax, eax
add esp, 0x68
ret 0xc
mov eax, dword [0x4955b0]
test eax, eax
je 0x43bbff
push str.04874F40_A61B_405c_8206_7116B598FD8A
push eax
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
jne 0x43bc16
push 0
push 0x43a0d0
mov dword [0x4955b0], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x4955b0]
test eax, eax
jne 0x43bc34
push str.bPostMessageToCCC:_failed_to_get_CCC_window_handle
call fcn.0040aab0
add esp, 4
xor eax, eax
add esp, 0x68
ret 0xc
mov eax, dword [esp + 0x74]
test eax, eax
push edi
je 0x43bc49
mov eax, dword [esp + 0x74]
push eax
call fcn.00439db0
jmp 0x43bc53
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00439d60
mov edi, eax
add esp, 4
lea eax, [edi - 0x20]
cmp eax, 0xa
push esi
ja case.0x43bc6c.35
movzx edx, byte [eax + 0x43bd5c]
jmp dword [edx*4 + 0x43bd54]
push str.bPostMessageToCCC:_PowerXpress_related_msg
call fcn.0040aab0
push 0xc
call fcn.0045fef9
mov esi, eax
add esp, 8
test esi, esi
je case.0x43bc6c.35
mov eax, dword [0x4955b0]
push edi
push 0x8486
push eax
lea ecx, [esp + 0x18]
push str.SendMessage_to__.8X_with_message_id:_.8X__lparam:__.8x
push ecx
call fcn.0045ebd9
lea edx, [esp + 0x20]
push edx
call fcn.00411050
mov eax, dword [0x4955b0]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
push 0x43a100
mov dword [esi], eax
mov dword [esi + 4], 0x8486
mov dword [esi + 8], edi
call fcn.00423cb0
add esp, 0x2c
test eax, eax
je 0x43bcf2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop edi
add esp, 0x68
ret 0xc
push esi
call fcn.0045fe48
add esp, 4
mov edx, dword [0x4955b0]
push edi
push 0
push 0x8486
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x43bd34
mov eax, dword [0x4955b0]
push eax
push str.bPostMessageToCCC:_PostMessage_success_ccc0x_x
call fcn.0040aab0
add esp, 8
pop esi
mov eax, 1
pop edi
add esp, 0x68
ret 0xc
mov ecx, dword [0x4955b0]
push ecx
push str.bPostMessageToCCC:_PostMessage_failed_ccc0x_x
call fcn.0040aab0
add esp, 8
pop esi
xor eax, eax
pop edi
add esp, 0x68
ret 0xc
Function at 0x43fc80
Capabilities:
Read file via mapping

Disassembly:
mov al, byte [esp + 0xc]
test al, al
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
mov bl, 1
push edi
jne 0x43fd08
push ebp
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x43fcf1
cmp eax, 0xffffffff
je 0x43fcf1
push edi
push str.CSharedDataBase::Init:_success_to_CreateFileMapping_for__s
call fcn.0040aab0
mov eax, dword [esi + 4]
add esp, 8
push ebp
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
push edi
jne 0x43fd3d
push str.CSharedDataBase::Init:_failed_to_MapViewOfFile_for__s
call fcn.0040aab0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push edi
push str.CSharedDataBase::Init:_failed_to_CreateFileMapping_for__s
call fcn.0040aab0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x43fd26
cmp eax, 0xffffffff
je 0x43fd26
push edi
push str.CSharedDataBase::Init:_success_to_OpenFileMapping_for__s
jmp 0x43fcba
push edi
push str.CSharedDataBase::Init:_failed_to_OpenFileMapping_for__s
call fcn.0040aab0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push str.CSharedDataBase::Init:_success_to_MapViewOfFile_for__s
call fcn.0040aab0
add esp, 8
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 0xc
Function at 0x4422d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc0
push esi
push edi
push 0xffffffffffffffff
mov ecx, 0x492d68
call fcn.004158f0
test eax, eax
jne 0x442311
test dword [0x4900e8], 0x10000
je 0x442403
push str.PowerXpressCreateProcess:_failed_to_acquire_PX_mutex_lock
call fcn.0040aab0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x492d68
call fcn.00415880
test eax, eax
je 0x4423ea
xor eax, eax
mov ecx, 0x19
lea edi, [esp + 0x60]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
push ecx
push edx
push eax
lea ecx, [esp + 0x6c]
push str.Ati2evxx.exe__PowerXpress__d__d__d
push ecx
call fcn.0045ebd9
add esp, 0x14
xor edx, edx
xor eax, eax
mov dword [esp + 8], edx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x1c]
push ecx
push edx
push edx
push 0x20
push edx
push edx
push edx
mov dword [esp + 0x34], edx
lea edx, [esp + 0x80]
push edx
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [0x4900e8]
je 0x4423d0
test eax, 0x10000
je 0x4423b6
push str.PowerXpressCreateProcess:_create_PowerXpress_process_n
call fcn.0040aab0
add esp, 4
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test eax, 0x10000
je 0x442403
push str.PowerXpressCreateProcess:_failed_to_create_PowerXpress_process_n
call fcn.0040aab0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test dword [0x4900e8], 0x10000
je 0x442403
push str.PowerXpressCreateProcess:_failed_to_unlock_PX_mutex
call fcn.0040aab0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442410
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2120
call fcn.0045f430
push ebx
push ebp
xor ebx, ebx
push esi
xor ebp, ebp
mov eax, str.dwm.exe
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x442438
sub eax, edx
mov dword [esp + 0x20], eax
xor eax, eax
mov ecx, 0x400
lea edi, [esp + 0x1130]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0x1000
lea ecx, [esp + 0x1138]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x44256e
mov edi, dword [esp + 0x1c]
shr edi, 2
cmp edi, ebx
mov dword [esp + 0x24], edi
jbe 0x44256e
jmp 0x442490
mov edx, dword [esp + ebx*4 + 0x1130]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
xor edx, edx
cmp esi, edx
je 0x442565
xor eax, eax
mov dword [esp + 0x130], edx
mov ecx, 0x3ff
lea edi, [esp + 0x134]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x1000
lea ecx, [esp + 0x138]
push ecx
push esi
mov dword [esp + 0x28], edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x442556
mov eax, dword [esp + 0x18]
xor ebp, ebp
test eax, 0xfffffffc
jbe 0x442556
jmp 0x442500
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x2c]
lea edx, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + ebp*4 + 0x134]
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x442544
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push str.dwm.exe
push edx
call fcn.0045fc11
add esp, 0xc
test eax, eax
je 0x442552
mov eax, dword [esp + 0x18]
inc ebp
shr eax, 2
cmp ebp, eax
jb 0x442500
jmp 0x442556
inc dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
inc ebx
cmp ebx, edi
jb 0x442490
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442580
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x3a8
mov eax, dword [esp + 0x3ac]
push ebp
push esi
xor ebp, ebp
push 8
push ebp
push ebp
push 0x486164
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov esi, eax
cmp esi, 0xffffffff
je 0x442778
lea ecx, [esp + 0x1c8]
push ecx
push esi
mov dword [esp + 0x1d0], 0x11f
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailA]
test eax, eax
je 0x442771
lea edx, [esp + 0x1c]
push edx
push ebp
push esi
mov dword [esp + 0x28], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x442771
push ebx
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
push edi
mov edi, 4
nop
lea eax, [esp + 0x10]
push eax
push 0xc8
lea ecx, [esp + 0x2f8]
push ecx
lea edx, [esp + 0x20]
push edx
push 1
lea eax, [esp + 0x38]
push eax
push esi
call ebx
test eax, eax
jne 0x44264e
test dword [0x4900e8], 0x10000
je 0x44264e
push str.PowerXpressSetDesktopPreference:_fail_to_get_SPDRP_HARDWAREID
call fcn.0040aab0
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0xc8
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x20]
push eax
push 9
lea ecx, [esp + 0x38]
push ecx
push esi
call ebx
test eax, eax
jne 0x44268c
test dword [0x4900e8], 0x10000
je 0x44268c
push str.PowerXpressSetDesktopPreference:_fail_to_get_SPDRP_DRIVER
call fcn.0040aab0
add esp, 4
lea edx, [esp + 0x108]
push edx
push str.SYSTEMCurrentControlSetControlClass
lea eax, [esp + 0x48]
push str._s_s
push eax
call fcn.0045ebd9
mov eax, dword [0x4900e8]
add esp, 0x10
test eax, 0x10000
je 0x4426c9
lea ecx, [esp + 0x40]
push ecx
push str.PowerXpressSetDesktopPreference:_registry:_s_n
call fcn.0040aab0
add esp, 8
lea edx, [esp + 0x18]
push edx
push 0x2001f
push 0
lea eax, [esp + 0x4c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44274e
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.PXACAutoSwitch
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x44274e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x3bc]
push edi
lea eax, [esp + 0x24]
push eax
push edi
push 0
push str.PXPreference
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x24]
push eax
inc ebp
push ebp
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x442610
pop edi
pop ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop esi
pop ebp
add esp, 0x3a8
ret
Function at 0x446f40
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x490918]
sub esp, 0x114
cmp eax, 0xffffffff
jne 0x446fe7
lea eax, [esp + 0xc]
push eax
call fcn.0040ba20
add esp, 4
test eax, eax
je 0x446fe2
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x18]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x446fe2
mov edx, dword [esp + 4]
lea eax, [esp]
push eax
push 0x490918
lea ecx, [esp + 0x10]
push ecx
push 0
push str.ExtEvent_VideoPlaybackCpuThrottle
push edx
mov dword [esp + 0x20], 4
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x446fe2
cmp dword [esp], 4
jne 0x446fe2
mov eax, dword [0x490918]
cmp eax, 0x64
jbe 0x446fe7
mov eax, 0x64
mov dword [0x490918], eax
add esp, 0x114
ret
mov eax, SysReAllocString
add esp, 0x114
ret
Function at 0x447900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x31c
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
push 2
push eax
push eax
push 0x4953f4
mov dword [ecx + 8], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x447af1
lea edx, [esp + 0x140]
push edx
push ebx
mov dword [esp + 0x148], 0x11f
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailA]
test eax, eax
je 0x447aea
lea eax, [esp + 0x24]
push eax
push 0
push ebx
mov dword [esp + 0x30], 0x1c
mov dword [esp + 0x18], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x447aea
mov edi, edi
mov edx, dword [esp + 0x38]
push 0
push 0
push 0xc8
lea ecx, [esp + 0x26c]
push ecx
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ExA]
test eax, eax
jne 0x447a32
push 0x20019
push 1
push eax
push 1
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
cmp esi, 0xffffffff
je 0x447a25
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x3f
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x44]
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push eax
push 0
push 0x47e2cc
push esi
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x447a1c
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x40]
push ecx
push edx
call fcn.0045f600
add esp, 8
test eax, eax
jne 0x447a5e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x447a32
push str.GetBDFNumberFromDeviceKey:_SetupDiOpenDevRegKey_function_fails_n
call fcn.0040aab0
add esp, 4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x24]
inc eax
push ecx
push eax
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x447980
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x15
lea edx, [esp + 0x38]
push edx
push ebx
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov eax, dword [esp + 0x14]
mov edi, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 4
mov dword [edi], eax
xor eax, eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 0x1c
lea ecx, [esp + 0x38]
push ecx
push ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov eax, dword [esp + 0x18]
mov edx, eax
shr edx, 0x10
and eax, 0xffff
push esi
mov dword [edi + 4], edx
mov dword [edi + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449cc0
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x2001f
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x449d12
mov edx, dword [esp]
push str.DALCurrentObjectData
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x449d08
push str.RemoveLassoLastSelectedSettings:_Success_deleted__DALCurrentObjectData
call fcn.0040aab0
add esp, 4
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x44aef0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x491164]
sub esp, 0xc
push edi
push 0
push eax
call fcn.00424ff0
mov edi, eax
add esp, 8
test edi, edi
je 0x44afd9
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x44afd5
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x44afcf
lea edx, [esp + 8]
push edx
push 0x2001f
push eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push str.SoftwareATI_Technologies_Inc._
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44af9a
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareATI_Technologies_Inc._
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44afc8
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.VistaMobileInternalActionInprocess
push edx
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push edi
call ebx
pop ebx
pop edi
add esp, 0xc
ret

Function at 0x44afe0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x491164]
sub esp, 0xc
push esi
push 0
push eax
call fcn.00424ff0
mov esi, eax
add esp, 8
test esi, esi
je 0x44b089
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x44b085
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x44b07f
lea edx, [esp + 8]
push edx
push 0x2001f
push eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push str.SoftwareATI_Technologies_Inc._
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44b078
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
push str.VistaMobileInternalActionInprocess
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
call ebx
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x44b5a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
mov eax, dword [0x491164]
push ebx
push ebp
xor ebx, ebx
push ebx
push eax
mov dword [esp + 0x10], ebx
call fcn.00424ff0
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x44b6ad
push ebp
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x44b6a6
mov eax, dword [0x489624]
mov edx, dword [0x489620]
push esi
push edi
mov ecx, 7
mov esi, str.SoftwareATIACESettingsEEU
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.XDNotification]
mov dword [esp + 0x2c], eax
mov eax, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], ecx
mov cx, word [0x489628]
mov dword [esp + 0x28], edx
mov dl, byte [0x48962a]
push eax
push 0x2001f
movsw word es:[edi], word [esi]
mov word [esp + 0x38], cx
mov byte [esp + 0x3a], dl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x44b69e
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x44b697
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push ebx
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b690
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop edi
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x44
ret

Function at 0x44bb80
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.0044b790
push 0
call fcn.0044c4b0
add esp, 8
jmp fcn.0044afe0

Function at 0x44c4b0
Capabilities:
Enumerate gui resources

Disassembly:
push esi
movzx esi, byte [esp + 8]
push esi
call fcn.0044c3e0
add esp, 4
push esi
push 0x44c380
call dword [sym.imp.USER32.dll_EnumWindows]
pop esi
ret
Function at 0x44e780
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x9c], 0
push 0x94
push 0
lea eax, [ebp - 0x98]
push eax
call fcn.00460770
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x44e8b1
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0xa0], edx
cmp dword [ebp - 0xa0], 0
je 0x44e8a7
cmp dword [ebp - 0xa0], 1
je 0x44e868
cmp dword [ebp - 0xa0], 2
je 0x44e7f8
jmp 0x44e8b1
cmp dword [ebp - 0x94], 5
jae 0x44e80d
mov dword [ebp - 0x9c], 4
jmp 0x44e866
cmp dword [ebp - 0x94], 5
jne 0x44e835
mov dword [ebp - 0x9c], 7
cmp dword [ebp - 0x90], 0
jne 0x44e833
mov dword [ebp - 0x9c], 6
jmp 0x44e866
cmp dword [ebp - 0x94], 6
jne 0x44e847
cmp dword [ebp - 0x90], 1
je 0x44e850
cmp dword [ebp - 0x94], 6
jbe 0x44e85c
mov dword [ebp - 0x9c], 9
jmp 0x44e866
mov dword [ebp - 0x9c], 8
jmp 0x44e8b1
cmp dword [ebp - 0x94], 4
jne 0x44e8a5
cmp dword [ebp - 0x90], 0xa
jne 0x44e886
mov dword [ebp - 0x9c], 3
jmp 0x44e8a5
cmp dword [ebp - 0x90], 0x5a
jne 0x44e89b
mov dword [ebp - 0x9c], 5
jmp 0x44e8a5
mov dword [ebp - 0x9c], 2
jmp 0x44e8b1
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x9c]
mov esp, ebp
pop ebp
ret
Function at 0x4525d0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
cmp dword [ebp + 8], 0
je 0x4525f1
cmp dword [ebp + 0xc], 0
je 0x4525f1
cmp dword [ebp + 0x14], 0
je 0x4525f1
cmp dword [ebp + 0x18], 0
jne 0x4525f8
xor eax, eax
jmp 0x452747
cmp dword [ebp + 0x1c], 0
je 0x452611
cmp dword [ebp + 0x1c], 1
je 0x452611
cmp dword [ebp + 0x1c], 2
je 0x452611
xor eax, eax
jmp 0x452747
mov dword [ebp - 0xcc], 0
push 0xc8
push 0
lea eax, [ebp - 0xc8]
push eax
call fcn.00460770
add esp, 0xc
push 0xc8
lea ecx, [ebp - 0xc8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00452300
test eax, eax
je 0x452741
mov dword [ebp - 0xd4], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov dword [ebp - 0xd0], edx
lea eax, [ebp - 0xd4]
push eax
push 0x2001f
push 0
lea ecx, [ebp - 0xc8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x452741
cmp dword [ebp + 0x1c], 0
jne 0x4526da
lea edx, [ebp - 0xd0]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0xd8]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4526d8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xd0]
mov dword [ecx], edx
mov dword [ebp - 0xcc], 1
jmp 0x452734
cmp dword [ebp + 0x1c], 1
jne 0x452715
mov eax, dword [ebp - 0xd0]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xd8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x452713
mov dword [ebp - 0xcc], 1
jmp 0x452734
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x452734
mov dword [ebp - 0xcc], 1
mov ecx, dword [ebp - 0xd4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xcc]
mov esp, ebp
pop ebp
ret 0x18