joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413766
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, ecx
lea eax, [esi + 0xa40]
push eax
xor edi, edi
push edi
push edi
push str.ServiceNameUTF8
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call dword [0x467050]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x418]
push eax
push edi
push edi
mov edi, dword [0x467040]
push str.UUID
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x41c]
push eax
push 0
push 0
push str.Security
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x4137dd
and dword [esi + 0x41c], 0
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x420]
push eax
push 0
push 0
push str.DefaultConnection
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x413804
and dword [esi + 0x420], 0
lea eax, [ebp - 4]
push eax
add esi, 0xa3c
push esi
push 0
push 0
push 0x46e7ec
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x413827
and dword [esi], 0
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x413830
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xa40]
push edi
call fcn.00439690
mov ebx, dword [esp + 0x18]
pop ecx
inc eax
push eax
push edi
push 3
push 0
push str.ServiceNameUTF8
push ebx
call dword [0x467054]
mov edi, dword [0x46703c]
push 4
pop ebp
push ebp
lea eax, [esi + 0x418]
push eax
push ebp
push 0
push str.UUID
push ebx
call edi
push ebp
lea eax, [esi + 0x41c]
push eax
push ebp
push 0
push str.Security
push ebx
call edi
push ebp
lea eax, [esi + 0x420]
push eax
push ebp
push 0
push str.DefaultConnection
push ebx
call edi
push ebp
add esi, 0xa3c
push esi
push ebp
push 0
push 0x46e7ec
push ebx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x413e7d
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x20c]
push eax
lea edi, [esi + 0x520]
mov eax, dword [edi]
add eax, 0x20c
push eax
call fcn.0043ad55
mov ebx, dword [esp + 0x1c]
pop ecx
pop ecx
mov ecx, dword [edi]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x10]
mov edi, dword [0x46703c]
push 6
lea eax, [esi + 0x418]
push eax
push 3
push 0
push str.BDAddress
push ebx
call edi
push 3
lea eax, [esi + 0x41e]
push eax
push 3
push 0
push str.BDDevClass
push ebx
call edi
lea ebp, [esi + 0x421]
push ebp
call fcn.00439690
pop ecx
inc eax
push eax
push ebp
push 3
push 0
push str.BDName
push ebx
call edi
push 4
pop ebp
push ebp
lea eax, [esi + 0x51c]
push eax
push ebp
push 0
push str.DefaultConnection
push ebx
call edi
push ebp
add esi, 0x524
push esi
push ebp
push 0
push str.Flags
push ebx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4140f4
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x418]
push edi
call fcn.0043ada3
mov ebx, dword [esp + 0x14]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
mov edi, dword [0x46703c]
push 1
push 0
push str.String
push ebx
call edi
push 4
lea eax, [esi + 0x620]
push eax
push 4
push 0
push str.ItemData
push ebx
call edi
push 4
lea eax, [esi + 0x624]
push eax
push 4
push 0
push str.Notify
push ebx
call edi
add esi, 0x628
push esi
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push 0x46b9d0
push ebx
call edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x414228
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x424]
push eax
xor ebx, ebx
push ebx
push ebx
push str.Notes
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x428]
push eax
push ebx
push ebx
push str.EmailMessages
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x420]
push eax
push ebx
push ebx
push str.CalendarItems
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x41c]
push eax
push ebx
push ebx
push str.BusinessCards
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x842c]
push eax
push ebx
push ebx
push 0x46b9d0
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x42c]
push eax
push ebx
push ebx
push str.ContactFolderName
push dword [ebp + 8]
mov dword [ebp - 4], 0x800
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xc2c]
push eax
push ebx
push ebx
push str.EmailFolderName
push dword [ebp + 8]
mov dword [ebp - 4], 0x800
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x142c]
mov dword [ebp - 4], 0x800
push eax
push ebx
push ebx
push str.CalendarFolderName
push dword [ebp + 8]
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x1c2c]
push eax
push ebx
push ebx
push str.NotesFolderName
push dword [ebp + 8]
mov dword [ebp - 4], 0x800
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x242c]
push eax
push ebx
push ebx
push str.OldContactFolderName
push dword [ebp + 8]
mov dword [ebp - 4], 0x800
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x2c2c]
push eax
push ebx
push ebx
push str.OldEmailFolderName
push dword [ebp + 8]
mov dword [ebp - 4], 0x800
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x342c]
push eax
push ebx
push ebx
push str.OldCalendarFolderName
push dword [ebp + 8]
mov dword [ebp - 4], 0x800
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x3c2c]
push eax
push ebx
push ebx
push str.OldNotesFolderName
push dword [ebp + 8]
mov dword [ebp - 4], 0x800
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x442c]
push eax
push ebx
push ebx
push str.ContactFolderPath
push dword [ebp + 8]
mov dword [ebp - 4], 0x1000
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x542c]
push eax
push ebx
push ebx
push str.EmailFolderPath
push dword [ebp + 8]
mov dword [ebp - 4], 0x1000
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x642c]
push eax
mov dword [ebp - 4], 0x1000
push ebx
push ebx
push str.CalendarFolderPath
push dword [ebp + 8]
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x742c
push edi
push ebx
push ebx
push str.NotesFolderPath
push dword [ebp + 8]
mov dword [ebp - 4], 0x1000
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4146f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.BusinessCards
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x41c]
push eax
push 0
push 0
push str.CalendarItems
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x420]
push eax
push 0
push 0
push str.Notes
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x424]
push eax
push 0
push 0
push str.EmailMessages
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x428]
push eax
push 0
push 0
push str.SendEmailAttachments
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x42c]
push eax
push 0
push 0
push str.ReceiveEmailAttachments
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x430]
push eax
push 0
push 0
push str.PromptWhenChanged
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
add edi, 0x434
push edi
push 0
push 0
push str.AlertWhenNewPIM
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4149e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x41c]
push eax
xor ebx, ebx
push ebx
push ebx
push str.PimID
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x420]
push eax
push ebx
push ebx
push str.BusinessCardID
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x628]
push eax
push ebx
push ebx
push 0x46b9d0
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x830
push edi
push ebx
push ebx
push str.Info
push dword [ebp + 8]
mov dword [ebp - 4], 0xa28
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x414b54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x467040]
push edi
lea eax, [ebp - 4]
push eax
mov edi, ecx
lea eax, [edi + 0x418]
push eax
push 0
push 0
push str.AppMenu
push dword [ebp + 8]
mov ebx, 0x208
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x620]
push eax
push 0
push 0
push str.AppName
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x828
push edi
push 0
push 0
push str.AppPath
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x414bc5
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x418]
push edi
call fcn.0043ada3
mov ebp, dword [esp + 0x18]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
mov edi, dword [0x46703c]
push 1
push 0
push str.AppMenu
push ebp
call edi
lea ebx, [esi + 0x620]
push ebx
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push str.AppName
push ebp
call edi
add esi, 0x828
push esi
call fcn.0043ada3
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push str.AppPath
push ebp
call edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x414c87
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
add ecx, 0x418
push ecx
push 0
push 0
push str.Installed
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [0x467040]
leave
ret 4

Function at 0x414d25
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.00414c87
mov edi, dword [0x467040]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x41c]
push eax
push 0
push 0
push str.SendPictures
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x420
push esi
push 0
push 0
push str.PromptForPictures
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x414dc3
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5ac]
sub esp, 0x62c
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x5a8], eax
push ebx
mov ebx, dword [ebp + 0x5b8]
push esi
mov esi, dword [ebp + 0x5b4]
push edi
mov edi, dword [0x467058]
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x80]
push ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp + 0x3a0]
push ecx
mov dword [ebp - 0x78], eax
push eax
jmp 0x414e4d
push dword [ebp - 0x74]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
lea eax, [ebp + 0x3a0]
push 0
push eax
push dword [ebx]
call dword [0x46703c]
inc dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x3a0]
push eax
push dword [ebp - 0x78]
push dword [esi]
mov dword [ebp - 0x7c], 0x208
mov dword [ebp - 0x74], 0x410
call edi
test eax, eax
je 0x414e13
mov ecx, dword [ebp + 0x5a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0x5ac
leave
ret

Function at 0x4151af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040c5e2
mov edi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x12cc]
push eax
push 0
push 0
push str.Auto
push dword [ebp + 8]
mov dword [ebp - 4], 4
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x12d0
push esi
push 0
push 0
push str.DoNotUseMicrosoftDevice
push dword [ebp + 8]
call edi
pop edi
pop esi
leave
ret 4
Function at 0x415a61
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.004151af
mov edi, dword [0x467040]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x12d4]
push eax
push 0
push 0
push str.ComPortNumber
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x12d8
push esi
push 0
push 0
push str.UserInstalled
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x415c05
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.004151af
mov esi, dword [0x467040]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d4]
push eax
push 0
push 0
push str.ModemComPortNumber
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d8]
push eax
push 0
push 0
push str.FlowControl
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x12dc
push edi
push 0
push 0
push 0x46f264
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x415df3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.004151af
mov esi, dword [0x467040]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d4]
push eax
push 0
push 0
push str.ModemComPortNumber
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d8]
push eax
push 0
push 0
push str.FlowControl
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x12dc
push edi
push 0
push 0
push 0x46f324
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x415fd8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.004151af
mov edi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x12d4]
push eax
push 0
push 0
push str.NetworkMode
push dword [ebp + 8]
mov dword [ebp - 4], 4
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x12d8
push esi
push 0
push 0
push 0x46f3a4
push dword [ebp + 8]
mov dword [ebp - 4], 0x206
call edi
pop edi
pop esi
leave
ret 4
Function at 0x4161c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.004151af
mov esi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d4]
push eax
xor ebx, ebx
push ebx
push ebx
push str.DefaultBusinessCard
push dword [ebp + 8]
mov dword [ebp - 4], 0x410
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x16e4]
push eax
push ebx
push ebx
push str.InboxDirectory
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x18f8]
push eax
push 0
push 0
push str.AcceptBusinessCards
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x18f4]
push eax
push 0
push 0
push str.AcceptCalendarItems
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x18f0]
push eax
push 0
push 0
push str.AcceptEmailMessages
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x18ec]
push eax
push 0
push 0
push str.AcceptNotes
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x18fc]
push eax
push 0
push 0
push str.AcceptOther
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
add edi, 0x1900
push edi
push 0
push 0
push 0x46f45c
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41656c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.004151af
lea eax, [ebp - 4]
push eax
add esi, 0x12d4
push esi
push 0
push 0
push str.InboxDirectory
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call dword [0x467040]
pop esi
leave
ret 4

Function at 0x4166db
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.004151af
mov esi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d4]
push eax
push 0
push 0
push str.Root
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14dc]
push eax
push 0
push 0
push str.FlistFormat
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14e0]
push eax
push 0
push 0
push str.DenyHiddenAccess
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x14e4
push edi
push 0
push 0
push 0x46f65c
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x416942
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.004151af
mov esi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d4]
push eax
xor ebx, ebx
push ebx
push ebx
push str.UserSinkApp
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14e0]
push eax
push ebx
push ebx
push str.DefaultAction
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14dc]
push eax
push ebx
push ebx
push 0x46f73c
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14e4]
push eax
push ebx
push ebx
push str.VdpReconnect
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x14e8
push edi
push ebx
push ebx
push 0x46ba78
push dword [ebp + 8]
mov dword [ebp - 4], 6
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x416c0b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.004151af
mov esi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x12d4]
push eax
push 0
push 0
push 0x46f80c
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call esi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14e8]
push eax
push 0
push 0
push str.SyncBusinessCards
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14e4]
push eax
push 0
push 0
push str.SyncCalendarItems
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x14e0]
push eax
push 0
push 0
push str.SyncEmailMessages
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
add edi, 0x14dc
push edi
push 0
push 0
push str.SyncNotes
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x417190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.004151af
mov edi, dword [0x467040]
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x12d4]
push eax
push 0
push 0
push str.PrinterName
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x14dc
push esi
push 0
push 0
push 0x46f90c
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
call edi
pop edi
pop esi
leave
ret 4
Function at 0x418e37
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x520], ebx
push edi
mov edi, dword [0x467040]
jne 0x418e7e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.UUID
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 4
call edi
push dword [ebp - 8]
call fcn.00418021
pop ecx
mov dword [esi + 0x520], eax
lea eax, [esi + 0x20c]
push eax
mov eax, dword [esi + 0x520]
add eax, 0x20c
push eax
call fcn.0043ad55
pop ecx
pop ecx
mov ecx, dword [esi + 0x520]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x418]
push eax
push ebx
push ebx
push str.BDAddress
push dword [ebp + 8]
mov dword [ebp - 4], 6
call edi
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x41e]
push eax
push ebx
push ebx
push str.BDDevClass
push dword [ebp + 8]
mov dword [ebp - 4], 3
call edi
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x421]
push eax
push ebx
push ebx
push str.BDName
push dword [ebp + 8]
mov dword [ebp - 4], 0xf8
call edi
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x51c]
push eax
push ebx
push ebx
push str.DefaultConnection
push dword [ebp + 8]
mov dword [ebp - 4], 4
call edi
lea eax, [ebp - 4]
push eax
add esi, 0x524
push esi
push ebx
push ebx
push str.Flags
push dword [ebp + 8]
mov dword [ebp - 4], 4
call edi
pop edi
pop esi
pop ebx
leave
ret 4