joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406630
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4362f0]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4066ae
push eax
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.00420751
add esp, 0xc
push 0x40359c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x40668f
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x40667d
push 0
push eax
push 0x4362f0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov edx, dword [0x4362f0]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x3e9
push edx
mov bl, 1
call edi
mov dword [esi], eax
test eax, eax
jne 0x4066ce
xor bl, bl
mov eax, dword [0x4362f0]
push 0x3ea
push eax
call edi
mov dword [esi + 4], eax
test eax, eax
jne 0x4066e4
xor bl, bl
mov ecx, dword [0x4362f0]
push 0x3eb
push ecx
call edi
mov dword [esi + 8], eax
test eax, eax
jne 0x4066fb
xor bl, bl
mov edx, dword [0x4362f0]
push 0x3ec
push edx
call edi
mov dword [esi + 0xc], eax
test eax, eax
jne 0x406712
xor bl, bl
mov eax, dword [0x4362f0]
push 0x3ed
push eax
call edi
mov dword [esi + 0x10], eax
test eax, eax
jne 0x406728
xor bl, bl
mov ecx, dword [0x4362f0]
push 0x3ee
push ecx
call edi
mov dword [esi + 0x14], eax
test eax, eax
jne 0x406753
xor bl, bl
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 4
test bl, bl
je 0x406762
push 0x4362ec
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00420627
mov esp, ebp
pop ebp
ret 4

Function at 0x406b0a
Capabilities:
Create process on windows

Disassembly:
add ecx, 0xffffff8b
cmp ecx, 0x14
ja case.0x406ad3.119
movzx ecx, byte [ecx + 0x406ba4]
jmp dword [ecx*4 + 0x406b88]
push 1
push 0
push 0
push 0x403640
push 0x4036a0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 1
push 0
push 0
push 0x4036b0
push 0x4036a0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
cmp dword [0x43630c], 0
push 1
push 0
push 0
je 0x406b2b
push 0x403710
push 0x4036a0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 0x403770
push 0x4036a0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 1
push 0
push 0
push 0x4037d0
push 0x4036a0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 1
push 0
push 0
push 0x403830
push 0x4036a0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 1
push 0
push 0
push 0x403890
push 0x4036a0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x408860
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4363e4]
push esi
mov eax, 2
xor esi, esi
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
cmp ecx, esi
jne 0x4088b3
push 4
call fcn.004206e2
add esp, 4
cmp eax, esi
je 0x4088ab
mov dword [eax], 0x404098
mov ecx, eax
jmp 0x4088ad
xor ecx, ecx
mov dword [0x4363e4], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
lea edx, [ebp - 0x130]
push edx
call eax
cmp eax, esi
jl 0x408b0f
mov ecx, dword [0x4363e4]
cmp ecx, esi
jne 0x4088f3
push 4
call fcn.004206e2
add esp, 4
cmp eax, esi
je 0x4088eb
mov dword [eax], 0x404098
mov ecx, eax
jmp 0x4088ed
xor ecx, ecx
mov dword [0x4363e4], ecx
mov edx, dword [ecx]
mov edx, dword [edx + 0x54]
lea eax, [ebp - 0x12c]
push eax
call edx
cmp eax, esi
jl 0x408b0f
mov eax, dword [ebp - 0x130]
push ebx
mov ebx, 1
sub eax, ebx
je 0x408933
sub eax, ebx
je 0x408925
mov dword [ebp - 0x124], ebx
jmp 0x408939
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x128], esi
jmp 0x40893f
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x128], ebx
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x408992
cmp dword [ebp - 0x114], 6
jb 0x408992
mov eax, dword [ebp - 0x12c]
sub eax, ebx
je 0x408984
sub eax, ebx
je 0x408992
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
jmp 0x40899e
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x120], ebx
jmp 0x40899e
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], esi
mov edx, dword [0x4362f4]
push 0x7f
push 0xa1
mov ecx, edi
call fcn.00419a20
cmp eax, esi
jl 0x408b0e
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7f
push edi
call ebx
cmp eax, esi
je 0x408a8b
mov esi, eax
call fcn.00419800
test eax, eax
js 0x408b0e
mov edx, dword [0x4362f4]
push 0x80
push 0xa2
mov ecx, edi
call fcn.00419a20
test eax, eax
js 0x408b0e
mov edx, dword [0x4362f4]
push 0x88
push 0xa3
mov ecx, edi
call fcn.00419a20
test eax, eax
js 0x408b0e
mov edx, dword [0x4362f4]
push 0x89
push 0xa4
mov ecx, edi
call fcn.00419c00
test eax, eax
js 0x408b0e
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x124]
push ecx
push edx
push 0xae
mov eax, 0x81
mov ecx, edi
call fcn.00408b30
test eax, eax
js 0x408b0e
mov edx, dword [0x4362f4]
push 0xbe
push 0xc1
mov ecx, edi
call fcn.00419a20
test eax, eax
js 0x408b0e
push 0xbe
push edi
call ebx
test eax, eax
jne 0x408aa0
pop ebx
mov eax, 0x80070006
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
mov esi, eax
call fcn.00419800
test eax, eax
js 0x408b0e
mov edx, dword [0x4362f4]
push 0xbf
push 0xc2
mov ecx, edi
call fcn.00419a20
test eax, eax
js 0x408b0e
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x11c]
push eax
push ecx
push 0xc3
mov eax, 0xc0
mov ecx, edi
call fcn.00408b30
test eax, eax
js 0x408b0e
mov edx, dword [0x4362f4]
push 0x8b
push 0xb1
mov ecx, edi
call fcn.00419a20
test eax, eax
js 0x408b0e
mov dword [0x436338], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret
Function at 0x409040
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x79
or ebx, 0xffffffff
push esi
mov dword [ebp - 4], ebx
call edi
cmp eax, 1
jne 0x409067
mov dword [ebp - 4], 0
push 0x7a
push esi
call edi
cmp eax, 1
jne 0x409074
mov dword [ebp - 4], eax
push 0x7b
push esi
call edi
cmp eax, 1
jne 0x409087
mov dword [ebp - 4], 2
jmp 0x40908c
cmp dword [ebp - 4], ebx
je 0x4090d9
cmp dword [0x4362f8], 0
jne 0x4090bd
push 0
push 0x4362f8
push 0
push 0xf023f
push 0
push 0
push 0
push 0x4034a0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4090d9
mov ecx, dword [0x4362f8]
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x403908
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [0x436338], 0
je 0x409117
push 0x81
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x409117
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x409117
push 0x81
push esi
call edi
cmp eax, 1
sete dl
mov byte [ebp - 8], dl
mov eax, dword [ebp - 8]
push eax
call fcn.00409180
push 0xc0
push esi
call edi
mov ecx, dword [0x4363e4]
cmp eax, 1
sete bl
test ecx, ecx
jne 0x40914f
push 4
call fcn.004206e2
add esp, 4
test eax, eax
je 0x409147
mov dword [eax], 0x404098
mov ecx, eax
jmp 0x409149
xor ecx, ecx
mov dword [0x4363e4], ecx
mov edx, dword [ecx]
mov edx, dword [edx + 0x58]
xor eax, eax
test bl, bl
sete al
push eax
call edx
call fcn.0041ecd0
call fcn.0040a930
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409280
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x403920
push 0x403930
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x114], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x409370
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x110], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x409370
cmp dword [ebp - 0x110], 0
je 0x409370
lea ecx, [ebp - 0x10c]
push ecx
push 0x20119
push 0
push 0x4034a0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409370
lea edx, [ebp - 0x114]
push edx
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0
push 0x403944
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409363
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret
Function at 0x409390
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.004276d0
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x180c], 0x800
call fcn.0040d442
add esp, 0xc
lea ecx, [ebp - 0x1808]
push ecx
push 0x20219
push 0
push 0x4034a0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409420
mov ecx, dword [ebp - 0x1808]
lea edx, [ebp - 0x180c]
push edx
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push 0x403944
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x1808]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00409280
mov edi, dword [0x4362f4]
xor ecx, ecx
test al, al
setne cl
lea edx, [ebp - 0x1804]
push edx
lea eax, [ecx + 0x90]
call fcn.00419690
test eax, eax
jne 0x40945d
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x1804]
push ecx
lea edx, [ebp - 0x1004]
push 0x400
push edx
xor ebx, ebx
call fcn.00420cff
add esp, 0x10
push 0x73
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
jne 0x4094a7
pop ebx
pop edi
mov eax, 0x80070006
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x1004]
push eax
push 0
push 0xc
push esi
call edi
push 0
push 0xffffffffffffffff
push 0xb1
push esi
call edi
push 0x80000
push 0
push 0x445
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret

Function at 0x40a0c0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x114
xor esi, esi
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0040d442
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a143
mov eax, dword [ebp - 0x114]
cmp eax, 5
ja 0x40a12f
jne 0x40a11e
cmp dword [ebp - 0x110], 1
jae 0x40a12f
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret
Function at 0x40b1d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x403d20
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00420751
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x1a4]
push edx
push 0
push 0x403e58
push 0x403d90
push SysReAllocStringLen
mov dword [ebp - 0x210], 0x1a0
call esi
test eax, eax
je 0x40b27c
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x1a4]
push ecx
push 0
push 0x403e58
push 0x403d90
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x210], 0x1a0
call esi
test eax, eax
je 0x40b27c
push 0x403dd8
lea edx, [ebp - 0x1a4]
push 0xd0
push edx
call fcn.00420751
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push edi
push 0
push 0x403e58
lea ecx, [ebp - 0x20c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x210], 0x208
call esi
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret

Function at 0x40b2c0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x210]
mov word [ebp - 0x210], ax
call fcn.0040b1d0
xor edi, edi
test eax, eax
je 0x40b3d0
push 0x40
xor eax, eax
lea ecx, [ebp - 0x264]
push edi
push ecx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x268], edi
call fcn.0040d442
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40b330
sub eax, edx
sar eax, 1
mov esi, eax
mov edx, 0x104
push 0x4038ec
sub edx, esi
push edx
lea eax, [ebp + esi*2 - 0x210]
push eax
call fcn.00420751
mov ecx, 0x103
push 0x403df8
sub ecx, esi
push ecx
lea edx, [ebp + esi*2 - 0x20e]
push edx
call fcn.00420751
add esp, 0x18
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x268]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
lea edx, [ebp - 0x210]
push edx
push edi
mov dword [ebp - 0x268], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
je 0x40b3d0
mov eax, dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x220]
push ecx
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
push 1
push edi
push edi
push 0x403df8
push 0x4036a0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret
Function at 0x40d700
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 0xf023f
xor edi, edi
push edi
push esi
push SysReAllocStringLen
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d74f
push edi
xor edx, edx
cmp esi, 0x404108
lea ecx, [ebp - 4]
push ecx
push edi
sete dl
push 0xf023f
push edx
push edi
push edi
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d76f
mov eax, dword [ebp - 4]
test eax, eax
je 0x40d782
mov edx, dword [ebp + 8]
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40d774
mov edi, 0x8000ffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x40d782
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x40d790
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
test esi, esi
jne 0x40d7ac
mov eax, 0x80004003
pop edi
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 4]
push eax
push 0xf023f
push 0
push 0x4041b4
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x40d806
push ecx
mov edx, 0x4041b4
xor eax, eax
cmp edx, 0x404108
lea ecx, [ebp - 4]
push ecx
push 0
sete al
push 0xf023f
push eax
push 0
push 0
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d825
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40d838
mov edx, dword [esi]
mov eax, dword [esi + 4]
add edx, edx
push edx
and eax, 0xfffffffe
push eax
mov eax, dword [ebp + 8]
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40d82a
mov edi, 0x8000ffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x40d838
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x40e590
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x40e5a9
mov eax, 3
mov esp, ebp
pop ebp
ret 0x14
push edi
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
test edi, edi
jne 0x40e68e
cmp dword [ebp - 8], 0x7ffffffe
jbe 0x40e5ed
lea eax, [edi + 0xe]
pop edi
mov esp, ebp
pop ebp
ret 0x14
push ebx
push esi
mov esi, dword [ebp - 0xc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40e618
pop esi
mov edi, 0xe
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push ebx
lea edx, [ebp + 0xc]
push edx
push 0
push eax
push ecx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x40e67c
mov edx, dword [ebp - 4]
cmp edx, esi
ja 0x40e67c
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
je 0x40e650
mov edi, 3
jmp 0x40e67c
mov eax, dword [ebp + 0x18]
mov ecx, edx
test eax, eax
je 0x40e65d
cmp edx, dword [eax]
jbe 0x40e668
mov edi, 0xea
test eax, eax
je 0x40e697
mov ecx, dword [eax]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40e67c
push ecx
push ebx
push eax
call fcn.0040d3aa
add esp, 0xc
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x14
xor ecx, ecx
jmp 0x40e66a
Function at 0x40e6a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
xor ecx, ecx
push edi
xor edi, edi
mov esi, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ecx
cmp ebx, ecx
jne 0x40e6d1
pop edi
pop esi
mov eax, 0x80004003
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, ecx
je 0x40e6c3
cmp dword [ebp + 8], ecx
je 0x40e6c3
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40e6e0
sub eax, esi
sar eax, 1
dec eax
cmp ecx, eax
jae 0x40e711
cmp word [esi + ecx*2], 0x5c
je 0x40e6fe
inc ecx
jmp 0x40e6f0
cmp ecx, 0xffffffff
je 0x40e711
pop edi
pop esi
mov eax, 0x8000ffff
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040ea10
test eax, eax
js 0x40e733
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e78f
mov eax, dword [ebp - 0x10]
dec eax
je 0x40e771
sub eax, 3
jne 0x40e78f
lea ecx, [ebp - 4]
push ecx
mov eax, esi
call fcn.0040f200
mov esi, eax
cmp esi, edi
jl 0x40e794
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [ebp - 4], edi
jmp 0x40e794
lea ecx, [ebp - 8]
push ecx
mov eax, esi
call fcn.0040f3b0
mov esi, eax
cmp esi, edi
jl 0x40e794
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [ebp - 8], edi
jmp 0x40e794
mov esi, 0x80004005
mov ecx, dword [ebp - 0xc]
cmp ecx, edi
je 0x40e7a2
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x40e7b0
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 8]
cmp ecx, edi
je 0x40e7be
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ef80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x808], ebx
cmp esi, ebx
jne 0x40efc8
pop edi
pop esi
mov eax, 0x80004003
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 8
cmp edi, ebx
je 0x40efb0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x40f0a3
lea eax, [ebp - 0x808]
push eax
push 0x20219
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f0a3
mov eax, dword [ebp - 0x808]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x804]
push edx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
mov dword [ebp - 0x810], 0x400
call ebx
test eax, eax
jne 0x40f07c
lea esp, [esp]
mov edx, dword [ebp - 0x808]
lea ecx, [ebp - 0x804]
push ecx
push edx
call fcn.0040ef80
mov dword [ebp - 0x80c], eax
test eax, eax
js 0x40f0a3
mov edx, dword [ebp - 0x808]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x804]
push ecx
push 0
push edx
mov dword [ebp - 0x810], 0x400
call ebx
test eax, eax
je 0x40f030
mov eax, dword [ebp - 0x808]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40f099
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x40f0a3
mov dword [ebp - 0x80c], 0x8000ffff
mov eax, dword [ebp - 0x808]
test eax, eax
je 0x40f0b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x80c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420627
mov esp, ebp
pop ebp
ret 8

Function at 0x4104b0
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x404ac4
push 1
push 0
push 0x402dbc
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x4104f7
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0
add edx, 8
push edx
push 0x402dcc
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x410506
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x410720
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x404ac4
push 1
push 0
push 0x402dbc
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x410767
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0
add edx, 8
push edx
push 0x402ddc
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x410776
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4