joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a820
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42a947
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00428180
mov eax, dword [esp + 4]
test eax, eax
je 0x42a930
mov dword [esp + 0xc], eax
call fcn.00449910
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
call fcn.00425ab0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00427da0
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 6]
mov byte [esp + 0xb], dl
mov ebx, dword [esp + 0xc]
lea ebp, [ebx + 0x48]
mov dword [esp + 0x18], ebp
mov dword [esp], ebp
call fcn.0040a780
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x42a8b8
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42a8f9
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42a8cd
cmp byte [ebp + 6], dl
je 0x42a8d8
cmp esi, ebx
ja 0x42a8f9
jne 0x42a8b6
cmp byte [ebp + 6], dl
jbe 0x42a8b6
jmp 0x42a8f9
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a980
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00449930
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.0042a6a0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a980
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00449930
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x50b52d]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00438c50
nop
call fcn.00463e70
jmp fcn.0042a820

Function at 0x42ae40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42af39
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x42aec4
cmp cl, 2
je 0x42ae7d
cmp cl, 3
jne 0x42af22
mov byte [eax + 8], 1
jmp 0x42af1e
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.004303b0
lea eax, [0x5ee8d8]
mov dword [esp], eax
call fcn.0040a780
lea eax, [0x5ee888]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f80
lea eax, [0x5ee8d8]
mov dword [esp], eax
call fcn.0040a980
jmp 0x42af1e
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00416f80
lea eax, [0x5ee8d8]
mov dword [esp], eax
call fcn.0040a780
lea eax, [0x5ee860]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f80
lea eax, [0x5ee8d8]
mov dword [esp], eax
call fcn.0040a980
add esp, 0x14
ret
lea eax, [0x506870]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00438c50
nop
call fcn.00463e70
jmp fcn.0042ae40
Function at 0x458630
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x458730
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00458f60
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4ea5e0]
mov dword [esp], ecx
call fcn.0040cb10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x5ee970]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00457b70
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00457230
add esp, 0x28
ret
call fcn.00463e70
jmp fcn.00458630
Function at 0x462fa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x20
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.004444f0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
test byte [eax], al
movzx ecx, byte [0x60a291]
test cl, cl
je 0x463029
call fcn.00434db0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x800
lea edx, [esp + 0x14]
mov dword [esp], edx
call fcn.00451ae0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
jmp 0x46305f
call fcn.00434da0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 1
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00451ae0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
mov eax, dword [0x5e3ed4]
mov dword [esp], eax
lea eax, [ecx + 0x190]
mov dword [esp + 4], eax
call fcn.00404800
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x19c]
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x46309b
mov eax, dword [eax + 0x1a4]
mov dword [esp + 0x30], eax
call fcn.00444580
add esp, 0x20
ret
Function at 0x465130
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x60a640]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4638fb
je 0x46394e
cmp ebx, 0x20
jbe 0x463954
cmp ebx, 0x40
jbe 0x46399a
jmp 0x463a3b
test ebx, ebx
je 0x463944
add eax, 0x10
test ax, 0xff0
je 0x463930
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x518bc0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x518cc0]
jmp 0x463918
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x463918
pxor xmm1, xmmword [0x60a650]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x60a650]
pxor xmm2, xmmword [0x60a660]
pxor xmm3, xmmword [0x60a670]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x60a650]
pxor xmm2, xmmword [0x60a660]
pxor xmm3, xmmword [0x60a670]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x463a9a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x60a28f], 0
je 0x46514a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4638c0
jmp fcn.00409070
Function at 0x465150
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4034ae
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00409070
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00463e70
jmp 0x403470
cmp byte [0x60a28f], 0
je 0x46516b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x4638c0
jmp 0x403470
Function at 0x4aec40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aed9f
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00465377
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4aec7a
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4aeca3
lea eax, [0x4ec9a0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0044cc90
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.00465377
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x6c]
mov dword [esp], ecx
call fcn.004ad470
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov word [esp + 0x46], cx
mov word [esp + 0x48], dx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x38]
cmp ebx, edx
jae 0x4aed49
mov dword [esp + 0x24], ecx
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0xc
lea eax, [0x4ec9a0]
mov dword [esp + 0x10], eax
call fcn.0044cd30
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
lea eax, [ebp + ecx]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00465a70
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.00465836
add esp, 0x5c
ret
call fcn.00463e70
jmp fcn.004aec40
Function at 0x4047c0
Capabilities:
Check if file exists
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54970b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5bd3fc], 0
je 0x4047fd
mov al, 1
jmp 0x4049da
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00521d30
xor eax, eax
mov dword [ebp - 0x220], 0
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404850
sub eax, edx
lea ecx, [ebp - 0x230]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00404cd0
push 0xa
push str.AsIO3.dll
lea ecx, [ebp - 0x230]
call fcn.00404b50
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4049cb
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.00402f20
add esp, 4
test eax, eax
je 0x4049cb
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5bd3fc], eax
test eax, eax
je 0x4049cb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ASIO_Open
push eax
call esi
push str.ASIO_ReadMSR
push dword [0x5bd3fc]
mov dword [0x5bd400], eax
call esi
push str.ASIO_WriteMSR
push dword [0x5bd3fc]
mov dword [0x5bd404], eax
call esi
push str.ASIO_InPortB
push dword [0x5bd3fc]
mov dword [0x5bd408], eax
call esi
push str.ASIO_OutPortB
push dword [0x5bd3fc]
mov dword [0x5bd40c], eax
call esi
push str.ASIO_InPortD
push dword [0x5bd3fc]
mov dword [0x5bd410], eax
call esi
push str.ASIO_OutPortD
push dword [0x5bd3fc]
mov dword [0x5bd414], eax
call esi
push str.MapPhysToLin
push dword [0x5bd3fc]
mov dword [0x5bd418], eax
call esi
push str.UnmapPhysicalMemory
push dword [0x5bd3fc]
mov dword [0x5bd420], eax
call esi
push str.ASIO_MapMem
push dword [0x5bd3fc]
mov dword [0x5bd424], eax
call esi
push str.ASIO_UnmapMem
push dword [0x5bd3fc]
mov dword [0x5bd428], eax
call esi
push 0
mov dword [0x5bd42c], eax
call dword [0x5bd400]
test eax, eax
je 0x4049cb
mov bl, 1
jmp 0x4049cd
xor bl, bl
lea ecx, [ebp - 0x230]
call fcn.00404720
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret
Function at 0x40aa60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549ad7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a4ca4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi], vtable.AsusFanControl.0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [ebp + 8]
mov word [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov byte [esi + 0x80], 1
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov eax, dword [esi + 0x50]
push 0
mov byte [ebp - 4], 4
mov dword [esi + 0x54], eax
call dword [sym.imp.ole32.dll_CoInitialize]
call sym.AsusFanControlService.exe__AcpiInit_0
push 0x4060022
call fcn.00408490
add esp, 4
test al, al
mov eax, esi
je 0x40ab92
mov byte [esi + 0x80], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b48b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x828], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x820]
push eax
push 0x20019
push 0
push 0x55d7b8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
mov dword [edi], vtable.FanControlImp.0
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f282
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00521d30
add esp, 0xc
mov dword [ebp - 0x81c], 0x400
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push str.ExeName
push dword [ebp - 0x820]
call esi
test eax, eax
jne 0x41f282
mov al, 1
jmp 0x41f33b
lea eax, [ebp - 0x818]
push eax
push 0x20019
push 0
push str.SoftwareAsusROG_Live_Service
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x41f2e2
push 0x400
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00521d30
add esp, 0xc
mov dword [ebp - 0x824], 0x400
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x810]
push eax
push 0
push 0
push 0x55d83c
push dword [ebp - 0x818]
call esi
test eax, eax
je 0x41f27b
lea eax, [ebp - 0x814]
push eax
push 0x20019
push 0
push str.SoftwareAsusAi_Suite_IIFAN_Xpert_2
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov esi, eax
lea eax, [ebp - 0x814]
push eax
push 0x20019
push 0
push str.SoftwareAsusAi_Suite_IIThermal_Radar
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test esi, esi
je 0x41f324
test eax, eax
je 0x41f324
xor al, al
jmp 0x41f33b
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00427af0
cmp eax, 4
sete al
mov byte [edi + 0x14], al
mov eax, edi
mov dword [edi + 0x10], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret
Function at 0x420c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x410]
push eax
push 0x20019
push 0
push 0x55d7b8
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420ce2
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00521d30
add esp, 0xc
mov dword [ebp - 0x408], 0x400
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0
push str.ExeName
push dword [ebp - 0x410]
call esi
test eax, eax
je 0x420d42
lea eax, [ebp - 0x414]
push eax
push 0x20019
push 0
push str.SoftwareAsusROG_Live_Service
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x420d54
push 0x400
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.00521d30
add esp, 0xc
mov dword [ebp - 0x408], 0x400
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0
push 0x55d83c
push dword [ebp - 0x414]
call esi
test eax, eax
jne 0x420d54
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40c]
push eax
push 0x20019
push 0
push str.SoftwareAsusAi_Suite_IIFAN_Xpert_2
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov esi, eax
lea eax, [ebp - 0x40c]
push eax
push 0x20019
push 0
push str.SoftwareAsusAi_Suite_IIThermal_Radar
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test esi, esi
je 0x420da4
test eax, eax
je 0x420da4
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00427af0
mov ecx, dword [ebp - 4]
cmp eax, 4
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.0050970c
mov esp, ebp
pop ebp
ret
Function at 0x426340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
lea esi, [ecx + 8]
mov ecx, esi
call fcn.00425880
xor ebx, ebx
mov cl, bl
shl cl, 3
lea eax, [ecx + 0x60]
mov byte [ebp - 0x1a], al
lea eax, [ecx + 0x61]
mov byte [ebp - 0x19], al
lea eax, [ecx + 0x62]
mov byte [ebp - 0x18], al
lea eax, [ecx + 0x63]
mov byte [ebp - 0x17], al
lea eax, [ecx + 0x64]
mov byte [ebp - 0x16], al
lea eax, [ecx + 0x65]
mov byte [ebp - 0x15], al
lea eax, [ecx + 0x66]
add cl, 0x67
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], cl
mov cl, bl
shl cl, 4
inc ebx
mov dword [ebp - 0x34], ebx
lea eax, [ecx + 0x10]
mov byte [ebp - 0x12], al
lea eax, [ecx + 0x11]
mov byte [ebp - 0x11], al
lea eax, [ecx + 0x12]
mov byte [ebp - 0x10], al
lea eax, [ecx + 0x13]
mov byte [ebp - 0xf], al
lea eax, [ecx + 0x15]
mov byte [ebp - 0xe], al
add cl, 0x19
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xd], cl
mov ecx, esi
movups xmm0, xmmword [ebp - 0x1c]
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x34]
push eax
movups xmmword [ebp - 0x30], xmm0
call fcn.00425020
push eax
add eax, 0x10
mov ecx, esi
push eax
push 0
lea eax, [ebp - 8]
push eax
call fcn.004251b0
cmp ebx, 4
jl 0x426354
movzx eax, byte [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0x1a], 0xabaaa9a8
mov dword [ebp - 0x16], 0xafaeadac
mov dword [ebp - 0x12], 0x63626160
mov word [ebp - 0xe], 0x6965
movups xmm0, xmmword [ebp - 0x1c]
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 5
movups xmmword [ebp - 0x30], xmm0
call fcn.00425020
push eax
add eax, 0x10
mov ecx, esi
push eax
push 0
lea eax, [ebp - 8]
push eax
call fcn.004251b0
movzx eax, byte [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0x1a], 0xa3a2a1a0
mov dword [ebp - 0x16], 0xa7a6a5a4
mov dword [ebp - 0x12], 0x53525150
mov word [ebp - 0xe], 0x5955
movups xmm0, xmmword [ebp - 0x1c]
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 6
movups xmmword [ebp - 0x30], xmm0
call fcn.00425020
push eax
add eax, 0x10
mov ecx, esi
push eax
push 0
lea eax, [ebp - 8]
push eax
call fcn.004251b0
mov ecx, dword [esi]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x4264ee
mov byte [eax + 0x14], 0x13
mov ecx, dword [eax + 0x10]
dec ecx
cmp ecx, 5
ja case.default.0x42649e
jmp dword [ecx*4 + 0x4264f4]
mov byte [eax + 0x24], 0x5d
mov byte [eax + 0x15], 0x15
jmp case.default.0x42649e
mov byte [eax + 0x24], 0x5e
mov byte [eax + 0x15], 0x16
jmp case.default.0x42649e
mov byte [eax + 0x24], 0x5f
mov byte [eax + 0x15], 0x17
jmp case.default.0x42649e
mov byte [eax + 0x24], 0x6d
mov byte [eax + 0x15], 0x1e
jmp case.default.0x42649e
mov byte [eax + 0x24], 0x6f
mov byte [eax + 0x15], 0x92
jmp case.default.0x42649e
mov byte [eax + 0x24], 0x6e
mov byte [eax + 0x15], 0x1f
lea ecx, [ebp - 4]
call fcn.00412180
mov eax, dword [ebp - 4]
cmp eax, dword [esi]
jne 0x426491
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54badf
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5a4ca4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x5bd7b8]
test esi, esi
jne 0x4287a2
call fcn.004047c0
test al, al
je 0x4287b4
call sym.AsusFanControlService.exe__AcpiInit_0
push 0xc
call fcn.0050971d
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x42879a
xor eax, eax
mov dword [esi], vtable.Sio::SioAccessor.0
push 0x11060004
mov word [esi + 4], ax
mov byte [esi + 6], al
mov dword [esi + 8], eax
call fcn.00408490
add esp, 4
mov byte [esi + 7], al
mov ecx, esi
call fcn.00428200
mov ecx, esi
call fcn.004284a0
jmp 0x42879c
xor esi, esi
mov dword [0x5bd7b8], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push str.Sio::SioAccessor::Instance
push 0x70
push str.d:jenkinsworkspace_asusfancontrolservice_src_asus_sio.cpp
lea ecx, [ebp - 0x1c]
call fcn.00427aa0
push str.ASIO_open_fail...exit_...
sub esp, 0xc
mov ecx, esp
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
push 2
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
call fcn.0047d6b0
push eax
call fcn.00481b00
add esp, 0x18
push 1
call fcn.0052cc88
int3