joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100af740
Capabilities:
Encode data using xor

Disassembly:
call fcn.1007b1fc
jmp 0x100b36f6
pushal
push edi
mov dword [esp + 0x20], edx
mov byte [esp + 4], bl
jmp 0x1005c9b8
push ebp
pushal
lea esp, [esp + 0x28]
call fcn.10024bf0
pushal
pushal
clc
push esi
add esp, 0x5c
call fcn.1008413c
fidivr word [esi - 0x194045b9]
mov bh, 0xae
add ecx, edi
inc ebx
push edi
mul byte [edi - 0x3e]
sub ch, byte [ebx + 0xe381411]
outsd dx, dword [esi]
pushal
mov dl, 0xc8
pop ebp
dec ebx
jp 0x100872ee
mov al, 0x5e
inc edx
mov bh, 0x37
ret 0xba53
cmc
pop ebx
sbb bh, byte [edi - 0x80]
add dword [edx - 0x6150942f], ebx
rcl dword gs:[esi], 0xb0
or al, byte [ecx]
outsd dx, dword [esi]
push cs
xchg edx, eax
mov edi, 0xbbda7fea
mov dh, 0xcb
xchg edx, eax
sti
repne scasd eax, dword es:[edi]
and eax, 0xcb025d10
adc esp, eax
call [esi - 0x11f6b2a3]
pop eax
clc
xor dword [eax - 0xbce1b83], edi
mov al, 0xa9
sar byte [ecx + 0x7f1d326b], 1
add byte [eax], 0x27
mov ebx, 0xc16550c9
pop ss
jle 0x100872ff
sub byte [0xd96de173], cl
pushal
dec ebp
sub byte [esi], al
ljmp 0x8918
invalid
shrd cx, si, 5
neg cx
add esp, 0x1c
pushal
mov dword [esp + 0x20], 0x97b4162c
push edi
call fcn.100dcbcd
push eax
lea esp, [esp + 0x34]
call fcn.10025ce0
lahf
jmp 0x1008f55b
jmp 0x100d1ea0
shr eax, 1
mov cl, bl
rol dx, cl
push eax
sbb edx, 0xe3d5b1d4
mov ecx, dword [ebp - 0x24]
adc dh, ch
cmc
stc
cmp bh, ah
shr ecx, 1
pushfd
mov byte [esp], 0x9b
mov dword [esp], ecx
setb dl
movzx dx, bl
movzx dx, al
pushal
mov edx, dword [ebp + 8]
lea esp, [esp + 0x20]
jg 0x10067e74
push esi
lea esp, [esp + 4]
jb 0x10096faa
pushfd
mov dword [esp], edx
call fcn.1009449c
cwde
in al, dx
aad 0xd8
test eax, 0x39801de0
cld
mov ecx, 0x826724fc
pop ss
test al, 0x78
mov al, 0xe7
or edx, dword [eax]
jae 0x100a87e9
pop edi
mov esi, 0xeaaad8ff
pop ebx
or byte [ebx - 0x3a], 0xaf
salc
mov al, 0x68
push ss
invalid
pop esp
inc ecx
scasd eax, dword es:[edi]
ljmp 0xf3e4
push esp
mov byte [esp + 8], dl
pushfd
fild dword [edx + 0x10045510]
pushal
lea esp, [esp + 0x30]
call fcn.1002b560
sar ch, 1
xadd dh, ch
push eax
rdtsc
mov eax, dword [ebp - 0x20]
sar ch, 3
rcl dl, 2
jmp 0x100a875c
push edi
jmp 0x10093a07
pushfd
pushfd
mov dword [esp + 4], edx
jmp 0x1008727e

Function at 0x100b4b35
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0x28], eax
setns dl
mov ecx, dword [ebp - 0x38]
btr dx, 6
push dword [esp + 4]
movzx dx, cl
imul ecx, ecx, 0x120
movsx dx, dl
push 0x55e06f00
call fcn.100e1051
inc ecx
xchg edx, eax
xchg edi, eax
das
sub dword [ecx], ebx
xor byte [ecx], bl
scasd eax, dword es:[edi]
invalid

Function at 0x100b550b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jp 0x100c1615
test ah, 0xeb
cmp dword [0x10047028], 0
jmp loc.1002a771
Function at 0x100be357
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x100a5aff
call fcn.1008ee7f
inc edi
add byte [ebp + 0x49], ch
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
test al, 0x2a
cmp al, 0x59
pop ecx
push ecx
jo 0x1009c9c7
xor al, 1
js 0x1009ca33
add byte [0xe89575d8], bh
in ax, 0x74
or dl, al
jnp 0x1009c9ba
call 0x1a7eaf32
sar byte [ebx - 0x15], 1
mov dl, 0x41
cmp dword [eax + 0x6c], edx
mov al, byte [edx]
invalid
iretd
stosd dword es:[edi], eax
loop 0x1009ca01
cmp bh, byte [edi - 0x1d15d38e]
fisub word [ecx + 0x34ff664b]
push dword [esp]
push dword [sym.imp.mfc100u.dll_delete__]
pop dword [esp + 0x2c]
pushfd
push ebx
push 0xac1ed205
push dword [esp + 0x38]
ret 0x3c
mov dword [esp + 0x40], 0x100d1aba
jmp 0x1009c9ab
pushal
jmp 0x10055493

Function at 0x100ca68e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je fcn.100efb5c
bswap ax
cbw
mov ax, 0x57fb
mov edx, dword [ebp - 0x68]
mov al, 0xd9
imul edx, edx, 0x120
neg ah
setne ah
inc ah
fld dword [edx + 0x100454ac]
neg al
stc
fcomp qword [0x1002f098]
btr ax, di
movzx ax, cl
fnstsw ax
pushfd
test ah, 5
mov byte [esp], ch
jmp loc.1000c676
pushfd
jmp 0x1009c7ad
mov eax, dword [ebp - 0x68]
rcr ch, cl
imul eax, eax, 0x120
xor cx, sp
pushfd
movzx ecx, byte [eax + 0x100454b0]
clc
test ecx, ecx
jmp 0x100a974a

Function at 0x100cd508
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x18
pushfd
push esp
pushfd
sub esp, 0xfffffff4
jg 0x100e94c2
cmp dword [0x10047020], 0
pushfd
lea esp, [esp + 4]
je 0x100a63d9
jmp 0x100af179
mov dword [esp + 0x20], ecx
pushal
pushfd
mov byte [esp + 0x10], al
lea esp, [esp + 0x44]
call fcn.10024bf0
jmp 0x1006b07c
push 0xf2e9c661
call fcn.100d3f2d
xor esp, dword [edx - 9]
xchg dword [ecx + 0x177bf794], edx
pop ss
jg 0x100af18b
mov ebp, ds
sbb al, 0xd5
shr ch, 0xf8
cmc
mov al, 0xdd
lodsb al, byte [esi]
sbb byte [ecx - 0x3c8c960], ch
mov dh, 0xdc
dec esp
pushfd
adc ah, dl
fstp xword [eax - 0x7d4538c4]
cmp esi, dword [0xb0e5f060]
movsb byte es:[edi], byte [esi]
int3
shrd edx, ebx, 0x1d
xor edx, ebp
mov edx, dword [ebp - 0x20]
xor ecx, 0x3c26fe55
adc al, 0xd
pushal
shr edx, 1
bsf cx, bx
mov dword [esp + 0x24], edx
cmc
xchg al, cl
bsf ax, di
rcl ax, 0xb
mov eax, dword [ebp - 0x24]
bts cx, 1
shr eax, 1
bswap ecx
lea ecx, [ebp - 0x6d23c14c]
mov dword [esp + 0x20], eax
push 0x88dd83f7
mov word [esp + 8], bp
mov ecx, dword [ebp + 8]
jmp 0x10071106
pushfd
push dword [esp]
mov word [esp + 4], 0x16ac
clc
cmp dword [0x10047020], 0
mov word [esp + 4], 0x84ee
mov byte [esp + 4], 0xff
pushal
lea esp, [esp + 0x28]
je 0x100a63d9
pushal
push ecx
call fcn.10063d37
fnstsw word [edi + 0x72]
scasb al, byte es:[edi]
nop
movsd dword es:[edi], dword [esi]
sbb dword [edx], esi
and eax, dword [edi]
outsd dx, dword [esi]
jmp 0x15a332e7
Function at 0x100e1051
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x28]
jmp fcn.100073e9
pop eax
mov edx, dword [ecx + 0x10045510]
sets ah
call fcn.100594fa
fbstp tbyte [esi]
jae 0x100e10b2
jg 0x100e10b4
sbb dword [edx], 0x43
inc edx
cmp esi, dword [esi + 0x1e]
push edx
sbb al, 0x82
adc eax, edx
sbb eax, 0x13b14bd5
les ebx, [ebx]
sub dword [ebx - 0x5e], ebp
pop ebp
cmp esp, edx
sub eax, 0x19c06190
nop
stc
outsd dx, dword [esi]
popal
and eax, 0xc9d6a35a
scasb al, byte es:[edi]
or bh, byte [ebx]
movsd dword es:[edi], dword [esi]
inc eax
in eax, 0x93
lodsd eax, dword [esi]
mov dl, 0xeb
lodsd eax, dword [esi]
clc
js 0x100e1043
xor ebp, dword [ecx]
je 0x100e10a8
or byte [ecx - 0x38], 0x8e
ljmp 0xe9ff
invalid
push ebp
call fcn.100f297b
invalid
ret

Function at 0x100e1d1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax*2 + 0x4b6867dc]
bswap eax
not eax
push edx
not ah
push 0xfffffffffffffff9
pushfd
movsx ax, dl
mov eax, dword [ebp + 8]
pushal
pushal
mov dword [esp + 0x40], eax
mov byte [esp], ah
lea esp, [esp + 0x40]
call fcn.10025ce0
dec dx
dec dl
shr dl, 2
sbb cl, bl
add esp, 0x1c
stc
btr dx, 0xc
push 0xffff0000
lea edx, [ebx + 0x5cd538ea]
movzx cx, al
not dh
mov ecx, dword [ebp - 0x5c]
seta dl
imul ecx, ecx, 0x120
rcr dh, 4
bt esi, 0xc
or dh, 0x67
add ecx, 0x10045540
push 0x36ec1ce9
mov byte [esp], 0x21
mov dword [esp], ecx
pushfd
pushal
mov edx, dword [ebp + 8]
pushal
pushfd
call fcn.10066fca
mov dword [esp + 4], 0x97ad3517
mov word [esp], 0xcd1e
jmp 0x100d0741
pushal
mov dword [esp + 0x20], 0xc5b19929
pushal
mov dword [esp + 4], 0x52e2dee6
push 0x209096c
push dword [esp + 8]
lea esp, [esp + 0x48]
jmp fcn.10003b8a
stc
mov dword [esp], eax
pushfd
mov ecx, dword [ebp - 0x5c]
rdtsc
setle ah
cmc
imul ecx, ecx, 0x120
pop edx
rdtsc
cdq
movzx ax, bl
mov edx, dword [ecx + 0x10045510]
jmp 0x100bdf42

Function at 0x100e50f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x20]
call fcn.10024bf0
clc
add esp, 0x18
pushfd
cmp ch, 0x9e
push eax
cmp dword [0x10047020], 0
pushal
jmp 0x100ec801
push ebp
lea esp, [esp + 0x2c]
je 0x100ee7d2
jmp 0x100f5abc
lea esp, [esp + 0x5c]
call fcn.1002b560
and dl, ah
push eax
sal ch, 2
rdtsc
rcl cx, 0xe
mov ecx, dword [ebp - 0x20]
clc
shr ecx, 1
stc
rdtsc
push ecx
xor ax, 0x2721
test sp, ax
mov edx, dword [ebp - 0x24]
and ah, 0xda
shl ah, cl
shr edx, 1
bswap ax
jmp 0x100e6187
lea eax, [ebp + 0x325afe0e]
push edx
movsx ax, cl
pushal
mov eax, dword [ebp + 8]
pushfd
mov dword [esp + 0x20], eax
jmp 0x10072ef8
jmp 0x100ce3ec
call fcn.1008ac6c

Function at 0x100e9839
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
mov dword [esp + 4], 0x97af9526
pushfd
mov dword [esp + 4], 0x365af125
push 0x54277e00
pushal
pushfd
push edx
lea esp, [esp + 0x30]
jmp fcn.10004ecb
mov dword [esp + 4], 0xa
call int.1004da33
push 0x97b0b76b
pushal
pushfd
pushal
call fcn.10069f13
jmp 0x10056a15
cmp dword [0x10047020], 0
pushal
pushfd
lea esp, [esp + 0x2c]
je 0x100a63d9
pushfd
pushfd
jmp 0x10071cd7
Function at 0x100ee5ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], 0x100e3039
jmp 0x100a6571
cmc
push 0x3909f1ca
cmp dword [0x10047020], 0
pushfd
lea esp, [esp + 8]
je 0x100a63d9
push ecx
pushal
mov dword [esp + 0x20], 0xa
jmp 0x1006509c
lea esp, [esp + 4]
je 0x100bcd22
bswap dx
rcl ch, 5
mov ecx, dword [ebp - 0x68]
ror ax, 5
lea eax, [esp + 0x61e73f88]
imul ecx, ecx, 0x120
btr dx, sp
setae al
movzx edx, word [ecx + 0x10045520]
rcl ch, cl
rcr cl, cl
push edx
rdtsc
mov al, 0x8a
bswap ax
rdtsc
mov eax, dword [ebp - 0x68]
call fcn.100af5d3
call fcn.10052107
clc
bt bx, 6
jmp 0x100ea6ff
mov byte [esp + 0x18], bh
call fcn.1000dd28
dec esp
pop ebx
push edx
cmpsb byte [esi], byte es:[edi]
xor al, byte [eax - 0x3f]
aas
invalid
bswap eax
push 0x51a2e513
lea ecx, [ecx - 0x3f44c7c4]
btc eax, ecx
mov dword [esp], 0xffff0000
push 0xd5ff20fe
cmc
not al
setl ah
mov eax, dword [ebp - 0x68]
rol ch, cl
pushfd
imul eax, eax, 0x120
or ch, cl
push ecx
add eax, 0x10045540
pop ecx
movzx cx, al
mov dword [esp + 4], eax
jmp 0x100c2a6e
mov ecx, dword [ebp + 8]
jmp 0x100d62ea
mov dword [esp], ecx
jmp loc.1000805b
pushfd
cmp dword [0x10047024], 0
mov byte [esp], dl
jmp 0x100869be
lea esp, [esp + 8]
jp 0x100c1615
clc
cmp dword [0x10047028], 0
pushfd
push dword [esp]
mov word [esp + 4], 0x85bf
lea esp, [esp + 8]
je 0x10085609
lahf
lea eax, [esp - 0x62546e51]
movsx ax, cl
lahf
push 0xffff0000
rol ax, 0xe
mov eax, dword [ebp - 0x68]
pushal
imul eax, eax, 0x120
call fcn.1005999a
mov byte [esp + 4], ah
mov byte [esp], al
mov dword [esp + 0x20], 0x803ee4b1
push dword [esp + 4]
mov byte [esp + 4], 0x71
mov byte [esp + 0xc], 0x9f
lea esp, [esp + 0x24]
jmp fcn.10003614

Function at 0x100f1324
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x44], ecx
pushfd
lea esp, [esp + 0x48]
call fcn.10025ce0
aas
rdtsc
sub dl, dh
xchg dh, cl
add esp, 0x1c
btr ecx, 0xc
rcr ax, cl
mov edx, dword [ebp + 8]
setl cl
bts eax, 0x1f
push edx
pushfd
bswap cx
pushfd
ror dword [edi], 0xba
call 0x76ab656f
bswap ecx
pushal
rdtsc
mov dword [esp + 0x20], 0xff7fff00
pushal
cdq
mov dx, 0xbcf6
mov dword [esp + 0x3c], 1
clc
mov eax, dword [ebp - 0xb4]
cmc
bt sp, bp
clc
imul eax, eax, 0x120
call fcn.10068d67
je 0x100f13c0
jle 0x100f130d
mov al, byte [0x2697b2ac]
cdq
mov byte [0x62f352e7], al
xchg edi, eax
lahf
outsb dx, byte [esi]
dec ebp
inc esp
jae 0x100f1347
add cl, al
salc
xor eax, eax
add eax, 0x28059474
mov dl, 0x8b
les edi, [ecx + esi*4 - 0x59c70b40]
clc
outsb dx, byte [esi]
fldenv [ebx + ecx*4 + 0x661835b7]
xor ebx, dword [edx - 0x32]
pushfd
or al, 0xcc
push edi
mov esp, 0xac415c1d
pop esp
inc ecx
lodsb al, byte [esi]
insd dword es:[edi], dx
cwde
fnstenv [ebx + 0x45]
cmpsd dword [esi], dword es:[edi]
or eax, 0x2623ea7d
fstp dword [edi + 0x79]
loope 0x100f13e9
xor edi, ebx
sahf
js 0x100f13bc
dec esp
in al, dx
push eax
mov esp, 0x5845d439
sbb dword [eax + 0x7e4ea8e], ebp
add ebp, ecx
cld
pminsw mm7, qword [edi - 0x3c09504a]
into
xchg edi, eax
retf 0xcaf3
Function at 0x100f5afc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
mov dword [esp + 0x10], edx
rdtsc
clc
mov eax, dword [ebp - 0x68]
movsx edx, bl
imul eax, eax, 0x120
pushfd
not cx
mov ecx, dword [eax + 0x1004551c]
jmp 0x100d73cd

Function at 0x100f6c7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dh
not ch
lahf
mov edx, dword [ebp - 0xc0]
cmc
mov byte [esp + 0xc], dh
not eax
imul edx, edx, 0x120
lahf
pop ecx
mov eax, dword [edx + 0x10045514]
clc
xchg cx, dx
not edx
movsx ecx, al
mov dword [esp + 8], eax
movzx cx, bl
bts dx, 0xb
mov ecx, dword [ebp - 0xc0]
push ebx
imul ecx, ecx, 0x120
setns dh
not dl
pushal
jmp 0x1009a3fa
call fcn.100ec0da
mov edx, dword [ecx + 0x10045510]
mov byte [esp], 0x7e
push 0xc7576cf
mov dword [esp + 0x2c], edx
call fcn.10091e60
jnp 0x1009a42a
pop ebx
sti
int 0x94
sbb dword [esi], edi
mov esp, 0x7aec17e
mov byte [0xcecff6af], al
mov edi, 0x36eea7f2
lahf
mov dh, 0x70
popal
or dword [edi], edi
invalid
pushfd
mov dword [esp + 0x44], edx
jmp 0x10097c32
imul edx, edx, 0x120
rcl cl, cl
bswap cx
ror ax, cl
movzx ecx, cl
mov eax, dword [edx + 0x10045514]
rcr dx, 0xa
mov dword [esp + 0x1c], eax
bswap edx
bts dx, bx
mov ecx, dword [ebp - 0xc0]
push dword [esp + 0x18]
bts dx, 1
btr dx, 8
imul ecx, ecx, 0x120
not dl
bswap dx
setl dl
mov edx, dword [ecx + 0x10045510]
push 0x6b8f7ad3
pushal
jmp 0x100b06d6
push ebp
mov byte [esp], 0x98
lea esp, [esp + 4]
call fcn.10025ce0
btr ax, ax
bsr eax, ebp
add esp, 0x1c
ror ch, 7
mov eax, dword [ebp + 8]
clc
push eax
bswap edx
pushal
ror dh, 6
mov dword [esp + 0x1c], 0xff0000ff
cdq
rcl edx, cl
push edx
mov dword [esp + 0x1c], 1
lea eax, [esp - 0x4c8f006c]
movzx cx, al
btr cx, bx
rdtsc
mov ecx, dword [ebp - 0xc0]
bswap eax
rcr dx, 7
rcr dx, cl
imul ecx, ecx, 0x120
bts ax, dx
mov edx, dword [ecx + 0x1004551c]
bt bp, dx
cmc
mov dword [esp + 0x18], edx
pop eax
mov eax, dword [ebp - 0xc0]
mov cl, bl
imul eax, eax, 0x120
bswap dx
mov ecx, dword [eax + 0x10045518]
ror ax, cl
setge dh
cdq
xchg dword [esp + 0x10], ecx
jmp 0x10093548
mov edx, dword [ebp + 8]
pushfd
push 0x87db6a02
mov dword [esp + 0x30], edx
push 0x5ffbda3
lea esp, [esp + 0x34]
jp 0x100eae46
pushal
pushfd
lea esp, [esp + 0x24]
call fcn.10025ce0
dec ecx
shr edx, 0x15
add esp, 0x1c
bts ax, 6
cdq
pushfd
mov eax, dword [ebp + 8]
setge dl
pushfd
setle cl
btr cx, bx
xchg dword [esp + 4], eax
not edx
mov dword [esp], 0xff0000ff
rcr al, 7
mov ah, 0xd6
ror edx, 0xa
push 1
clc
bts edx, esp
pushfd
lea edx, [ecx*2 - 0x4025021e]
mov ecx, dword [ebp - 0xc0]
clc
bswap eax
bt eax, eax
imul ecx, ecx, 0x120
not al
pushal
ror dl, cl
bts ax, 9
mov edx, dword [ecx + 0x1004551c]
bt di, di
rcr al, cl
clc
not ecx
mov dword [esp + 0x20], edx
xchg ah, dh
rol cl, 1
bts ax, 0xc
mov eax, dword [ebp - 0xc0]
lea edx, [ebx*8 + 0x7632bd9b]
movzx dx, dl
pushfd
movzx cx, al
imul eax, eax, 0x120
ror dl, cl
clc
mov ecx, dword [eax + 0x10045518]
cdq
mov dword [esp + 0x20], ecx
rdtsc
cmc
setno dl
mov edx, dword [ebp - 0xc0]
btr cx, 3
mov byte [esp + 0x14], 0xe
jmp 0x100b2b5d
Function at 0x40210c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x170], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
push 0x4310f4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
je 0x40219e
mov ecx, dword [ebp - 0x174]
push ecx
push 0
push 0x1109
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + 0xc8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x174]
push ecx
push 1
push 0x1003
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + 0x10c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x178]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x4021f1
mov ecx, dword [ebp - 0x17c]
add ecx, 0xac
call fcn.00403060
push 0xffff0000
push 0
mov edx, dword [ebp - 0x178]
push edx
mov ecx, dword [ebp - 0x17c]
add ecx, 0xac
call fcn.004012ba
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x178]
push edx
call dword [ecx + 8]
mov dword [ebp - 0xc], 0xffff0000
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x4015ad
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x17c]
add ecx, 0xac
call fcn.00401d50
push 0x4028d5
mov ecx, dword [ebp - 0x17c]
add ecx, 0xac
call fcn.00402a30
push 0x4022d9
mov ecx, dword [ebp - 0x17c]
add ecx, 0xac
call fcn.00402a50
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x17c]
add ecx, 0xac
call fcn.0040105f
mov esp, ebp
pop ebp
ret 4
Function at 0x40568b
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov dword [ebp - 0x134], ecx
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x120]
push ecx
call fcn.00412be0
add esp, 8
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x124]
mov byte [edx], 0
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 0x128], 0x640065
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x128]
push edx
call sub.ASUSBIOS.dll_Ordinal_1
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x405782
cmp dword [ebp - 0x130], 0x6b
jne 0x405732
mov eax, 0x64
jmp 0x405795
cmp dword [ebp - 0x130], 0x6a
jne 0x405742
mov eax, 0x65
jmp 0x405795
cmp dword [ebp - 0x130], 0x64
jne 0x405752
mov eax, 0x66
jmp 0x405795
cmp dword [ebp - 0x130], 0x65
jne 0x405762
mov eax, 0x67
jmp 0x405795
cmp dword [ebp - 0x130], 0x66
jne 0x405772
mov eax, 0x68
jmp 0x405795
cmp dword [ebp - 0x130], 0x67
jne 0x405782
mov eax, 0x69
jmp 0x405795
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40cadf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREASUSAsusUpdate
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cb6b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.Options
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40cb52
cmp dword [ebp - 8], 4
jne 0x40cb52
mov edx, dword [ebp - 0x10]
and edx, 1
sub edx, 1
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x8a8], edx
jmp 0x40cb5f
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x8a8], 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40cb78
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x8a8], 0
mov esp, ebp
pop ebp
ret
Function at 0x410027
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0x432344
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call fcn.00401a80
push eax
call fcn.00410250
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4100b1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4100b1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
shl ecx, 4
add ecx, 0x20
push ecx
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x60], eax
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x60]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00410260
mov edx, dword [ebp - 4]
push edx
call fcn.00410240
cmp dword [ebp - 4], 0
je 0x4100c1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x10]
call fcn.00424701
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x410802
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [ebp + 0xc]
push eax
push 0x160
lea ecx, [ebp - 0x160]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x15c]
mov esp, ebp
pop ebp
ret
Function at 0x411317
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREASUSLDCM60BIOSFLASH
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0
push str.Error_Code
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 4

Function at 0x4113fd
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x110], 0
cmp dword [ebp + 0xc], 0
je 0x4114cd
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4114cd
lea ecx, [ebp - 8]
push ecx
push 0x10008
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4114cd
cmp dword [ebp - 0x114], 0
jne 0x4114c3
mov dword [ebp - 4], 0x104
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x103
jne 0x4114a5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x4114c3
cmp dword [ebp - 0x114], 0
jne 0x4114c1
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004113fd
add esp, 8
jmp 0x411454
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x4118c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x640065
push 0x432624
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push 0x1c
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x24]
push eax
call sub.ASUSBIOS.dll_Ordinal_1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x411a1b
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
sub edx, 0x64
mov dword [ebp - 0x134], edx
cmp dword [ebp - 0x134], 7
ja case.0x411940.2
mov eax, dword [ebp - 0x134]
jmp dword [eax*4 + 0x411a36]
lea ecx, [ebp - 0x12c]
push ecx
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [ebp - 0x12c]
push edx
push str.Can_not_find_driver_BS_DEF.DLL_under__s
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x20], 0x64
jmp case.0x411940.2
push str.Can_not_open_NT_SCM_DataBase_for_BS_DEF.DLL
lea ecx, [ebp - 0xac]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [ebp - 0x20], 0x66
jmp case.0x411940.2
push str.Can_not_create_NT_driver_service_for_BS_DEF.DLL
lea edx, [ebp - 0xac]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [ebp - 0x20], 0x67
jmp case.0x411940.2
push str.Can_not_open_BS_DEF.DLL_driver
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [ebp - 0x20], 0x68
jmp case.0x411940.2
push str.NT_service_registry_error__Please_reboot_NT_and_run_again
lea ecx, [ebp - 0xac]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [ebp - 0x20], 0x65
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x130]
call fcn.00411317
push 0x30
push str.ASUS_Flash_BIOS_Program_for_Windows_Platform
lea eax, [ebp - 0xac]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x411a2b
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 8