joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1807b6fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 8
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1807b72f
cmp dword [ebp - 8], 3
jne 0x1807b72f
cmp dword [ebp - 4], esi
jne 0x1807b72f
mov al, 1
jmp 0x1807b73f
push esi
push 0
push dword [ebp + 8]
call fcn.180a89f0
add esp, 0xc
xor al, al
pop esi
leave
ret

Function at 0x1807b742
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x20
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1807b777
cmp dword [ebp - 8], 3
jne 0x1807b777
cmp dword [ebp - 4], esi
jne 0x1807b777
mov al, 1
jmp 0x1807b787
push esi
push 0
push dword [ebp + 8]
call fcn.180a89f0
add esp, 0xc
xor al, al
pop esi
leave
ret

Function at 0x1807b8af
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push 4
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x1807b8d9
push ecx
mov ecx, 0x180ff140
call fcn.18041615
mov eax, 0x80040884
jmp 0x1807b95e
mov eax, dword [esi]
mov edx, dword [esi + 0xc]
add eax, 4
mov ecx, dword [esi + 8]
push edi
push eax
call fcn.1807cb2e
mov ecx, dword [esi]
movzx eax, byte [esi + 0x10]
push dword [ecx]
push eax
lea eax, [ecx + 0x10]
push str._d:_u
push eax
call fcn.18011d09
mov edx, dword [esi]
lea ecx, [ebp - 4]
add esp, 0x14
add edx, 4
call fcn.180105a7
mov ecx, dword [esi]
push eax
add ecx, 0x14
call fcn.18005b84
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18003140
push 0
push 0x3f
lea ecx, [esi + 4]
call fcn.18009d6b
mov ecx, str._1cup2key_2cup2hreq_3
cmp eax, 0xffffffff
jne 0x1807b943
mov ecx, str._1_cup2key_2cup2hreq_3
mov eax, dword [esi]
push dword [eax + 0x14]
push dword [eax + 0x10]
add eax, 0x18
push dword [esi + 4]
push ecx
push eax
call fcn.1803b18e
add esp, 0x14
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1807d9dc
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
mov esi, ecx
call fcn.180663aa
call fcn.18067682
mov ebx, eax
call fcn.18067682
mov edx, str.AuCheckPeriodMs
mov ecx, str.HKLMSoftwareASUSUpdateDev_
mov edi, eax
call fcn.18012ab0
test al, al
jne 0x1807da33
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1807da33
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x927c1
div ecx
lea edi, [edx + 0x493e0]
and dword [ebp - 0x50], 0
lea eax, [ebp - 0x44]
sub esp, 0x2c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x74]
mov esi, esp
mov dword [ebp - 0x44], 0x180f4fb4
lea ecx, [ebp - 0x44]
push eax
call fcn.1807db84
and dword [esi + 0x24], 0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x50], eax
call fcn.1807e198
lea ecx, [ebp - 0x74]
mov dword [esi + 0x24], eax
call fcn.1802b171
mov ecx, dword [ebp + 8]
push ebx
push edi
call fcn.1807dffa
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.1802b171
test esi, esi
jns 0x1807dacb
movzx ecx, byte [0x18101323]
neg ecx
sbb ecx, ecx
and ecx, 0x18101240
je 0x1807dac7
or dword [ebp - 0x10], 0xffffffff
push 7
pop eax
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call fcn.1800457f
push esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push str._Failed_to_start_update_worker_scheduler__0x_08x_
push eax
call fcn.18002ca6
add esp, 0xc
mov eax, esi
jmp 0x1807dacd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1808ab75
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov byte [ebp - 4], dl
push 1
lea edx, [ebp - 4]
mov ecx, dword [esi]
not ecx
call fcn.180869a2
mov ecx, dword [esi + 8]
lea edx, [ebp - 4]
not eax
not ecx
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
call fcn.180869a2
pop ecx
not eax
pop ecx
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x1808abc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov dword [ebp - 4], ecx
xor edx, edx
mov dword [ebp - 0xc], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edx
jb 0x1808ac54
ja 0x1808abe4
cmp dword [ebp + 0xc], edx
jbe 0x1808ac54
test eax, eax
je 0x1808ac32
mov eax, dword [ebp + 8]
mov bl, byte [edi + eax]
mov ax, word [ecx + 8]
mov dl, bl
or ax, 2
movzx esi, ax
call fcn.1808ab75
mov eax, esi
mov ecx, esi
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 0xc]
shr ecx, 8
xor cl, bl
mov byte [edi + eax], cl
add edi, 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x1808abe8
ja 0x1808ac54
cmp edi, dword [ebp + 0xc]
jb 0x1808abe8
jmp 0x1808ac54
mov ebx, dword [ebp + 8]
mov esi, edx
mov dl, byte [esi + ebx]
call fcn.1808ab75
mov ecx, dword [ebp - 4]
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x1808ac37
ja 0x1808ac54
cmp esi, dword [ebp + 0xc]
jb 0x1808ac37
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1808acbc
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xf0000040
push 0x18
push 0
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1808acff
push esi
push 0xb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1808acff
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x1808acff
mov al, 1
jmp 0x1808ad01
xor al, al
pop esi
leave
ret
Function at 0x1808dbb2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
mov esi, edx
test esi, esi
jne 0x1808dbc6
mov eax, 0x80070057
jmp 0x1808dc30
push edi
xor eax, eax
mov dword [ebp - 0x54], 0x44
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
xor edi, edi
push edi
push eax
call fcn.180a89f0
add esp, 0xc
mov dword [ebp - 0x28], 0x80
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
jne 0x1808dc1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1808dc30
movzx eax, ax
or eax, 0x80070000
jmp 0x1808dc30
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
pop esi
leave
ret

Function at 0x1808de97
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
push esi
mov esi, edx
mov byte [ebp - 1], cl
jne 0x1808deb3
mov eax, 0x80070057
jmp 0x1808dfd9
mov ecx, dword [ebp + 0xc]
push edi
call fcn.18005cb1
lea eax, [ebp - 8]
xor edi, edi
push eax
movzx eax, byte [ebp - 1]
push 0x20019
push edi
push dword [esi]
sub eax, 0x7fffffff
mov dword [ebp - 8], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1808def4
jle 0x1808dfd8
movzx eax, ax
or eax, 0x80070000
jmp 0x1808dfd8
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], edi
push eax
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], edi
push eax
mov eax, dword [ebp + 8]
push edi
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x1808df35
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x1808df2e
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x1808dfd8
xor edi, edi
inc edi
cmp dword [ebp - 0x14], edi
je 0x1808df43
cmp dword [ebp - 0x14], 2
jne 0x1808df49
cmp dword [ebp - 0xc], 0
jne 0x1808df59
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x8007000d
jmp 0x1808dfd8
lea ecx, [ebp - 0x10]
call fcn.18005c3b
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
shr ecx, 1
mov eax, dword [esi - 8]
sub edi, dword [esi - 4]
sub eax, ecx
or edi, eax
jge 0x1808df81
push ecx
lea ecx, [ebp - 0x10]
call fcn.18006135
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1808dfc3
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x10]
shr eax, 1
push eax
call fcn.18005e57
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.18005b84
jmp 0x1808dfce
jle 0x1808dfce
movzx edi, di
or edi, 0x80070000
lea ecx, [esi - 0x10]
call fcn.18003140
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1808f3e1
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x180fd00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x158], edi
mov esi, ebx
lea edx, [edi + 0x10]
movzx ecx, byte [edx]
lea edx, [edx + 4]
movzx eax, byte [edx - 3]
shl eax, 0x10
shl ecx, 0x18
or ecx, eax
movzx eax, byte [edx - 2]
shl eax, 8
or ecx, eax
movzx eax, byte [edx - 1]
or ecx, eax
mov dword [ebp + esi*4 - 0x144], ecx
inc esi
cmp esi, 0x10
jl 0x1808f406
push 0x50
pop edx
lea ecx, [ebp + esi*4 - 0x17c]
sub edx, esi
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x1808f440
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x5c]
mov esi, dword [edi + 0x58]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov eax, dword [edi + 0x54]
mov dword [ebp - 0x148], eax
mov eax, dword [edi + 0x60]
mov edi, dword [ebp - 0x148]
mov dword [ebp - 0x14c], ecx
jmp 0x1808f48d
mov eax, dword [ebp - 0x148]
mov edx, dword [ebp - 0x150]
rol edx, 5
add edx, dword [ebp + ebx*4 - 0x144]
add edx, eax
cmp ebx, 0x14
jae 0x1808f4b3
mov eax, ecx
xor eax, esi
and eax, edi
xor eax, ecx
add eax, 0x5a827999
jmp 0x1808f4f2
cmp ebx, 0x28
jae 0x1808f4c5
mov eax, ecx
xor eax, esi
xor eax, edi
add eax, 0x6ed9eba1
jmp 0x1808f4f2
cmp ebx, 0x3c
jae 0x1808f4e7
mov ecx, esi
mov eax, esi
or ecx, edi
and eax, edi
and ecx, dword [ebp - 0x14c]
or eax, ecx
mov ecx, dword [ebp - 0x14c]
add eax, 0x8f1bbcdc
jmp 0x1808f4f2
mov eax, ecx
xor eax, esi
xor eax, edi
add eax, 0xca62c1d6
add eax, edx
mov dword [ebp - 0x14c], esi
mov edx, ecx
mov ecx, esi
mov esi, edi
mov dword [ebp - 0x148], edx
mov edi, dword [ebp - 0x150]
ror esi, 2
inc ebx
mov dword [ebp - 0x150], eax
cmp ebx, 0x50
jl 0x1808f487
add eax, dword [ebp - 0x154]
mov dword [ebp - 0x148], edi
mov edi, dword [ebp - 0x158]
add dword [edi + 0x5c], ecx
add dword [edi + 0x58], esi
add dword [edi + 0x60], edx
mov ecx, dword [ebp - 4]
mov dword [edi + 0x50], eax
xor ecx, ebp
mov eax, dword [ebp - 0x148]
add dword [edi + 0x54], eax
pop edi
pop esi
pop ebx
call fcn.180a61d8
leave
ret

Function at 0x1808f555
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov dword [eax], fcn.1808f555
mov dword [eax + 0x50], 0x67452301
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
mov dword [eax + 0x60], 0xc3d2e1f0
pop ebp
ret
Function at 0x1808f6ee
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x180fd00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x124], edi
lea edx, [edi + 0x10]
movzx ecx, byte [edx]
lea edx, [edx + 4]
movzx eax, byte [edx - 3]
shl eax, 0x10
shl ecx, 0x18
or ecx, eax
movzx eax, byte [edx - 2]
shl eax, 8
or ecx, eax
movzx eax, byte [edx - 1]
or ecx, eax
mov dword [ebp + esi*4 - 0x104], ecx
inc esi
cmp esi, 0x10
jl 0x1808f711
push 0x40
pop eax
sub eax, esi
lea ebx, [ebp + esi*4 - 0x10c]
mov dword [ebp - 0x108], eax
mov edi, eax
mov ecx, dword [ebx - 0x34]
mov esi, ecx
mov edx, dword [ebx]
mov eax, ecx
rol esi, 0xe
lea ebx, [ebx + 4]
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub edi, 1
jne 0x1808f753
mov edi, dword [ebp - 0x124]
mov eax, dword [edi + 0x50]
mov ebx, eax
mov edx, dword [edi + 0x54]
mov dword [ebp - 0x128], eax
mov eax, dword [edi + 0x58]
mov dword [ebp - 0x114], eax
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0x120], eax
mov eax, dword [edi + 0x60]
mov dword [ebp - 0x10c], eax
mov eax, dword [edi + 0x64]
mov dword [ebp - 0x118], eax
mov eax, dword [edi + 0x68]
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x6c]
xor edi, edi
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x108], eax
mov ecx, edx
mov esi, ebx
xor ecx, ebx
ror esi, 0xd
and ecx, dword [ebp - 0x114]
and edx, ebx
xor ecx, edx
mov eax, ebx
rol eax, 0xa
xor esi, eax
mov eax, ebx
ror eax, 2
xor esi, eax
add esi, ecx
mov ecx, dword [ebp - 0x10c]
mov edx, ecx
mov eax, ecx
rol eax, 7
ror edx, 0xb
xor edx, eax
mov eax, ecx
ror eax, 6
not ecx
and ecx, dword [ebp - 0x11c]
xor edx, eax
mov eax, dword [ebp - 0x118]
and eax, dword [ebp - 0x10c]
xor ecx, eax
mov eax, dword [ebp - 0x11c]
add edx, ecx
mov ecx, dword [ebp - 0x120]
add edx, dword [edi + 0x180e1910]
add edx, dword [ebp + edi - 0x104]
add edi, 4
add edx, dword [ebp - 0x108]
mov dword [ebp - 0x108], eax
add ecx, edx
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x110], ebx
lea ebx, [edx + esi]
mov edx, dword [ebp - 0x110]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x114], eax
cmp edi, 0x100
jl 0x1808f7df
mov edi, dword [ebp - 0x124]
mov eax, dword [ebp - 0x128]
add eax, ebx
add dword [edi + 0x60], ecx
add dword [edi + 0x54], edx
mov ecx, dword [ebp - 0x118]
add dword [edi + 0x64], ecx
mov edx, dword [ebp - 0x114]
add dword [edi + 0x58], edx
mov ecx, dword [ebp - 0x11c]
add dword [edi + 0x68], ecx
mov ecx, dword [ebp - 0x108]
add dword [edi + 0x6c], ecx
mov edx, dword [ebp - 0x120]
add dword [edi + 0x5c], edx
mov ecx, dword [ebp - 4]
mov dword [edi + 0x50], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.180a61d8
leave
ret
Function at 0x1808f901
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov dword [eax], fcn.1808f901
mov dword [eax + 0x50], 0x6a09e667
mov dword [eax + 0x54], 0xbb67ae85
mov dword [eax + 0x58], 0x3c6ef372
mov dword [eax + 0x5c], 0xa54ff53a
mov dword [eax + 0x60], 0x510e527f
mov dword [eax + 0x64], 0x9b05688c
mov dword [eax + 0x68], 0x1f83d9ab
mov dword [eax + 0x6c], 0x5be0cd19
pop ebp
ret

Function at 0x18091f8d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push 9
sub edx, ecx
pop esi
mov eax, dword [edx + ecx]
xor eax, dword [ecx]
and eax, dword [ebp + 8]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x18091f96
pop esi
pop ebp
ret
Function at 0x18092c0d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov ecx, 0x180fead8
push edi
call fcn.1801a740
mov ecx, 0x180fe998
mov dword [esi + 0xc], 0xc
call fcn.1801a740
xor eax, eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.18005c3b
push str.update
mov esi, 0x180ee624
lea eax, [ebp - 4]
push esi
push eax
call fcn.18011d09
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.180929fb
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x18092ce6
cmp ebx, dword [ebp - 0x18]
je 0x18092c7e
mov edi, 0x80040712
jmp 0x18092de1
push str.uninstall
lea eax, [ebp - 4]
push esi
push eax
call fcn.18011d09
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.180929fb
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x18092ce6
cmp ebx, dword [ebp - 0x18]
je 0x18092cb1
mov edi, 0xa0430721
jmp 0x18092de1
push str.install
lea eax, [ebp - 4]
push esi
push eax
call fcn.18011d09
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.180929fb
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x18092ce6
mov edi, dword [ebp - 0x18]
cmp ebx, edi
je 0x18092ce6
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x18092cf0
mov edi, 0x80040706
jmp 0x18092de1
push eax
lea ecx, [ebp - 8]
call fcn.18005bdc
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
je 0x18092dd4
push 0
push str.AsusUpdate.exe
lea ecx, [ebp - 8]
call fcn.18010991
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x18092dd4
push str.AsusUpdate.exe
call fcn.180ac191
add eax, dword [ebp - 0xc]
pop ecx
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.18005d9f
push 0x22
pop ecx
cmp cx, ax
mov ecx, dword [ebp - 0xc]
jne 0x18092d47
inc ecx
mov eax, dword [esi - 0xc]
sub eax, ecx
lea ecx, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.18009cb4
lea ecx, [ebp - 0x10]
call fcn.18057cb9
and dword [ebp - 0xc], 0
sub edi, ebx
sar edi, 2
test edi, edi
je 0x18092db0
lea ecx, [ebp - 8]
call fcn.18005c3b
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [ebx + ecx*4]
call fcn.18013da7
test eax, eax
js 0x18092d9a
push 0
push dword [ebp - 0x10]
lea ecx, [ebp - 8]
call fcn.18010991
cmp eax, 0xffffffff
jne 0x18092dc2
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.18003140
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, edi
jb 0x18092d6e
mov edi, 0x80040711
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.18003140
jmp 0x18092dd9
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18003140
mov edi, 0x80040710
jmp 0x18092db5
mov edi, 0x80040706
lea ecx, [esi - 0x10]
call fcn.18003140
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18003140
test ebx, ebx
je 0x18092e01
mov ecx, dword [ebp - 0x14]
sub ecx, ebx
and ecx, 0xfffffffc
push ecx
push ebx
call fcn.180064b3
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x18094084
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x180fd00c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx ecx, byte [0x18101323]
push ebx
push esi
neg ecx
push edi
sbb ecx, ecx
push 7
pop edi
and ecx, 0x18101240
je 0x180940d3
xor eax, eax
mov dword [ebp - 0x38], ecx
inc eax
mov dword [ebp - 0x34], edi
push eax
push edi
mov dword [ebp - 0x30], eax
call fcn.1800457f
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push str._StartService_
push eax
call fcn.18002ca6
pop ecx
pop ecx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
jne 0x180940f7
call fcn.18015f1f
mov ebx, eax
jmp 0x1809417a
lea ecx, [ebp - 0x24]
call fcn.180542c4
push 0x14
push dword [ebp - 0x24]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x1809411a
call fcn.18015f1f
mov ebx, eax
jmp 0x18094157
mov ecx, edi
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1809413e
cmp dword [ebp - 0x1c], 4
je 0x18094157
cmp dword [ebp - 0x1c], 2
je 0x18094157
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x18094157
call fcn.18015f1f
cmp eax, 0x80070420
jne 0x1809415d
test esi, esi
je 0x18094166
jmp 0x1809415f
mov ebx, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.18003140
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.180a61d8
leave
ret
Function at 0x1809942c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push esi
mov dword [ebp - 4], esi
lea eax, [esi + 8]
push eax
call fcn.1805e53b
movzx edx, word [esi + 0xe8]
xor ebx, ebx
push ecx
push ecx
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
mov ecx, dword [0x18100118]
push ebx
call fcn.1809a76d
add esp, 0xc
cmp dword [esi + 0x24], ebx
jge 0x1809947f
test eax, eax
je 0x18099483
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18099483
test eax, eax
jne 0x1809948d
mov eax, 0x80040e80
jmp 0x180995d4
push dword [esi + 0x130]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi + 4]
call edi
push ecx
mov ecx, esi
call fcn.180995d9
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7d8
push dword [esi + 4]
call ebx
mov esi, eax
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push dword [eax + 0x124]
push esi
call edi
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.1809962f
push 2
push 0xff
push 0
lea edi, [esi + 4]
push dword [edi]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0
mov ecx, edi
call fcn.180076cd
mov ecx, dword [edi]
lea eax, [esi + 0x134]
push eax
call fcn.1801839e
sub esp, 0xc
lea ecx, [esi + 0x128]
push 0x5a
call fcn.1809981f
push ecx
push ecx
push dword [esi + 0x128]
push ecx
mov ecx, edi
call fcn.180957f9
sub esp, 0x10
lea edi, [esi + 0x12c]
mov ecx, edi
push 0x96
call fcn.1809981f
push 0x7d8
push dword [esi + 4]
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi]
push 0x30
push eax
call esi
mov eax, dword [ebp - 4]
push 0x7d9
push dword [eax + 4]
call ebx
push 1
push dword [edi]
push 0x30
push eax
call esi
mov eax, dword [ebp - 4]
push 0x7db
push dword [eax + 4]
call ebx
push 1
push dword [edi]
push 0x30
push eax
call esi
mov eax, dword [ebp - 4]
push 0x7dc
push dword [eax + 4]
call ebx
push 1
push dword [edi]
push 0x30
push eax
call esi
mov esi, dword [ebp - 4]
push 0x7d1
push dword [esi + 4]
call ebx
push ecx
push eax
push dword [esi + 4]
lea ecx, [esi + 0x28]
call fcn.1809d9c9
push ecx
push ecx
lea ecx, [esi + 0xd4]
call fcn.1809dad8
push 0
push 0x1809b952
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 1
mov ecx, esi
call fcn.180996d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret