joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a6c6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a465
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x438094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041983f
lea ecx, [esi + 0x30]
call fcn.00417ee8
push dword [esi + 0x24]
call fcn.0041bdf5
pop ecx
lea ecx, [esi + 0xc]
call fcn.004072aa
mov ecx, esi
call fcn.0041a68c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ad4f
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x42afbf
call fcn.0041be3f
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.0041a8bf
push 0xce4
lea eax, [ebp - 0x18]
push eax
call fcn.0041994b
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040b726
push dword [ebp - 0x18]
call fcn.0041bdf5
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.0041be08
ret 8
Function at 0x408924
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.00408947
and esi, eax
mov eax, 0x8b9c3279
xor dword [edx], ebx
and esi, esi
push eax
pop eax
inc edx
cmp edx, ecx
jne fcn.00408924
sub esi, 0x53bfa474
ret
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4059b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
movsx eax, byte [esi]
test eax, eax
jne 0x4059e4
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.004057c0
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.00405f00
pop ecx
mov ebx, eax
test eax, eax
jne 0x405a17
push 1
call fcn.004054a0
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [ebx + eax*4]
push eax
push ebx
push esi
call fcn.004057c0
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x44d468], eax
mov dword [0x44d464], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405a50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
jmp 0x405a88
or eax, 0xffffffff
inc eax
cmp byte [ebx + eax], 0
jne 0x405a71
inc eax
mov esi, eax
movsx eax, byte [ebx]
cmp eax, 0x3d
je 0x405a86
add dword [ebp - 4], esi
add ebx, esi
cmp byte [ebx], 0
jne 0x405a6e
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.00405f00
pop ecx
mov edi, eax
mov dword [0x44d570], eax
test eax, eax
jne 0x405aab
push 1
call fcn.004054a0
pop ecx
mov ebx, dword [ebp - 8]
jmp 0x405ad2
or eax, 0xffffffff
inc eax
cmp byte [ebx + eax], 0
jne 0x405ab3
inc eax
mov esi, eax
movsx eax, byte [ebx]
cmp eax, 0x3d
je 0x405ad0
push ebx
push edi
call fcn.00406780
pop ecx
pop ecx
add edi, esi
add ebx, esi
movsx eax, byte [ebx]
test eax, eax
jne 0x405ab0
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b6c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
cmp dword [ebp + 0xc], 0
je 0x1000b710
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
sub esp, 0x10
mov edx, esp
mov eax, dword [0x100259c8]
mov dword [edx], eax
mov ecx, dword [0x100259cc]
mov dword [edx + 4], ecx
mov eax, dword [0x100259d0]
mov dword [edx + 8], eax
mov ecx, dword [0x100259d4]
mov dword [edx + 0xc], ecx
push str.AsusFanSetupFeatures
call fcn.10001f32
add esp, 0x1c
mov byte [ebp - 2], al
cmp dword [ebp + 0x14], 0
je 0x1000b754
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [0x100259c8]
mov dword [ecx], edx
mov eax, dword [0x100259cc]
mov dword [ecx + 4], eax
mov edx, dword [0x100259d0]
mov dword [ecx + 8], edx
mov eax, dword [0x100259d4]
mov dword [ecx + 0xc], eax
push 0x100224d4
call fcn.10001f32
add esp, 0x1c
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
push ecx
movzx edx, byte [ebp - 2]
push edx
push str.Group04_GetFanModeFromNVRAM_DetectMode___x__Control___x_n
call fcn.100012b2
add esp, 0xc
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x1000b792
movzx ecx, byte [ebp - 2]
cmp ecx, 1
jne 0x1000b78a
mov edx, dword [ebp + 0x18]
mov byte [edx], 1
jmp 0x1000b790
mov eax, dword [ebp + 0x18]
mov byte [eax], 2
jmp 0x1000b7b2
movzx ecx, byte [ebp - 1]
cmp ecx, 1
jne 0x1000b7a3
mov edx, dword [ebp + 0x18]
mov byte [edx], 1
jmp 0x1000b7b2
movzx eax, byte [ebp - 1]
cmp eax, 2
jne 0x1000b7b2
mov ecx, dword [ebp + 0x18]
mov byte [ecx], 2
mov esp, ebp
pop ebp
ret

Function at 0x10012300
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.1001aac0
mov ecx, dword [ebp - 4]
mov dword [ecx], 0x10023860
push str.Group0B_C_EPU_VCORE_TBL_pDescriptor_n
call fcn.100012b2
add esp, 4
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
call fcn.1001b1a0
movzx edx, ax
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], edx
call fcn.1001b260
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x30], al
call fcn.1001b290
mov edx, dword [ebp - 4]
mov byte [edx + 0x31], al
mov eax, dword [ebp - 4]
add eax, 0x32
push eax
call fcn.1001b2d0
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 0x36
push ecx
call fcn.1001b2f0
add esp, 4
call fcn.1001b3d0
movzx edx, ax
mov eax, dword [ebp - 4]
mov dword [eax + 0x37], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b430
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
lea eax, [ebp - 0x18]
push eax
push 0xc0010064
call fcn.1001d7f0
add esp, 8
mov ecx, dword [ebp - 0x18]
and ecx, 0
mov edx, dword [ebp - 0x14]
and edx, 0x80000000
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x1c]
jne 0x1001b472
xor eax, eax
jmp 0x1001b514
movzx ecx, word [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 2
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0xe
ja case.0x1001b496.1
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x1001b524]
jmp dword [ecx*4 + 0x1001b518]
mov edx, dword [ebp - 0x18]
and edx, 0xfff
mov dword [ebp - 0x10], edx
imul eax, dword [ebp - 0x10], 5
mov dword [ebp - 8], eax
jmp case.0x1001b496.1
mov ecx, dword [ebp - 0x18]
and ecx, 0xff
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
shr edx, 8
and edx, 0x3f
mov dword [ebp - 4], edx
jne 0x1001b4d5
mov dword [ebp - 8], 0
jmp case.0x1001b496.1
cmp dword [ebp - 4], 8
jb 0x1001b4f2
cmp dword [ebp - 4], 0x3c
ja 0x1001b4f2
imul eax, dword [ebp - 0x10], 0xc8
xor edx, edx
div dword [ebp - 4]
mov dword [ebp - 8], eax
jmp case.0x1001b496.1
mov eax, dword [ebp - 4]
push eax
push str.____Undefined_CpuDfsId__d_used._Force_it_to_div_1._n
call fcn.100012b2
add esp, 8
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
imul ecx, dword [ebp - 0x10], 0x19
mov dword [ebp - 8], ecx
mov ax, word [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1001b4b2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
lea eax, [ebp - 0x18]
push eax
push 0xc0010064
call fcn.1001d7f0
add esp, 8
mov ecx, dword [ebp - 0x18]
and ecx, 0
mov edx, dword [ebp - 0x14]
and edx, 0x80000000
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x1c]
jne 0x1001b472
xor eax, eax
jmp 0x1001b514
movzx ecx, word [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 2
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0xe
ja case.0x1001b496.1
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x1001b524]
jmp dword [ecx*4 + 0x1001b518]
mov edx, dword [ebp - 0x18]
and edx, 0xfff
mov dword [ebp - 0x10], edx
imul eax, dword [ebp - 0x10], 5
mov dword [ebp - 8], eax
jmp case.0x1001b496.1
mov ecx, dword [ebp - 0x18]
and ecx, 0xff
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
shr edx, 8
and edx, 0x3f
mov dword [ebp - 4], edx
jne 0x1001b4d5
mov dword [ebp - 8], 0
jmp case.0x1001b496.1
cmp dword [ebp - 4], 8
jb 0x1001b4f2
cmp dword [ebp - 4], 0x3c
ja 0x1001b4f2
imul eax, dword [ebp - 0x10], 0xc8
xor edx, edx
div dword [ebp - 4]
mov dword [ebp - 8], eax
jmp case.0x1001b496.1
mov eax, dword [ebp - 4]
push eax
push str.____Undefined_CpuDfsId__d_used._Force_it_to_div_1._n
call fcn.100012b2
add esp, 8
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
imul ecx, dword [ebp - 0x10], 0x19
mov dword [ebp - 8], ecx
mov ax, word [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1001c690
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov eax, dword [ebp + 0xc]
push eax
push str.dwTargetRatio___x__n
call fcn.100012b2
add esp, 8
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [ebp + 0xc], 0xffffffff
je 0x1001c75a
cmp dword [ebp + 0xc], 0
je 0x1001c75a
movzx ecx, word [ebp + 8]
push ecx
push 0
call fcn.1001d600
add esp, 8
mov byte [ebp - 1], al
push 1
lea edx, [ebp - 0x1c]
push edx
movzx eax, byte [ebp - 1]
imul ecx, eax, 0x2f
movzx edx, byte [ecx + 0x10025aa2]
push edx
movzx eax, word [ebp + 8]
push eax
push 0
call fcn.1001bfe0
add esp, 0x14
cmp dword [ebp + 0xc], 0xffffffff
je 0x1001c75a
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
mov dword [ebp + edx - 0x1c], eax
push 1
lea ecx, [ebp - 0x1c]
push ecx
movzx edx, byte [ebp - 1]
imul eax, edx, 0x2f
movzx ecx, byte [eax + 0x10025aa3]
push ecx
movzx edx, word [ebp + 8]
push edx
push 0
call fcn.1001bfe0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1001c760
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov byte [ebp - 1], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 2], 0
mov dword [ebp - 8], 0
movzx eax, word [ebp + 8]
push eax
push str.AsusGetOverclockCap_Enter___x__n
call fcn.100012b2
add esp, 8
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov dword [ebp - 0x18], 0xec87d643
mov ecx, 0xeba4
mov word [ebp - 0x14], cx
mov edx, 0x4bb5
mov word [ebp - 0x12], dx
mov byte [ebp - 0x10], 0xa1
mov byte [ebp - 0xf], 0xe5
mov byte [ebp - 0xe], 0x3f
mov byte [ebp - 0xd], 0x3e
mov byte [ebp - 0xc], 0x36
mov byte [ebp - 0xb], 0xb2
mov byte [ebp - 0xa], 0xd
mov byte [ebp - 9], 0xa9
push 1
push 0x46
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
push str.AutoDetectData
call fcn.10001f32
add esp, 0x1c
mov byte [ebp - 2], al
movzx eax, word [ebp + 8]
push eax
push 0
call fcn.1001d600
add esp, 8
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 0xff
jne 0x1001c843
jmp 0x1001c906
push 1
lea edx, [ebp - 0x30]
push edx
movzx eax, byte [ebp - 1]
imul ecx, eax, 0x2f
movzx edx, byte [ecx + 0x10025aa6]
push edx
movzx eax, word [ebp + 8]
push eax
push 0
call fcn.1001bfe0
add esp, 0x14
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0x30]
mov dword [ebp - 8], eax
movzx ecx, word [ebp + 8]
and ecx, 2
je 0x1001c88a
mov edx, dword [ebp - 8]
or edx, 2
mov dword [ebp - 8], edx
jmp 0x1001c8e5
movzx eax, word [ebp + 8]
and eax, 0xc
je 0x1001c8d3
mov ecx, dword [ebp - 8]
or ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
or edx, 0x40
mov dword [ebp - 8], edx
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1001c8d1
movzx ecx, word [ebp + 8]
and ecx, 4
je 0x1001c8bf
mov edx, dword [ebp - 8]
or edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
or eax, 2
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
or ecx, 4
mov dword [ebp - 8], ecx
jmp 0x1001c8e5
movzx edx, word [ebp + 8]
and edx, 0x10
je 0x1001c8e5
mov eax, dword [ebp - 8]
or eax, 2
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push str.AsusGetOverclockCap_End___x__n
call fcn.100012b2
add esp, 8
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x1001c910
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
movzx eax, word [ebp + 8]
push eax
push str.AsusGetCpuTDP_Enter___x__n
call fcn.100012b2
add esp, 8
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
movzx ecx, word [ebp + 8]
push ecx
push 0
call fcn.1001d600
add esp, 8
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
cmp edx, 0xff
jne 0x1001c986
jmp 0x1001ca96
push 1
lea eax, [ebp - 0x20]
push eax
movzx ecx, byte [ebp - 1]
imul edx, ecx, 0x2f
movzx eax, byte [edx + 0x10025aa4]
push eax
movzx ecx, word [ebp + 8]
push ecx
push 0
call fcn.1001bfe0
add esp, 0x14
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x20]
and ecx, 0xffff0000
shr ecx, 0x10
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov byte [ebp - 1], 0
jmp 0x1001c9d2
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 0xb
jae 0x1001ca71
movzx edx, byte [ebp - 1]
imul eax, edx, 0xe
movzx ecx, word [eax + 0x10025b98]
cmp ecx, 0xffff
jne 0x1001ca1c
push str.AsusGetCpuTDP_CpuInfrastructureGroup_CpuType_not_match___n
call fcn.100012b2
add esp, 4
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
jmp 0x1001ca6c
movzx ecx, byte [ebp - 1]
imul edx, ecx, 0xe
movzx eax, word [edx + 0x10025b98]
movzx ecx, word [ebp + 8]
and eax, ecx
je 0x1001ca6c
movzx edx, byte [ebp - 1]
imul eax, edx, 0xe
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x10025b9a]
cmp edx, dword [ecx]
jne 0x1001ca6c
movzx eax, byte [ebp - 1]
imul ecx, eax, 0xe
mov edx, dword [ebp + 0x10]
mov eax, dword [ecx + 0x10025b9e]
mov dword [edx], eax
movzx ecx, byte [ebp - 1]
imul edx, ecx, 0xe
mov eax, dword [ebp + 0x14]
mov ecx, dword [edx + 0x10025ba2]
mov dword [eax], ecx
jmp 0x1001ca71
jmp 0x1001c9ca
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push str.AsusGetCpuTDP_End___x__x__x__n
call fcn.100012b2
add esp, 0x10
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x1001caa0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
movzx eax, word [ebp + 8]
push eax
push str.AsusSetCpuPpt_Enter___x__n
call fcn.100012b2
add esp, 8
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
movzx ecx, word [ebp + 8]
push ecx
push 0
call fcn.1001d600
add esp, 8
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
cmp edx, 0xff
jne 0x1001cb13
jmp 0x1001cb60
movzx eax, word [ebp + 0xc]
imul ecx, eax, 0x3e8
mov edx, 4
imul eax, edx, 0
mov dword [ebp + eax - 0x20], ecx
push 1
lea ecx, [ebp - 0x20]
push ecx
movzx edx, byte [ebp - 1]
imul eax, edx, 0x2f
movzx ecx, byte [eax + 0x10025aa5]
push ecx
movzx edx, word [ebp + 8]
push edx
push 0
call fcn.1001bfe0
add esp, 0x14
push str.AsusSetCpuPpt_End_n
call fcn.100012b2
add esp, 4
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret

Function at 0x1001d600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
mov byte [ebp - 1], 0
jmp 0x1001d616
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 6
jae 0x1001d67d
movzx edx, byte [ebp - 1]
imul eax, edx, 0x2f
movzx ecx, word [eax + 0x10025a7c]
cmp ecx, 0xffff
jne 0x1001d64e
push str.AsusNbioSmuServiceRequest_SmuCommandAddress_CpuType_not_match___n
call fcn.100012b2
add esp, 4
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
or al, 0xff
jmp 0x1001d67f
movzx edx, byte [ebp - 1]
imul eax, edx, 0x2f
movzx ecx, word [eax + 0x10025a7c]
movzx edx, word [ebp + 0xc]
and ecx, edx
je 0x1001d67b
movzx eax, byte [ebp - 1]
imul ecx, eax, 0x2f
mov edx, dword [ecx + 0x10025a78]
cmp edx, dword [ebp + 8]
jne 0x1001d67b
mov al, byte [ebp - 1]
jmp 0x1001d67f
jmp 0x1001d60e
or al, 0xff
mov esp, ebp
pop ebp
ret
Function at 0x1001f1c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
cdq
mov ecx, 0xa
idiv ecx
mov byte [ebp - 2], al
movzx eax, byte [ebp + 8]
cdq
mov ecx, 0xa
idiv ecx
mov byte [ebp - 3], dl
mov byte [ebp - 1], 0
movzx edx, byte [ebp + 8]
push edx
push str.OemLib::ReadSioGpioLevel__Pin___d._n
call fcn.100012b2
add esp, 8
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
movzx eax, byte [ebp - 3]
cmp eax, 7
jg 0x1001f210
movzx ecx, byte [ebp - 2]
cmp ecx, 9
jle 0x1001f227
push str.Pin_Number_over_7_or_Pin_Group_over_9._n
call fcn.100012b2
add esp, 4
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
xor al, al
jmp 0x1001f287
lea edx, [ebp - 1]
push edx
movzx eax, byte [ebp - 2]
imul ecx, eax, 5
mov edx, 1
shl edx, 2
movzx eax, byte [ecx + edx + 0x10025c70]
push eax
movzx ecx, byte [ebp - 2]
imul edx, ecx, 5
mov eax, 1
shl eax, 0
movzx ecx, byte [edx + eax + 0x10025c70]
push ecx
call fcn.1001de90
add esp, 0xc
movzx ecx, byte [ebp - 3]
mov edx, 1
shl edx, cl
movzx eax, byte [ebp - 1]
and eax, edx
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x1001f285
mov al, 1
jmp 0x1001f287
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x72f92b2a
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x23ac3b38
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402beb
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x108]
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push ebx
push 0x4011c4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ca2
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], edi
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExA]
test eax, eax
jne 0x402ca2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402c92
lea eax, [ebp - 0x108]
mov edx, edi
push eax
mov ecx, esi
call fcn.004027f5
test eax, eax
setns bl
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x402ce6
push edi
lea eax, [ebp - 0x108]
push eax
push 0x4011e4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x402ce6
push 0x401200
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x402ce6
lea eax, [ebp - 0x108]
mov edx, edi
push eax
mov ecx, esi
call fcn.004027f5
xor ebx, ebx
test eax, eax
setns bl
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403dd0
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x403790
Capabilities:
Identify system language via api

Disassembly:
cmp byte [0x436000], 0
push ebx
push ebp
push esi
push edi
mov edi, 0xffff
mov ebx, 0x436000
je 0x4037af
push ebx
call fcn.004058d7
jmp 0x4037b5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
mov esi, dword [0x42f064]
test esi, esi
je 0x403808
mov ecx, dword [0x42f028]
mov ecx, dword [ecx + 0x64]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x42f060]
add ecx, edx
dec esi
mov bp, word [ecx]
xor bp, ax
and ebp, edi
test bp, bp
je 0x4037ed
test esi, esi
jne 0x4037d7
jmp 0x403808
mov edx, dword [ecx + 2]
mov dword [0x42e800], edx
mov edx, dword [ecx + 6]
mov dword [0x42f0c8], edx
lea edx, [ecx + 0xa]
mov dword [0x42e7fc], edx
cmp dword [0x42e7fc], 0
jne 0x403823
cmp di, 0xffff
jne 0x40381f
mov edi, 0x3ff
jmp 0x4037b7
xor edi, edi
jmp 0x4037b7
movzx eax, word [ecx]
push eax
push ebx
call fcn.004058be
push 0xfffffffffffffffe
push 0x42e820
call fcn.00405972
push eax
push dword [0x42a470]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x42f04c]
mov esi, dword [0x42f048]
test eax, eax
je 0x403870
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x403867
push eax
lea eax, [esi + 0x18]
push eax
call fcn.00405972
add esi, 0x418
dec edi
jne 0x403857
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405212
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x42c498], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405236
test al, 0x10
jne 0x405239
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x42c498
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405264
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8