joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4320b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 1
lea eax, [ebp - 0x18]
mov esi, ecx
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0xc
push str.GlobalAccess_Intel_OC_Mailbox
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push 0
push eax
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x432148
push str.atkex:_Create_OCMBMutex_fail...
sub esp, 0xc
mov dword [ebp - 0x30], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_asusmutex.h
mov eax, esp
mov dword [ebp - 0x2c], 0x9d
movq xmm0, qword [ebp - 0x30]
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.CPUZMutex::CPUZMutex
call fcn.0044af90
push eax
call fcn.0044ef80
mov eax, dword [esi]
add esp, 0x18
test eax, eax
je 0x432193
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x432193
push str.atkex:_OCMBMutex_timeout...
sub esp, 0xc
mov dword [ebp - 0x30], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_asusmutex.h
mov eax, esp
mov dword [ebp - 0x2c], 0xa4
movq xmm0, qword [ebp - 0x30]
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.CPUZMutex::CPUZMutex
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004512f7
mov esp, ebp
pop ebp
ret
Function at 0x433f90
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d338
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00432430
mov esi, eax
lea ecx, [esi - 1]
push ecx
mov ecx, esi
neg ecx
push ecx
call dword [0x4cac08]
mov dword [ebp - 0x40], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_atkex.cpp
mov edi, eax
test esi, esi
jne 0x434015
mov dword [ebp - 0x3c], 0x10c
push str.dwFlashSize__0___fail
movq xmm0, qword [ebp - 0x40]
sub esp, 0xc
mov eax, esp
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.getBiosDllFile
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
xor al, al
jmp 0x43414d
push str.start_search_dll....
sub esp, 0xc
mov dword [ebp - 0x3c], 0x115
movq xmm0, qword [ebp - 0x40]
mov eax, esp
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.getBiosDllFile
call fcn.0044af90
push eax
call fcn.0044ef80
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push edi
call fcn.0043f6e0
add esp, 0x28
cmp dword [ebp - 0x34], 0
jne 0x434081
mov dword [ebp - 0x40], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_atkex.cpp
mov dword [ebp - 0x3c], 0x11a
push str.pDllFile__NULL___fail
jmp 0x433fe9
lea eax, [ebp - 0x58]
push eax
call fcn.00432820
add esp, 4
push 0x15
push 0x49467c
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00404b70
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00404ac0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x80
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0x80
push 2
push 0
push 0
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.00404ac0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004512f7
mov esp, ebp
pop ebp
ret
Function at 0x435b80
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push 0xff
push 0x100
push eax
call fcn.00405060
push dword [eax + 4]
push dword [eax]
call fcn.00471054
xor eax, eax
add esp, 0x20
cmp dword [esi + 0x260], 0
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
jne 0x435be7
push eax
call fcn.004736cf
add esp, 4
lea eax, [esi + 0x40]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x435c1c
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004512f7
mov esp, ebp
pop ebp
ret
Function at 0x4363f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4b50d0]
mov edx, dword [0x4b50d4]
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, 1
push edi
mov edi, ecx
cmp eax, edx
jae 0x43648c
nop dword [eax]
test esi, esi
js 0x4365c1
mov ebx, dword [eax]
test ebx, ebx
je 0x436482
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], 0
test ecx, ecx
jne 0x436440
xor esi, esi
jmp 0x436482
lea eax, [ebp - 0xc]
push eax
push 0x493a74
push dword [ebx + 0xc]
call ecx
mov esi, eax
test esi, esi
js 0x43646c
mov eax, dword [ebx + 0x10]
add eax, 4
push eax
push 5
push 4
push dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
mov esi, eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x436479
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [0x4b50d4]
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp eax, edx
jb 0x436420
test esi, esi
js 0x4365c1
jne 0x4365bd
cmp byte [edi + 0x3c], 0
je 0x436565
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x436557
lea eax, [ebp - 8]
push eax
push 0
push edi
push 0x435c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x4364e9
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x30], ebx
test ebx, ebx
je 0x436557
cmp dword [edi + 0x260], 0
je 0x43652c
mov edx, 4
lea ecx, [edi + 0x248]
mov eax, 2
lock cmpxchg dword [ecx], edx
cmp eax, 2
jne 0x43652c
push str.Service_started_resumed
push edi
call fcn.00435b80
add esp, 8
lea eax, [edi + 0x244]
push eax
push dword [edi + 0x240]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x43654e
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4365b0
mov ecx, edi
mov esi, 0x80004005
call fcn.00436a30
jmp 0x4365c1
cmp dword [edi + 0x260], 0
je 0x4365a8
mov edx, 4
lea ecx, [edi + 0x248]
mov eax, 2
lock cmpxchg dword [ecx], edx
cmp eax, 2
jne 0x4365a8
push str.Service_started_resumed
push edi
call fcn.00435b80
add esp, 8
lea eax, [edi + 0x244]
push eax
push dword [edi + 0x240]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x4365c1
mov ecx, edi
call fcn.00436a30
jmp 0x4365c1
mov byte [edi + 0x3c], 0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004512f7
mov esp, ebp
pop ebp
ret 4
Function at 0x436b20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x436b35
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x436b40
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x436b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x20019
push str.AppID
mov edi, ecx
mov dword [ebp - 0x230], 0
push Ordinal_3
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
call fcn.0042f560
mov esi, eax
mov eax, dword [ebp - 0x230]
test esi, esi
je 0x436bd6
mov dword [edi + 0x250], esi
jmp 0x436d45
push ebx
push 0x20019
push str.63882250_25AD_4ED6_8003_B9AD33F1FC33
push eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
call fcn.0042f560
mov ebx, dword [ebp - 0x218]
mov esi, eax
test esi, esi
jne 0x436d2d
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.LocalService
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x436c90
mov eax, dword [ebp - 0x220]
cmp eax, 1
je 0x436c63
cmp eax, 2
je 0x436c63
mov eax, 0xd
jmp 0x436c90
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x436c85
test al, 1
jne 0x436c7e
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
je 0x436c8e
mov eax, 0xd
jmp 0x436c90
xor eax, eax
mov word [ebp - 0x20c], ax
xor eax, eax
mov dword [edi + 0x260], 0
test eax, eax
jne 0x436cf4
lea eax, [edi + 0x40]
mov dword [edi + 0x260], 1
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x218], 0x437210
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x436cec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x250], eax
mov esi, dword [edi + 0x250]
jmp 0x436d33
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
jns 0x436d1d
cmp esi, 0x80010106
jne 0x436d33
push str.Mscoree.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x436d21
jmp 0x436d33
mov byte [edi + 0x3e], 1
push dword [ebp + 8]
mov ecx, edi
call fcn.00436a80
mov esi, eax
mov dword [edi + 0x250], esi
test ebx, ebx
je 0x436d3e
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x230]
pop ebx
test eax, eax
je 0x436d50
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004512f7
mov esp, ebp
pop ebp
ret 4
Function at 0x4370d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00436e40
test eax, eax
jne 0x4370e8
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push 0x20006
push str.AppID
push Ordinal_3
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0042f560
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xc]
test eax, eax
je 0x437131
push eax
call fcn.0042d7b0
add esp, 4
mov esi, eax
jmp 0x437195
push 0x20006
push str.63882250_25AD_4ED6_8003_B9AD33F1FC33
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0042f560
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x43716b
push eax
call fcn.0042d7b0
add esp, 4
jmp 0x43717e
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.004371b0
mov esi, eax
test edi, edi
je 0x43718f
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x437195
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x43719c
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438660
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x495038
sub esp, 0xc
mov dword [ebp - 0xc], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_atkexcomsvc.cpp
mov eax, esp
mov dword [ebp - 8], 0x1d4
movq xmm0, qword [ebp - 0xc]
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.wWinMain
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
mov dword [ebp - 0xc], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_atkexcomsvc.cpp
mov dword [ebp - 8], 0x1d5
movq xmm0, qword [ebp - 0xc]
push 0x495038
sub esp, 0xc
mov eax, esp
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.wWinMain
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
mov dword [ebp - 0xc], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_atkexcomsvc.cpp
mov dword [ebp - 8], 0x1d6
movq xmm0, qword [ebp - 0xc]
push str.atkexcom_logging......
sub esp, 0xc
mov eax, esp
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.wWinMain
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
call fcn.00435aa0
mov esi, dword [ebp + 0x10]
test al, al
je 0x43878d
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438720
sub ecx, edx
sar ecx, 1
jne 0x43878d
call fcn.00437a80
call fcn.004376f0
push str.initial_atkex......
sub esp, 0xc
mov dword [ebp - 0xc], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_atkexcomsvc.cpp
mov eax, esp
mov dword [ebp - 8], 0x1dc
movq xmm0, qword [ebp - 0xc]
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.wWinMain
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
call fcn.004334d0
cmp byte [0x4cae4c], 0
je 0x4387bd
or esi, 0xffffffff
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.00435aa0
test al, al
jne 0x438778
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4387a0
sub esi, ecx
sar esi, 1
jne 0x438778
mov eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp + 0x10]
push ecx
push eax
mov ecx, 0x4caec0
call fcn.00436200
cmp al, 1
jne 0x4387ee
push dword [ebp + 0x14]
mov ecx, 0x4caec0
call fcn.00436b70
mov esi, eax
jmp 0x4387f1
mov esi, dword [ebp + 0x10]
cmp dword [0x4cb120], 0
jne 0x438809
cmp byte [0x4caefe], 0
je 0x438809
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43e120
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dc88
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push 1
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], Ordinal_3
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], 0xc
push str.GlobalAccess_Intel_OC_Mailbox
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x48], esi
test esi, esi
jne 0x43e1b4
mov dword [ebp - 0x40], 0x9d
push str.atkex:_Create_OCMBMutex_fail...
jmp 0x43e1d3
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43e1ff
mov dword [ebp - 0x40], 0xa4
push str.atkex:_OCMBMutex_timeout...
sub esp, 0xc
mov dword [ebp - 0x44], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvc_asusmutex.h
movq xmm0, qword [ebp - 0x44]
mov eax, esp
push 2
movq qword [eax], xmm0
mov dword [eax + 8], str.CPUZMutex::CPUZMutex
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
mov eax, dword [ebp + 0xc]
shl eax, 8
or eax, dword [ebp + 8]
or dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x150
mov dword [ebp - 4], 0
call fcn.00404430
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
push 0x150
mov dword [ebp - 0x18], 0
call fcn.004043b0
add esp, 8
cmp dword [ebp - 0x14], 0
je 0x43e254
xor bl, bl
jmp 0x43e25b
mov eax, dword [ebp - 0x18]
mov bl, 1
mov dword [edi], eax
test esi, esi
je 0x43e266
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004512f7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447e60
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push str.SENSORTHREAD_GoOn:......
sub esp, 0xc
mov dword [ebp - 0xc], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvcprobethread.cpp
mov eax, esp
mov dword [ebp - 8], 0x138
movq xmm0, qword [ebp - 0xc]
push 1
movq qword [eax], xmm0
mov dword [eax + 8], str.SENSORTHREAD_GoOn
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
call fcn.00447f60
push str.SENSORTHREAD_Resume:......
sub esp, 0xc
mov dword [ebp - 0xc], str.d:jenkinsworkspace_atkexcomsvc_atkexcomsvcprobethread.cpp
mov eax, esp
mov dword [ebp - 8], 0x10a
movq xmm0, qword [ebp - 0xc]
mov dword [0x4b5230], 2
push 1
movq qword [eax], xmm0
mov dword [eax + 8], str.SENSORTHREAD_Resume
call fcn.0044af90
push eax
call fcn.0044ef80
add esp, 0x18
push 0x11060004
call fcn.004334d0
mov ecx, eax
call fcn.00432390
test eax, eax
je 0x447f2d
push 0x2710
push dword [0x4cae98]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 3
push 1
push 0x11060004
call fcn.004334d0
mov ecx, eax
call fcn.00433a90
push dword [0x4cae98]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x4cb1dc]
test eax, eax
je 0x447f4e
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop dword [eax]
push eax
call esi
test eax, eax
je 0x447f4e
mov eax, dword [0x4cb1dc]
jmp 0x447f40
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x447f60
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e6f9
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4cb1ec]
test eax, eax
jne 0x447fc1
push 0x1c
call fcn.00451308
add esp, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x447fb3
mov ecx, eax
call fcn.004061f0
jmp 0x447fb5
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x4cb1ec], eax
push eax
lea ecx, [ebp - 0x2c]
call fcn.004050b0
cmp dword [0x4cb1e8], 0
mov dword [ebp - 4], 1
jne 0x44816c
cmp dword [0x4cb1e4], 0
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jne 0x44802f
push 1
lea eax, [ebp - 0x24]
push eax
call esi
push 0
push 0
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x38], 0xc
push str.GlobalAccess_ISABUS.HTP.Method
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4cb1e4], eax
cmp dword [0x4cb1e0], 0
jne 0x4480ae
push 1
lea eax, [ebp - 0x24]
push eax
call esi
push 0
push 0
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalASUS_SIO_MUTEX
lea eax, [ebp - 0x24]
mov dword [ebp - 0x38], 0xc
push 1
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4cb1e0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4480a2
push str.GlobalASUS_SIO_MUTEX
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x4cb1e0], eax
jmp 0x4480ae
push dword [0x4cb1e0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0043d410
mov ecx, eax
call fcn.0043d380
push 0xc4
call fcn.00451308
mov esi, eax
add esp, 4
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x4480ed
push 0xc4
push 0
push esi
call fcn.00468a50
add esp, 0xc
mov ecx, esi
call fcn.00444ab0
jmp 0x4480ef
xor eax, eax
mov ecx, eax
mov byte [ebp - 4], 1
mov dword [0x4cb1e8], eax
call fcn.004472c0
call fcn.00447cd0
call fcn.0043d410
push 0x4cb1d4
push 0
push dword [eax]
push 0x4481b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x4cb1dc], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call fcn.00403e10
test al, al
jne 0x448145
call fcn.00403d10
test al, al
jne 0x448145
push 0
jmp 0x448147
push 1
push dword [0x4cb1dc]
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov ecx, dword [0x4cb1d8]
mov edx, 0x4cb1d8
nop
mov eax, ecx
lock cmpxchg dword [edx], ecx
mov ecx, eax
test ecx, ecx
je 0x448160
lea ecx, [ebp - 0x2c]
call fcn.004050d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004512f7
mov esp, ebp
pop ebp
ret
Function at 0x4485f0
Capabilities:
Check if file exists
Compare security identifiers
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4486d0
test al, 0x10
je 0x4486d0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], esi
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], esi
push eax
push 1
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x4486d0
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
mov dword [ebp - 0x10], esi
call edi
test eax, eax
je 0x448689
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x4486c7
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x18]
or esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004512f7
mov esp, ebp
pop ebp
ret