joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x60]
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push 0x41df18
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b5bd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40b5bd
push eax
mov eax, dword [eax + 8]
add eax, 2
lea ecx, [esp + 0xc]
shl eax, 4
push eax
push ecx
mov dword [esp + 0x14], 0x3f800000
mov dword [esp + 0x20], 0x3f800000
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov edx, dword [esi + 0x20]
push 1
push eax
push edx
mov dword [esi + 0x64], eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov ecx, esi
call sub.MFC42u.DLL_CDialog::OnInitDialog
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret

Function at 0x40b920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4179dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call sub.MFC42u.DLL_CWnd::CWnd
mov dword [esi], 0x419668
xor edi, edi
mov dword [esi + 0x54], 0x419654
mov dword [esp + 0x1c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], edi
lea ebp, [esi + 0xe4]
mov ebx, 1
mov ecx, ebp
mov byte [esp + 0x1c], bl
call sub.MFC42u.DLL_CWnd::CWnd
mov dword [ebp], 0x419590
mov dword [esi + 0x128], edi
mov dword [esi + 0x124], 0x418998
lea ecx, [esi + 0x12c]
mov byte [esp + 0x1c], 3
call sub.MFC42u.DLL_CImageList::CImageList
mov byte [esp + 0x1c], 4
mov dword [esi], 0x4194d0
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xc0], 0x7d
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
push str.ANICURSORS
push 0xad
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x30000
push edi
push ebp
push eax
call dword [sym.imp.USER32.dll_CreateIconFromResource]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x68], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40d4c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x417b98
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov ecx, ebp
call sub.MFC42u.DLL_CString::Empty
mov eax, dword [0x4211c0]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d579
push 0x400
push 0x400
mov ecx, 0x4211c0
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
mov ecx, 0x4211c0
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov ecx, 0x4211c0
call sub.MFC42u.DLL_CString::FreeExtra
push 0x5c
mov ecx, 0x4211c0
call sub.MFC42u.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, 0x4211c0
call sub.MFC42u.DLL_CString::Left
push eax
mov ecx, 0x4211c0
mov dword [esp + 0x20], 0
call fcn.00416290
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
push str.Liveupdt.ini
mov ecx, 0x4211c0
call fcn.00416332
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40d6c1
cmp word [eax], 0
je 0x40d6c1
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 1
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [0x421210]
lea eax, [esp + 0xc]
and edx, 0xffff
mov byte [esp + 0x1c], 2
push edx
push str.0x_X
push eax
call sub.MFC42u.DLL_CString::Format
mov ecx, dword [0x4211c0]
mov esi, dword [esp + 0x18]
add esp, 0xc
push ecx
push 0xa
push 0xa
lea ecx, [esp + 0x30]
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x420598
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.Language
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::FreeExtra
mov eax, dword [esp + 0x24]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d66b
push 0x41df3c
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::operator_2
mov edx, dword [0x4211c0]
mov edi, dword [esp + 0xc]
push edx
push 0xa
push 0xa
lea ecx, [esp + 0x30]
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x420598
push edi
push str.Language
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::FreeExtra
mov eax, dword [esp + 0x24]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40d6a2
mov edi, eax
mov eax, dword [0x4211c0]
push eax
push 0x100
push 0x100
mov ecx, ebp
call sub.MFC42u.DLL_CString::GetBuffer
mov ecx, dword [esp + 0x30]
push eax
push 0x420598
push ecx
push edi
call esi
push 0xffffffffffffffff
mov ecx, ebp
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov ecx, ebp
call sub.MFC42u.DLL_CString::FreeExtra
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40d6e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x417bd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x48
mov dword [esp + 0x28], 1
call sub.MFC42u.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
mov bl, 2
test esi, esi
mov byte [esp + 0x24], bl
je 0x40d756
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call sub.MFC42u.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x30], 3
call sub.MFC42u.DLL_CString::CString_2
mov ecx, esi
mov byte [esp + 0x2c], bl
call fcn.00403320
mov dword [esp + 0x10], eax
jmp 0x40d75e
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov byte [esp + 0x24], 1
lea edi, [eax + 4]
push 0
push edi
call ebp
push 0x64
mov esi, eax
call ebx
mov ecx, esi
and ecx, 0x80000000
cmp ecx, 0x80000000
je 0x40d796
cmp esi, 5
jne 0x40d776
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40d7ae
mov ecx, edi
call fcn.00403530
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret
Function at 0x40eca0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x10ec
call fcn.00416730
mov eax, dword [esp + 0x10f0]
push ebp
push esi
xor esi, esi
cmp eax, esi
je 0x40ee86
mov ebp, dword [esp + 0x10fc]
cmp ebp, esi
je 0x40ee86
lea eax, [esp + 8]
mov dword [esp + 8], esi
push eax
push 8
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ee79
push edi
mov ecx, 0x1ff
lea edi, [esp + 0xfa]
mov word [esp + 0xf8], si
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push esi
push esi
stosw word es:[edi], ax
push esi
lea eax, [esp + 0x108]
push edx
push eax
push esi
push ecx
mov dword [esp + 0x30], 0x800
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40ee6d
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x8fe]
mov word [esp + 0x8fc], si
rep stosd dword es:[edi], eax
lea edx, [esp + 0xfc]
mov dword [esp + 0x14], 0x800
stosw word es:[edi], ax
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea eax, [esp + 0x904]
push str._s_s
push eax
mov dword [esp + 0x28], esi
call ebx
add esp, 0x10
lea ecx, [esp + 0x18]
lea edx, [esp + 0x8fc]
push ecx
push 3
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ee38
mov ecx, 0x31
lea edi, [esp + 0x36]
mov word [esp + 0x34], si
lea edx, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push esi
push str.DisplayName
push eax
mov dword [esp + 0x3c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ee38
mov eax, dword [esp + 0x28]
mov edi, 1
cmp eax, edi
jne 0x40ee38
mov ecx, dword [esp + 0x1100]
lea edx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40ee38
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
mov eax, dword [esp + 0x1c]
push ebp
push edi
push esi
push str.alu7501e157_4b4a_4850_b6ea_3bea55826ba9
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
mov eax, ecx
inc ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x2c]
push ecx
push esi
push esi
push esi
lea ecx, [esp + 0x10c]
push edx
mov edx, dword [esp + 0x24]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40ed4d
pop ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
add esp, 0x10ec
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x10ec
ret
Function at 0x40eea0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0xd8
lea eax, [esp + 4]
push ebx
xor ebx, ebx
push eax
push 3
push ebx
push str.SOFTWAREAsusASUS_Live_Update
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40eff9
mov ecx, dword [esp + 8]
push esi
push ecx
mov dword [esp + 0xc], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 8]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push str.SelfUpdating
push edx
call esi
test eax, eax
jne 0x40ef43
cmp dword [esp + 0x10], 1
jne 0x40ef43
cmp word [esp + 0x18], 0x56
jne 0x40ef43
mov ax, word [esp + 0x1a]
cmp ax, 0x30
jb 0x40ef43
cmp ax, 0x39
ja 0x40ef43
mov eax, dword [esp + 0xe8]
mov edx, dword [esp + 0xe4]
lea ecx, [esp + 0x18]
push eax
push ecx
push edx
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [esp + 0xf0]
mov edx, dword [esp + 0xec]
lea ecx, [esp + 8]
mov dword [esp + 8], eax
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.Source
push ecx
call esi
mov edx, dword [esp + 0xf8]
mov ecx, dword [esp + 0xf4]
lea eax, [esp + 8]
mov dword [esp + 8], edx
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.Path
push eax
call esi
lea ecx, [esp + 8]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x41e5a0
push ecx
mov dword [esp + 0x20], 4
call esi
test eax, eax
pop esi
jne 0x40efde
cmp dword [esp + 0xc], 4
jne 0x40efde
cmp dword [esp + 0x10], 1
jne 0x40efde
mov edx, dword [esp + 0xf8]
mov dword [edx], 1
mov eax, dword [esp + 8]
push 0x41e5a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
add esp, 0xd8
ret

Function at 0x40f010
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 2
push 0
push str.SOFTWAREAsusASUS_Live_Update
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f0ba
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
mov edi, dword [esp + 0x14]
push edi
call esi
mov ecx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
shl eax, 1
push eax
push edi
push 1
push 0
push str.SelfUpdating
push ecx
call ebx
mov edi, dword [esp + 0x18]
push edi
call esi
mov edx, dword [esp + 0xc]
shl eax, 1
push eax
push edi
push 1
push 0
push str.Source
push edx
call ebx
push edi
call esi
test eax, eax
je 0x40f09c
cmp dword [esp + 0x1c], 1
jne 0x40f09c
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push 4
push eax
push 4
push 0
push 0x41e5a0
push ecx
call ebx
mov edx, dword [esp + 0xc]
push str.Path
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40f0c0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x218
lea eax, [esp]
push esi
xor esi, esi
push eax
push 8
push esi
push str.SOFTWAREAsusASUS_Live_Update
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f1b9
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
mov ebx, dword [esp + 0x228]
push edi
mov ecx, 0x81
lea edi, [esp + 0x22]
mov word [esp + 0x20], si
rep stosd dword es:[edi], eax
push ebp
push str.V0.0
push ebx
mov dword [esp + 0x20], 0x208
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea ecx, [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ecx
mov ecx, dword [esp + 0x14]
push 0
push 0
lea edx, [esp + 0x20]
push 0
lea eax, [esp + 0x30]
push edx
push eax
push 0
push ecx
mov esi, 1
call edi
test eax, eax
jne 0x40f1a1
add ebx, 2
lea edx, [esp + 0x20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x40f175
lea eax, [ebp - 1]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x18]
lea ecx, [esp + 0x14]
push edx
push 0
push 0
push 0
lea edx, [esp + 0x30]
mov eax, esi
push ecx
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x34], 0x208
inc esi
call edi
test eax, eax
je 0x40f155
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x218
ret
xor eax, eax
pop esi
add esp, 0x218
ret
Function at 0x4115e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x417dd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcc
push esi
push edi
mov esi, dword [esp + 0xe4]
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
mov dword [esp + 0xdc], 0
rep stosd dword es:[edi], eax
test esi, esi
stosw word es:[edi], ax
je 0x411652
lea eax, [esi + 0x192]
lea ecx, [esp + 0xe8]
push eax
push 0
call sub.MFC42u.DLL_CString::GetBuffer
push eax
lea ecx, [esp + 0x14]
push str._s___s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [esp + 8]
push edx
push 2
push 0
push str.SOFTWAREAsusASUS_Live_Update
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4116da
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0xc]
push ebx
push eax
call edi
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
shl eax, 1
lea ecx, [esp + 0x10]
push eax
push ecx
push 1
push 0
push str.BIOS
push edx
call ebx
test esi, esi
je 0x4116be
add esi, 0x65a
push esi
call edi
shl eax, 1
push eax
mov eax, dword [esp + 0x10]
push esi
push 1
push 0
push 0x41eda4
push eax
call ebx
jmp 0x4116ce
mov ecx, dword [esp + 0xc]
push 0x41eda4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
lea ecx, [esp + 0xe8]
mov dword [esp + 0xdc], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xd8
ret
Function at 0x411710
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd4
push ebx
push edi
xor ebx, ebx
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push 1
push ebx
push str.SOFTWAREAsusASUS_Live_Update
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411822
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0xc]
push esi
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.BIOS
push ecx
mov dword [esp + 0x28], 0xc8
call ebp
test eax, eax
jne 0x4117df
cmp dword [esp + 0x18], 1
jne 0x4117df
cmp dword [esp + 0x10], ebx
je 0x4117df
lea edx, [esp + 0x1c]
push 0x41edc4
push edx
call dword [sym.imp.MSVCRT.dll_wcsstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x4117df
mov eax, dword [esp + 0xec]
mov edx, dword [esp + 0xe8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
mov word [esi], bx
call edi
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf0]
add esi, 2
push eax
push esi
push ecx
call edi
mov ebx, 1
mov edx, dword [esp + 0xfc]
mov ecx, dword [esp + 0xf8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edx
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push 0x41eda4
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov eax, ebx
pop edi
pop ebx
add esp, 0xd4
ret
mov eax, ebx
pop edi
pop ebx
add esp, 0xd4
ret
Function at 0x411830
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0xe6c
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
push esi
mov esi, dword [esp + 0xe7c]
lea eax, [esp + 0x678]
push esi
push 0x41edc8
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x678]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ebx, ebx
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x411a66
cmp eax, 0xffffffff
je 0x411a66
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x47e]
mov word [esp + 0x47c], bx
mov word [esp + 0x27c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x27e]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x100
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x11], bl
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push ecx
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 1
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x411936
lea edx, [esp + 0x28]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x480]
push eax
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x288]
push edx
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov cx, word [esp + 0x5a]
mov ax, word [esp + 0x58]
cmp cx, bx
jne 0x411955
cmp ax, 0x2e
je 0x411a11
cmp word [esp + 0x5c], bx
jne 0x41196b
cmp ax, 0x2e
jne 0x41196b
cmp cx, ax
je 0x411a11
lea eax, [esp + 0x58]
lea ecx, [esp + 0x67c]
push eax
push esi
push str._s_s
push ecx
call ebp
mov eax, dword [esp + 0x3c]
add esp, 0x10
test al, 1
je 0x41199c
and al, 0xfe
lea edx, [esp + 0x67c]
push eax
push edx
call edi
mov eax, dword [esp + 0x2c]
test al, 0x10
je 0x4119d9
lea eax, [esp + 0x67c]
push eax
call fcn.00411a70
lea ecx, [esp + 0x280]
push 0x10000000
lea edx, [esp + 0x684]
push ecx
push edx
call fcn.00411ba0
lea eax, [esp + 0x68c]
push eax
call fcn.00411830
add esp, 0x14
jmp 0x411a11
lea ecx, [esp + 0x67c]
push ecx
call fcn.00411a70
lea edx, [esp + 0x280]
push 0x10000000
lea eax, [esp + 0x684]
push edx
push eax
call fcn.00411ba0
add esp, 0x10
lea ecx, [esp + 0x67c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41193c
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x2c]
test al, 1
je 0x411a42
and al, 0xfe
push eax
push esi
call edi
push esi
call fcn.00411a70
lea edx, [esp + 0x280]
push 0x10000000
push edx
push esi
call fcn.00411ba0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe6c
ret
Function at 0x411ba0
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0xc20
push esi
lea eax, [esp + 0x10]
push 1
push eax
mov dword [esp + 0x14], 0x400
mov dword [esp + 0x10], 0x800
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x828]
push edx
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc38]
lea edx, [esp + 0x30]
push ecx
push edx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x411c7e
lea ecx, [esp + 0x24]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edi, eax
add edi, 0x10
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov esi, eax
push 2
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov eax, dword [esp + 0xc34]
lea edx, [esp + 0x28]
push edx
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
pop edi
je 0x411c82
push 0
push esi
lea ecx, [esp + 0x18]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x411c82
mov eax, dword [esp + 0xc28]
lea edx, [esp + 0x10]
push edx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
je 0x411c82
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 1
pop esi
add esp, 0xc20
ret
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop esi
add esp, 0xc20
ret