joyce8/EMBER2024-capa huggingface dataset:
Function at 0x906031b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x158
mov eax, 0x90a26eb
call fcn.0900621d
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x164], eax
xor ebx, ebx
lea eax, [ebp - 0x154]
push eax
mov edi, 0x20019
push edi
push ebx
push str.SOFTWARE
push 0x80000002
mov byte [ebp - 0x13d], bl
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x14c], ebx
call esi
test eax, eax
je 0x9060388
mov dword [ebp - 0x154], ebx
jmp 0x9060557
lea eax, [ebp - 0x148]
push eax
push edi
push ebx
push str.Adobe
push dword [ebp - 0x154]
call esi
test eax, eax
je 0x90603ad
mov dword [ebp - 0x148], ebx
jmp 0x9060557
lea eax, [ebp - 0x150]
push eax
push edi
push ebx
push str.Color
push dword [ebp - 0x148]
call esi
test eax, eax
je 0x90603d2
mov dword [ebp - 0x150], ebx
jmp 0x9060557
lea eax, [ebp - 0x144]
push eax
push edi
push ebx
push str.Monitor
push dword [ebp - 0x150]
call esi
test eax, eax
je 0x90603f7
mov dword [ebp - 0x144], ebx
jmp 0x9060557
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x144]
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9060452
cmp dword [ebp - 0x15c], 4
jne 0x9060452
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x160], eax
cmp eax, 0x3e7
ja 0x9060557
push dword [ebp - 0x160]
lea eax, [ebp - 0x1c]
push str.Monitor_u
push 0xb
push eax
call fcn.0903b6c0
add esp, 0x10
lea eax, [ebp - 0x14c]
push eax
push edi
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x144]
call esi
test eax, eax
je 0x90604dc
mov dword [ebp - 0x14c], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x144], ebx
je 0x90604a0
push dword [ebp - 0x144]
call esi
cmp dword [ebp - 0x150], ebx
je 0x90604b0
push dword [ebp - 0x150]
call esi
cmp dword [ebp - 0x148], ebx
je 0x90604c0
push dword [ebp - 0x148]
call esi
cmp dword [ebp - 0x154], ebx
je 0x90604d0
push dword [ebp - 0x154]
call esi
mov al, byte [ebp - 0x13d]
call fcn.0900804d
ret
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x14c]
mov dword [ebp - 0x158], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9060557
cmp dword [ebp - 0x15c], 1
jne 0x9060557
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0905592d
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 4], ebx
call fcn.0903b6c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.090167a9
mov byte [ebp - 0x13d], 1
cmp dword [ebp - 0x14c], ebx
je 0x906048a
push dword [ebp - 0x14c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x9060490
Function at 0x9063086
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a2ae1
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.0909ea10
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
mov eax, dword [esi + 4]
add eax, 0x78
mov edi, ecx
push 0
push eax
mov dword [ebp - 0x13e8], edi
mov dword [ebp - 0x13e4], esi
call fcn.0903b6c0
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x906310a
mov eax, dword [esi + 4]
push 0
push 0x753
push 0xb71b
push eax
call fcn.0903b6c0
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.0900e991
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], 0xc
mov eax, dword [ebp - 0x13d4]
push 0x18
xor edx, edx
pop ecx
div ecx
mov ecx, dword [ebp - 0x13d8]
add dword [ebp - 0x13d4], 0x8000
add dword [ebp - 0x13d8], 2
cmp dword [ebp - 0x13d4], 0xc800c
mov word [ecx], ax
jb 0x906312e
and dword [ebp - 0x13d8], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13e0], eax
jmp 0x906317f
mov edi, dword [ebp - 0x13e8]
mov esi, dword [ebp - 0x13e4]
mov eax, dword [ebp - 0x13e0]
movzx eax, word [eax]
and dword [ebp - 0x13d4], 0
mov dword [ebp - 0x13dc], eax
lea eax, [ebp - 0x13cc]
xor ecx, ecx
mov dx, word [ebp - 0x13dc]
mov word [eax - 2], dx
mov edx, dword [ebp - 0x13d4]
movzx edx, word [ebp + edx*2 - 0x48]
mov word [eax], dx
mov dx, word [ebp + ecx*2 - 0x48]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x19
jb 0x906319d
inc dword [ebp - 0x13d4]
cmp dword [ebp - 0x13d4], 0x19
jb 0x906319b
push 0
mov eax, 0x504c4142
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
mov ecx, esi
call fcn.0903b6c0
push 1
push 0x753
push dword [ebp - 0x13d8]
lea ecx, [ebp - 0x1408]
push dword [edi]
call fcn.0903b6c0
lea ecx, [ebp - 0x1408]
mov byte [ebp - 4], 1
call fcn.09005145
lea edi, [ebp - 0x13d0]
lea esi, [eax + 2]
mov dword [ebp - 0x13dc], 0x19
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [edi]
mov ecx, dword [edi + 4]
shr eax, 0x10
imul eax, eax, 0xff
add eax, 0x4000
shr eax, 0xf
mov byte [esi - 2], al
movzx eax, cx
push eax
mov dword [ebp - 0x13f0], ecx
call fcn.0903b6c0
mov byte [esi - 1], al
movzx eax, word [ebp - 0x13ee]
push eax
call fcn.0903b6c0
mov byte [esi], al
pop ecx
add esi, 3
add edi, 8
dec dword [ebp - 0x13d4]
pop ecx
jne 0x906323a
dec dword [ebp - 0x13dc]
jne 0x9063230
lea ecx, [ebp - 0x1408]
mov byte [ebp - 4], 0
call fcn.09005177
add dword [ebp - 0x13d8], 0x753
add dword [ebp - 0x13e0], 2
cmp dword [ebp - 0x13d8], 0xb71b
jb 0x9063173
mov ecx, dword [ebp - 0x13e4]
or dword [ebp - 4], 0xffffffff
call fcn.0903b6c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x906400a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a2cd0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.0909ea10
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
mov eax, dword [edi + 4]
add eax, 0x78
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x13ec], esi
mov dword [ebp - 0x13e4], edi
call fcn.0903b6c0
cmp dword [esi], 0
pop ecx
pop ecx
jne 0x906408e
mov eax, dword [edi + 4]
push 0
push 0x9c4
push 0xf424
push eax
call fcn.0903b6c0
add esp, 0x10
mov dword [esi], eax
mov ecx, edi
mov dword [ebp - 0x13f0], edi
call fcn.0900e991
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x13d4], 0xc
mov eax, dword [ebp - 0x13d4]
push 0x18
xor edx, edx
pop esi
div esi
add dword [ebp - 0x13d4], 0x8000
mov word [ecx], ax
add ecx, 2
cmp dword [ebp - 0x13d4], 0xc800c
jb 0x90640ac
and dword [ebp - 0x13dc], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13e0], eax
mov esi, 0x4000
jmp 0x90640f2
mov edi, dword [ebp - 0x13e4]
mov eax, dword [ebp - 0x13e0]
movzx eax, word [eax]
and dword [ebp - 0x13d4], 0
mov dword [ebp - 0x13d8], eax
lea eax, [ebp - 0x13cc]
xor ecx, ecx
mov dx, word [ebp - 0x13d8]
mov word [eax - 2], dx
mov edx, dword [ebp - 0x13d4]
movzx edx, word [ebp + edx*2 - 0x48]
mov word [eax], dx
mov dx, word [ebp + ecx*2 - 0x48]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x19
jb 0x9064110
inc dword [ebp - 0x13d4]
cmp dword [ebp - 0x13d4], 0x19
jb 0x906410e
push 0
push 0x434d594b
push 0x50524742
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
mov ecx, edi
call fcn.0903b6c0
mov eax, dword [ebp - 0x13ec]
push 1
push 0x9c4
push dword [ebp - 0x13dc]
lea ecx, [ebp - 0x1404]
push dword [eax]
call fcn.0903b6c0
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 1
call fcn.09005145
lea ecx, [ebp - 0x13d0]
add eax, 2
mov dword [ebp - 0x13d8], 0x19
mov dword [ebp - 0x13d4], ecx
mov dword [ebp - 0x13e8], 0x19
mov ecx, dword [ebp - 0x13d4]
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
movzx edx, di
imul edx, edx, 0xff
add edx, esi
shr edx, 0xf
mov byte [eax - 2], dl
shr edi, 0x10
mov edx, edi
imul edx, edx, 0xff
add dword [ebp - 0x13d4], 8
add edx, esi
shr edx, 0xf
mov byte [eax - 1], dl
movzx edx, cx
shr ecx, 0x10
imul edx, edx, 0xff
imul ecx, ecx, 0xff
add edx, esi
add ecx, esi
shr edx, 0xf
shr ecx, 0xf
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
dec dword [ebp - 0x13e8]
jne 0x90641bc
dec dword [ebp - 0x13d8]
mov ecx, dword [ebp - 0x13d4]
jne 0x90641ac
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 0
call fcn.09005177
add dword [ebp - 0x13dc], 0x9c4
add dword [ebp - 0x13e0], 2
cmp dword [ebp - 0x13dc], 0xf424
jb 0x90640ec
mov ecx, dword [ebp - 0x13e4]
or dword [ebp - 4], 0xffffffff
call fcn.0903b6c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90646d5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a2cd0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.0909ea10
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
mov eax, dword [edi + 4]
add eax, 0x78
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x13ec], esi
mov dword [ebp - 0x13e4], edi
call fcn.0903b6c0
cmp dword [esi], 0
pop ecx
pop ecx
jne 0x9064759
mov eax, dword [edi + 4]
push 0
push 0x9c4
push 0xf424
push eax
call fcn.0903b6c0
add esp, 0x10
mov dword [esi], eax
mov ecx, edi
mov dword [ebp - 0x13f0], edi
call fcn.0900e991
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x13d4], 0xc
mov eax, dword [ebp - 0x13d4]
push 0x18
xor edx, edx
pop esi
div esi
add dword [ebp - 0x13d4], 0x8000
mov word [ecx], ax
add ecx, 2
cmp dword [ebp - 0x13d4], 0xc800c
jb 0x9064777
and dword [ebp - 0x13dc], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13e0], eax
mov esi, 0x4000
jmp 0x90647bd
mov edi, dword [ebp - 0x13e4]
mov eax, dword [ebp - 0x13e0]
movzx eax, word [eax]
and dword [ebp - 0x13d4], 0
mov dword [ebp - 0x13d8], eax
lea eax, [ebp - 0x13cc]
xor ecx, ecx
mov dx, word [ebp - 0x13d8]
mov word [eax - 2], dx
mov edx, dword [ebp - 0x13d4]
movzx edx, word [ebp + edx*2 - 0x48]
mov word [eax], dx
mov dx, word [ebp + ecx*2 - 0x48]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x19
jb 0x90647db
inc dword [ebp - 0x13d4]
cmp dword [ebp - 0x13d4], 0x19
jb 0x90647d9
push 0
push 0x434d594b
push 0x504c4142
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
mov ecx, edi
call fcn.0903b6c0
mov eax, dword [ebp - 0x13ec]
push 1
push 0x9c4
push dword [ebp - 0x13dc]
lea ecx, [ebp - 0x1404]
push dword [eax]
call fcn.0903b6c0
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 1
call fcn.09005145
lea ecx, [ebp - 0x13d0]
add eax, 2
mov dword [ebp - 0x13d8], 0x19
mov dword [ebp - 0x13d4], ecx
mov dword [ebp - 0x13e8], 0x19
mov ecx, dword [ebp - 0x13d4]
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
movzx edx, di
imul edx, edx, 0xff
add edx, esi
shr edx, 0xf
mov byte [eax - 2], dl
shr edi, 0x10
mov edx, edi
imul edx, edx, 0xff
add dword [ebp - 0x13d4], 8
add edx, esi
shr edx, 0xf
mov byte [eax - 1], dl
movzx edx, cx
shr ecx, 0x10
imul edx, edx, 0xff
imul ecx, ecx, 0xff
add edx, esi
add ecx, esi
shr edx, 0xf
shr ecx, 0xf
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
dec dword [ebp - 0x13e8]
jne 0x9064887
dec dword [ebp - 0x13d8]
mov ecx, dword [ebp - 0x13d4]
jne 0x9064877
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 0
call fcn.09005177
add dword [ebp - 0x13dc], 0x9c4
add dword [ebp - 0x13e0], 2
cmp dword [ebp - 0x13dc], 0xf424
jb 0x90647b7
mov ecx, dword [ebp - 0x13e4]
or dword [ebp - 4], 0xffffffff
call fcn.0903b6c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x9095fa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a3edd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb18
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb24], eax
call fcn.0903b6c0
add esp, 4
push eax
lea ecx, [ebp - 0xb20]
call fcn.0903b6c0
push 0
push 0
mov eax, dword [ebp - 0xb20]
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push eax
push esi
mov dword [ebp - 4], 0
call fcn.09008249
add esp, 0x3c
push eax
lea ecx, [ebp - 0xb1c]
call fcn.0903b6c0
mov byte [ebp - 4], 1
xor eax, eax
jmp 0x9096050
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x9096050
push 0
push 0x5058595a
push 0x67386b30
push pe_nt_image_headers32
lea ecx, [ebp - 0x918]
push ecx
mov ecx, dword [ebp - 0xb1c]
lea edx, [ebp - 0x118]
push edx
call fcn.0903b6c0
movzx edi, word [ebp - 0x914]
movzx esi, word [ebp - 0x11c]
cmp esi, edi
ja 0x90960a5
push 0x6250726f
call fcn.0903b6c0
sub esi, edi
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx*8 - 0x914]
cmp eax, edi
ja 0x90960c0
xor eax, eax
jmp 0x90960e9
movzx edx, word [ebp - 0x11c]
cmp eax, edx
jb 0x90960da
mov edx, 0x8000
mov word [ebp + ecx*2 - 0xb18], dx
jmp 0x90960f1
sub eax, edi
mov edx, esi
shr edx, 1
shl eax, 0xf
add eax, edx
xor edx, edx
div esi
mov word [ebp + ecx*2 - 0xb18], ax
inc ecx
cmp ecx, 0x100
jb 0x90960b0
lea ecx, [ebp - 0xb1c]
mov byte [ebp - 4], 0
call fcn.0900ec67
lea ecx, [ebp - 0xb20]
mov dword [ebp - 4], 0xffffffff
call fcn.09019001
mov esi, dword [ebp - 0xb24]
lea eax, [esi + 8]
push eax
push 0x260
mov dword [ebp - 0xb24], eax
call fcn.0903b6c0
add esp, 8
mov dword [ebp - 0xb20], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909615b
push esi
mov ecx, eax
call fcn.0903b6c0
mov esi, eax
mov dword [ebp - 0xb1c], esi
jmp 0x909616b
mov dword [ebp - 0xb1c], 0
mov esi, dword [ebp - 0xb1c]
fld qword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
fmul qword [0x90b4990]
mov ecx, dword [eax]
fldz
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 4]
fcomp st(1)
mov dword [esi + 0x54], edx
fnstsw ax
test ah, 0x41
jne 0x9096195
fsub qword [0x90aad88]
jmp 0x909619b
fadd qword [0x90aad88]
call fcn.0909e870
mov word [esi + 0x58], ax
mov eax, dword [ebp - 0xb1c]
lea edi, [esi + 0x5a]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4037f1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.00404060
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x403842
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_LoadResource
mov dword [0x40e3e4], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x40e3f8], eax
mov eax, dword [esp + 4]
jmp 0x40384a
push dword [esp]
call fcn.0040aca0
add esp, 8
ret 8

Function at 0x403858
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x403860
mov edx, dword [esp + 0x48]
lea ecx, [esp]
call fcn.00404060
lea edx, [esp + 4]
push edx
push 0
push 5
push 4
push 4
call fcn.0040a8bd
lea edx, [esp + 0xc]
push edx
push 0
push 5
push 4
push 4
call fcn.0040a8bd
lea edx, [esp + 0x14]
push edx
push 0
push 5
push 4
push 4
call fcn.0040a8bd
push dword [esp]
push dword [esp + 0x60]
push dword [esp + 0x54]
jmp loc.00410416

Function at 0x404af1
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x404b40
push dword [esp + 0x10]
push 0x404a6f
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x40e4dc]
cmp esi, ebx
je 0x404b94
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x404b38
cmp byte [esi + 0x10], bl
je 0x404b38
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x404b15
jmp 0x404b94
mov esi, dword [0x40e4dc]
cmp esi, ebx
je 0x404b94
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x404b8d
cmp byte [esi + 0x11], bl
je 0x404b6a
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x404b80
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x40e4dc
call fcn.0040a87d
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x404b4b
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1002aaee
pop dword [ebp - 0x44]
mov eax, 0x9790ef6b
sub eax, 0x878e447d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc66e0a01
add dword [ebp - 0x54], 0x87e43b4a
mov dword [ebp - 0x50], 0xce9a247b
sub dword [ebp - 0x50], 0x9c66d836
mov dword [ebp - 0x4c], 0x373abc9c
sub dword [ebp - 0x4c], 0xeaee786e
mov dword [ebp - 0x48], 0xf5f0a37e
sub dword [ebp - 0x48], 0xf5f0a37e
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xbff2d591
sub dword [ebp - 0x54], 0x4b806c3b
mov dword [ebp - 0x50], 0x191eed4e
add dword [ebp - 0x50], 0x284d7427
mov dword [ebp - 0x4c], 0xdde74b08
sub dword [ebp - 0x4c], 0x7a77de9c
mov dword [ebp - 0x48], 0x9b8fa68f
add dword [ebp - 0x48], 0x64705971
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x38fd1d38
sub eax, 0x28fa5d10
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39be8
push 0
call eax
mov ecx, 0xef866f7
add ecx, 0xf107ee24
xor ebx, ebx
add ebx, eax
mov esi, 0x10039600
add esi, dword [ebp - 0x44]
mov edx, 0xec8f285a
sub edx, 0xab7bf27e
xor dword [ebp - 0x14], ebx
mov edi, dword [esi]
sub edi, edx
xor dword [ebp - 0x14], edx
mov dword [ebx], edi
xor dword [ebp - 0x18], 0xe51b5e79
add ebx, 0xb27843f6
add ebx, 0x4d87bc0e
add esi, 0x486de038
sub esi, 0x486de034
loop 0x1002ac07
add eax, 0x1473f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10001000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x104
push 0
push 0x10106ed0
call fcn.10021ab0
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov esi, esp
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SOFTWAREASUSAI_SUITE_IIASUS_Update
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.10021b10
test eax, eax
jne 0x100010c3
mov dword [ebp - 0x10], 0x104
mov esi, esp
lea ecx, [ebp - 0x10]
push ecx
push 0x10106ed0
lea edx, [ebp - 0xc]
push edx
push 0
push 0x100f31c8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.10021b10
test eax, eax
jne 0x100010a3
cmp dword [ebp - 0xc], 1
jne 0x100010a3
mov dword [ebp - 0x14], 1
jmp 0x100010aa
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.10021b10
mov eax, 0x10106ed0
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.10021b10
mov esp, ebp
pop ebp
ret

Function at 0x100011f4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea edi, [ebp - 0x104]
mov ecx, 0x41
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
push 1
call fcn.100012f4
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push 2
call fcn.100012f4
add esp, 8
mov edx, dword [ebp + 8]
push edx
push 5
call fcn.100012f4
add esp, 8
call section..text
push eax
push str._sBIOSInfo.ini
lea eax, [ebp - 0x104]
push eax
call fcn.10022150
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0x104]
push ecx
push 0
push str.Blocks
push str.File_Information
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp esi, esp
call fcn.10021b10
pop edi
pop esi
add esp, 0x104
cmp ebp, esp
call fcn.10021b10
mov esp, ebp
pop ebp
ret
Function at 0x100012f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push esi
push edi
lea edi, [ebp - 0x34c]
mov ecx, 0xd3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
call section..text
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.10022250
add esp, 8
call section..text
push eax
push str._sPEUpdater.exe
lea ecx, [ebp - 0x108]
push ecx
call fcn.10022150
add esp, 0xc
mov dword [ebp - 0x348], 0x3c
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x33c], 0x100f3214
lea edx, [ebp - 0x108]
mov dword [ebp - 0x338], edx
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x344], 0x40
mov ecx, dword [ebp + 8]
and ecx, 0xff
mov dword [ebp - 0x34c], ecx
cmp dword [ebp - 0x34c], 5
ja case.default.0x100013b3
mov edx, dword [ebp - 0x34c]
jmp dword [edx*4 + 0x100014d3]
push str._Check
lea eax, [ebp - 0x208]
push eax
call fcn.10022250
add esp, 8
jmp case.default.0x100013b3
mov ecx, dword [ebp + 0xc]
push ecx
push str._GetFileInfo__s
lea edx, [ebp - 0x208]
push edx
call fcn.10022150
add esp, 0xc
jmp case.default.0x100013b3
push str._GetROMInfo
lea eax, [ebp - 0x208]
push eax
call fcn.10022250
add esp, 8
jmp case.default.0x100013b3
mov ecx, dword [ebp + 0xc]
push ecx
push str._SaveBIOS__s
lea edx, [ebp - 0x208]
push edx
call fcn.10022150
add esp, 0xc
jmp case.default.0x100013b3
mov eax, dword [ebp + 0xc]
push eax
push str._FlashBIOS__s
lea ecx, [ebp - 0x208]
push ecx
call fcn.10022150
add esp, 0xc
jmp case.default.0x100013b3
mov edx, dword [ebp + 0xc]
push edx
push str._GetBlocks__s
lea eax, [ebp - 0x208]
push eax
call fcn.10022150
add esp, 0xc
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x334], ecx
mov esi, esp
lea edx, [ebp - 0x348]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp esi, esp
call fcn.10021b10
test eax, eax
je 0x100014be
cmp dword [ebp - 0x310], 0
je 0x100014be
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.10021b10
mov esi, esp
push 0
mov ecx, dword [ebp + 8]
and ecx, 0xff
push ecx
push 0x466
mov edx, dword [0x10107000]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
cmp esi, esp
call fcn.10021b10
mov al, 1
jmp 0x100014c0
xor al, al
pop edi
pop esi
add esp, 0x34c
cmp ebp, esp
call fcn.10021b10
mov esp, ebp
pop ebp
ret