joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x6cbd0409
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x19a267fb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0xe14424
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x48]
lea esi, [ebx + 0x28]
mov edx, dword [ebx + 4]
add eax, 0x28
mov ecx, dword [ebx]
add eax, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
test edx, edx
jne 0xe1446f
cmp ecx, 0x20
jae 0xe1446f
mov edi, dword [ebp + 8]
mov ebx, dword [ebx + 0x18]
add ebx, 0x165667c5
mov edi, dword [edi + 0x1c]
adc edi, 0x27d4eb2f
jmp 0xe14506
push dword [ebx + 0x24]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x12
push dword [ebx + 0x24]
push dword [ebx + 0x20]
call fcn.00e13394
push 0xc
push dword [ebx + 0x1c]
mov edi, eax
mov esi, edx
push dword [ebx + 0x18]
call fcn.00e13394
push 7
push dword [ebx + 0x14]
add edi, eax
push dword [ebx + 0x10]
adc esi, edx
call fcn.00e13394
push 1
push dword [ebx + 0xc]
add edi, eax
push dword [ebx + 8]
adc esi, edx
call fcn.00e13394
add esp, 0x30
add edi, eax
adc esi, edx
push esi
push edi
call fcn.01646914
add esp, 0x10
push edx
push eax
call fcn.01646914
add esp, 0x10
push edx
push eax
call fcn.01646914
add esp, 0x10
push edx
push eax
call fcn.01646914
mov esi, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
mov edi, edx
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov edx, dword [ebp - 0x10]
add ebx, ecx
lea ecx, [esi + 8]
adc edi, edx
jmp 0xe14560
push 0x1b
push esi
call fcn.016414c8
push edx
push eax
push 0
push 0
call fcn.016487e4
add esp, 0x14
xor edx, edi
xor eax, ebx
push edx
push eax
call fcn.00e13394
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.00e117b0
mov ecx, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
mov edi, edx
adc edi, 0x85ebca77
add esi, 8
add ecx, 8
mov dword [ebp - 8], ecx
cmp ecx, eax
jbe 0xe1450f
lea ecx, [esi + 4]
mov dword [ebp - 0x10], ecx
cmp ecx, eax
ja 0xe145c3
push 0x17
push esi
call fcn.01649d28
pop ecx
mov ecx, eax
mov eax, 0x9e3779b1
mul ecx
mov esi, eax
mov eax, 0x85ebca87
mul ecx
add esi, edx
xor eax, ebx
xor esi, edi
push esi
push eax
call fcn.00e13394
add esp, 0xc
push 0xc2b2ae3d
push 0x27d4eb4f
push edx
push eax
call fcn.00e117b0
mov esi, dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0x9e3779f9
mov edi, edx
adc edi, 0x165667b1
cmp esi, eax
jae 0xe14607
movzx eax, byte [esi]
push 0xb
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00e117b0
xor edx, edi
xor eax, ebx
push edx
push eax
call fcn.00e13394
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.00e117b0
inc esi
mov ebx, eax
mov edi, edx
cmp esi, dword [ebp - 4]
jb 0xe145c7
push 0xc2b2ae3d
xor eax, eax
mov ecx, edi
push 0x27d4eb4f
shr ecx, 1
xor eax, edi
xor ecx, ebx
push eax
push ecx
call fcn.00e117b0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.00e117b0
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
leave
ret
Function at 0xe173a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [edx]
mov eax, dword [edx + 4]
test esi, esi
jle 0xe17403
mov ecx, dword [ebp + 0x10]
sub dword [ebp + 0xc], ecx
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
push edi
inc bl
movzx ebx, bl
mov cl, byte [edx + ebx + 8]
add al, cl
movzx eax, al
mov dword [ebp + 8], eax
mov edi, dword [ebp + 8]
mov al, byte [edx + eax + 8]
mov byte [edx + ebx + 8], al
add al, cl
movzx eax, al
mov byte [edx + edi + 8], cl
mov cl, byte [eax + edx + 8]
mov eax, dword [ebp + 0x10]
xor cl, byte [esi + eax]
mov byte [eax], cl
inc eax
sub dword [ebp - 4], 1
mov dword [ebp + 0x10], eax
mov eax, edi
jne 0xe173c2
mov esi, dword [ebp + 0x14]
pop edi
mov dword [edx + 4], eax
mov eax, esi
pop esi
mov dword [edx], ebx
pop ebx
leave
ret
Function at 0x1599ffa
Capabilities:
Encrypt data using speck

Disassembly:
pop ss
xchg ebp, eax
outsd dx, dword [esi]
invalid
jle 0x159a002
push ebp
mov ebp, esp
leave
xchg edi, eax
mov eax, ebx
push edi
xchg edi, eax
pop eax
and ebx, 0x1e030fff
shr edi, 0xc
add ebx, edx
inc ebp
in al, dx
mov eax, ebx
push dword [ebp - 0x14]
xchg dword [ebp - 0x14], eax
pop eax
cmp edi, 3
mov edi, edi
je 0x15f3098
cmp edi, 0xe
jne 0x1595c11
jmp 0x15f3081
adc eax, 0x7ba3a32c
or eax, 0xee72b54d
mov ch, 0x72
out dx, al
inc edx
popfd
push edx
in al, dx
aaa
je 0x15f30b0
sub ah, byte [esi + 0x379d86e1]
dec esi
xchg esp, eax
push edi
iretd
call 0xf4a0fc39
std
xor byte [ebp - 0x3bb2e6f5], bl
mov ebx, 0x655f9f24
and cl, 0x60
sub al, 0xf8
jmp 0x15f3032
cdq
jnp 0x15f302a
mov edi, esi
mov ch, 0x90
xchg esp, eax
stosd dword es:[edi], eax
inc edx
fidivr word [eax + 0x27]
mov ecx, 0x8c6ecaa6
stc
dec edx
xchg ebp, eax
mov dword [edi - 0x43689f7f], ebp
sbb edi, ebp
iretd
pushal
xchg edi, eax
mov esp, 0xe0cfef19
setbe byte [esi - 0xb]
aad 0xdd
sbb eax, 0xba54fea9
and bl, bh
test al, 0x95
fisubr word [ebp + edi - 0x5a]
sti
ret

Function at 0x1648d74
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push edi
mov ebx, 0x1646420
mov eax, dword [eax + 0xc]
push ebx
mov edi, dword [eax + 0x18]
push dword [edi + 0x28]
call fcn.016399b8
pop ecx
pop ecx
test eax, eax
jne 0x1648d9b
mov eax, dword [edi + 0x10]
jmp 0x1648dba
push esi
mov esi, dword [edi + 4]
jmp 0x1648db3
push ebx
push dword [esi + 0x28]
call fcn.016399b8
pop ecx
pop ecx
test eax, eax
je 0x1648dbd
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x1648da1
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x10]
jmp 0x1648db9
Function at 0x164a39c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
call fcn.00e17a6c
outsb dx, byte [esi]
call fcn.016464e8
invalid

Function at 0x164c6e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
test ebx, ebx
je 0x164c73b
mov edi, dword [ebp + 0xc]
test edi, 0xffff0000
jne 0x164c705
sub edi, dword [ebx + esi + 0x10]
jmp 0x164c756
mov ecx, dword [ebx + esi + 0x20]
xor eax, eax
add ecx, esi
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
cmp dword [ebx + esi + 0x18], eax
jbe 0x164c73b
mov eax, dword [ecx + eax*4]
add eax, esi
push edi
push eax
call fcn.0163711c
pop ecx
pop ecx
test eax, eax
je 0x164c744
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebx + esi + 0x18]
jb 0x164c719
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 8]
test ecx, ecx
js 0x164c73b
mov eax, dword [ebx + esi + 0x24]
lea eax, [eax + ecx*2]
movzx edi, word [eax + esi]
cmp edi, 0xffffffff
je 0x164c73b
cmp edi, dword [ebx + esi + 0x14]
jae 0x164c73b
mov eax, dword [ebx + esi + 0x1c]
lea eax, [eax + edi*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x164c73d
Function at 0xb606c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
lea esp, [esp + 7]
mov cx, 0x6d22
neg ch
mov dword [esp + 3], edx
not edx
jmp 0xb606ab
mov byte [esp + 7], dh
mov si, word [esp + 0x13]
mov byte [esp + 0x19], cl
lea ecx, [esi + ebp]
rcr ecx, 2
add esp, 9
jmp 0xb60670
not ah
pop word [esp]
lea eax, [ebx - 0xd7]
lea esp, [esp + 3]
jmp 0xb606f5
lea esp, [esp + 8]
pushal
sub esp, 0x1e
mov word [esp], ax
pop word [esp + 0xa]
jmp 0xb60693
cmc
xchg bx, si
cpuid
add esp, 2
neg edi
mov byte [esp], dh
jmp 0xb60707
lea ebx, [esp + edi]
rdtsc
bswap ebx
mov byte [esp], ah
mov ch, 0xe5
mov word [esp], di
jmp 0xb606d4
inc di
setae ch
mov ax, word [esp]
add esp, 0
mov bp, word [esp]
not edi
jmp 0xb6079d
rdtsc
mov byte [esp], bl
add esp, 0
bt esi, edi
call 0xb60741
Function at 0xb60d22
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, ecx
clc
rdtsc
xchg byte [esp + 0xd], dh
setae cl
cld
jmp 0xb60cba
bsr eax, esi
rdtsc
or al, dl
mov di, 0xf5e
cmc
bswap ebx
jmp 0xb60cd0
xchg dword [esp + 0x11], eax
or ebx, 0x4d8986d0
jmp 0xb60cf5

Function at 0xb64e75
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
rcl si, cl
not bp
mov edx, dword [esp]
cld
jmp 0xb64dd5

Function at 0xb64ee9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, 0xd8
lea esp, [esp + 3]
xchg bl, dh
jmp 0xb64f22
mov di, 0x2e43
rcl ch, 2
mov bx, 0x99f
mov edx, 0xb3970e49
rdtsc
lea ebp, reloc.MSVFW32.dll_DrawDibDraw
jmp 0xb64f0c

Function at 0xb6521c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x2b]
pop edi
add esp, 0xb
pop dword [esp + 9]
rcl ebp, 0x1f
jmp 0xb6523b
pop esi
xchg dword [esp + 0xf], ebx
neg si
xchg si, bp
cmc
pop esi
jmp 0xb651e7
pushfd
mov bp, 0xcc7
xchg dl, dh
jmp 0xb651fd
mov bl, byte [esp + 0x18]
mov di, 0x8ae0
bsr si, bp
pop esi
cld
not esi
jmp 0xb65260
mov ax, bp
bswap ebx
std
and ax, di
xchg dl, cl
mov cl, ah
jmp 0xb65225
xchg ch, dh
inc edx
mov ah, byte [esp + 5]
cpuid
pop edi
mov ebx, 0xe9f240d5
jmp 0xb6527a
mov byte [esp + 0x13], bh
rdtsc
mov dl, byte [esp + 8]
push word [esp + 0xb]
pop bp
lea edi, [ebx*4]
jmp 0xb6524a
mov word [esp], sp
bswap esi
sub esp, 0xf
rdtsc
stc
mov si, bx
jmp 0xb6531b
xchg ecx, ebx
mov edi, 0x74f652aa
dec dx
clc
cmc
mov edi, 0xd02e6151
jmp 0xb65303
shr bh, cl
mov ebx, 0xe115da94
push dword [esp]
setl ah
lea esp, [esp + 4]
pop word [esp + 0x10]
jmp 0xb652b1
pop ebx
mov si, word [esp + 5]
xchg word [esp + 1], si
mov byte [esp + 0xc], ah
jmp 0xb6534d
xchg dword [esp + 0x10], ecx
pop eax
mov bl, 0xaa
xchg edi, eax
dec edx
bt si, cx
jmp 0xb652ed
lea edi, [eax + edi]
push word [esp + 0x1d]
xchg word [esp + 0x24], bx
lea esp, [esp + 0x11]
mov cx, bx
xchg cl, ch
jmp 0xb652d5
lea ebx, [eax + ebp]
neg bx
not eax
xchg ah, dl
neg edx
mov byte [esp], ch
jmp 0xb65376
mov bh, ch
lea edi, [ecx + esi]
lea esp, [esp + 7]
mov ax, word [esp + 2]
pop edx
xchg ah, bl
jmp 0xb65333
mov dx, di
xchg esi, eax
xchg word [esp + 0xd], si
bsr bx, bp
jmp 0xb6538a
push eax
cpuid
pop word [esp]
sub esp, 0xb
mov word [esp + 7], sp
bts esi, edi
jmp 0xb65360
pop word [esp + 4]
mov edx, 0x4e0d5ca8
call fcn.00b653b9
ror byte [edi - 0x21], 0xba
dec ecx
mov eax, 0xffec9d62
invalid
Function at 0xb65508
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea ebx, [ecx + esi]
dec bx
setno dl
pop dword [esp + 0xa]
jmp 0xb654ea
mov dx, cx
push dword [esp + 5]
mov di, 0xe400
setg dl
cpuid
xchg edi, edx
jmp 0xb654c0
push dword [esp + 4]
push dword [esp + 0x17]
xchg dword [esp + 0x13], ebx
xchg bp, dx
lea esi, [ebx + edi]
rcr ah, cl
jmp 0xb6552b
lea esp, [esp]
not eax
xchg ah, dl
push dword [esp + 1]
jmp 0xb654d6
bswap esi
add bh, bh
push word [esp + 0xe]
xchg word [esp], ax
jmp 0xb65555
neg al
mov dword [esp + 9], ebx
mov bh, 0x22
xchg al, ch
setbe dh
mov edi, 0xf6fe9d77
jmp 0xb65515
mov eax, dword [esp + 7]
dec di
lea eax, [esp + ebx]
mov cx, si
neg esi
jmp 0xb655a1
xor esi, 0x6de89fe1
mov edx, esi
neg ebp
mov dword [esp + 9], esp
mov bh, byte [esp + 0xe]
xchg byte [esp + 0x1d], bh
jmp 0xb6553f
xchg word [esp + 5], cx
mov ecx, edi
xchg cx, ax
neg ch
pushfd
jmp 0xb655b6
mov dword [esp + 1], edx
rdtsc
pop eax
setnp ah
mov ah, byte [esp + 0xf]
push word [esp + 9]
jmp 0xb6558b
mov edi, 0xac40a5a4
setb bl
mov bx, word [esp + 0x17]
neg eax
rdtsc
push esi
jmp 0xb655f1
push word [esp + 0x15]
mov word [esp + 1], sp
mov byte [esp + 0xc], ah
xchg esi, eax
setge cl
push word [esp + 0x25]
jmp 0xb6573c
mov byte [esp + 0x19], dl
xchg esi, ecx
push word [esp + 0x1d]
pop cx
mov ebx, 0x11ca3012
xchg byte [esp + 4], bh
call fcn.00b6561e
mov dword [esp + 1], esi
mov ch, 0xce
mov ecx, 0x7d730bc9
setne ah
lea esp, [esp + 7]
jmp 0xb65671
pop word [esp + 8]
rdtsc
mov dh, ch
mov dword [esp + 0xb], edi
mov al, byte [esp + 0x1f]
neg di
jmp 0xb656e1
btc bx, cx
btr cx, dx
add esp, 0x11
mov bx, word [esp + 9]
cmc
mov ax, 0xf51d
call fcn.00b656c0
ret 0xdd84
mov ecx, dword [esp + 0x1a]
not bp
not ch
lea ecx, [ebx*4]
pop dword [esp + 0x18]
xchg word [esp], si
jmp 0xb65634
xchg byte [esp + 0x1d], bh
mov word [esp + 9], sp
mov bx, 0x2784
pop eax
mov cx, word [esp + 0xe]
mov ax, 0x9687
jmp 0xb6570e

Function at 0xb658c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, 0x8e0b5cda
mov si, 0x1493
push word [esp + 2]
jmp 0xb658e8
pop dword [esp]
mov di, word [esp]
rdtsc
mov esi, 0x8b0a3c2f
mov si, 0xd19c
jmp 0xb65892
mov byte [esp + 1], dh
mov edx, dword [esp + 4]
xchg byte [esp + 1], bl
xchg edi, eax
rdtsc
jmp 0xb658a8
pop word [esp + 1]
xchg word [esp + 1], cx
cmc
lea ebp, [ebx + ebx]
jmp 0xb6594e
lea edi, reloc.MSVFW32.dll_DrawDibDraw
mov bx, word [esp + 2]
bswap eax
jmp 0xb658d2
lea edi, [ecx*4]
xchg dl, dh
lea edx, reloc.MSVFW32.dll_DrawDibDraw
mov ch, 0xaf
xchg dword [esp], edx
cpuid
jmp 0xb6590f
pop word [esp]
rdtsc
lea ebp, [edi + ebp]
add esp, 0
pushfd
dec ebx
jmp 0xb65925

Function at 0xb65b57
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00b6508e
pop word [esp]
pushal
push dword [esp + 1]
pop word [esp + 0x1b]
jmp 0xb66261
push eax
jmp 0xb65089
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xb65d2d
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xb65e29
Function at 0x1c215f2
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.01c22012
test al, al
je 0x1c216a1
call fcn.01c23496
test al, al
je 0x1c21619
call fcn.01c23474
test al, al
je 0x1c216a1
cmp byte [ebp + 8], 0
jne 0x1c21628
call fcn.01c216a7
test al, al
je 0x1c216a1
push ebx
push edi
xor ebx, ebx
push ebx
call fcn.01c236f0
mov edi, eax
pop ecx
test edi, edi
je 0x1c2169f
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x40
push 0x40
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1c2169f
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x18]
mov esi, dword [edi]
push ebx
push 0x40
push section..crthunk
push 0x1c22b58
push ebx
push str.NtMapViewOfSection
push 0x1c20000
push 0x1c341c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, edi
call dword [esi + 4]
mov edx, dword [edi]
mov ecx, edi
push 1
mov esi, eax
call dword [edx]
test esi, esi
setns byte [0x1c3c9bc]
call fcn.01c219f5
pop esi
pop edi
pop ebx
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x1c216a7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push esi
push 3
push esi
push esi
push esi
push str.SOFTWAREUCBrowserBLBeacon
push 0x80000001
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1c216df
xor al, al
jmp 0x1c21762
push ebx
push edi
push 4
pop edi
lea eax, [ebp - 0x14]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
push esi
mov ebx, str.state
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c21755
cmp dword [ebp - 8], esi
je 0x1c21755
cmp dword [ebp - 0xc], edi
jne 0x1c21755
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.01c2155f
pop ecx
pop ecx
test al, al
je 0x1c21755
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 2
push eax
push edi
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x1c21760
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1c219f5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
push 3
push edi
push str.SOFTWAREUCBrowserBLFinchList
push 0x80000001
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1c21ac6
mov eax, 0x104
lea ecx, [ebp - 0x24]
push esi
push eax
mov dword [ebp - 4], eax
call fcn.01c2151f
mov esi, edi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x104
push eax
push edi
push edi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], edi
push eax
push dword [ebp - 0x24]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1c21ab4
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
inc dword [ebp - 4]
inc eax
push eax
mov dword [ebp - 8], eax
call fcn.01c2151f
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x24]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1c21aac
mov eax, dword [ebp - 8]
xor ecx, ecx
push edi
mov word [edi + eax*2 - 2], cx
call sym.chrome_elf.dll_AddDllToBlacklist
pop ecx
lea ecx, [ebp - 0x18]
call fcn.01c21931
inc esi
xor edi, edi
jmp 0x1c21a34
lea ecx, [ebp - 0x18]
call fcn.01c21931
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
call fcn.01c21931
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1c22fad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x1c3c114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x20c]
push 0x208
push ebx
push eax
mov dword [ebp - 0x480], ebx
call fcn.01c26b60
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
xor edi, edi
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1c231f6
push 0x20a
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.01c26b60
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1c231f6
and dword [ebp - 0x420], ebx
xor eax, eax
mov word [ebp - 0x430], ax
mov byte [ebp - 0x479], al
lea eax, [ebp - 0x479]
push eax
mov dword [ebp - 0x41c], 7
call fcn.01c2354c
pop ecx
test al, al
jne 0x1c23086
call fcn.01c23207
test al, al
je 0x1c23080
mov esi, str..pipeChromeCrashServices_
push esi
call fcn.01c23335
pop ecx
push eax
push esi
lea ecx, [ebp - 0x430]
call fcn.01c22737
jmp 0x1c2315d
xor edi, edi
mov eax, edi
jmp 0x1c2308f
movzx eax, byte [ebp - 0x479]
xor edi, edi
test eax, eax
je 0x1c231e8
lea eax, [ebp - 0x20c]
push eax
call fcn.01c234a3
pop ecx
test al, al
je 0x1c230bd
xor ebx, ebx
lea ecx, [ebp - 0x478]
push str.S_1_5_18
inc ebx
call fcn.01c22c42
jmp 0x1c230cd
push 2
lea eax, [ebp - 0x460]
pop ebx
push eax
call fcn.01c22ed7
pop ecx
push eax
lea ecx, [ebp - 0x448]
call fcn.01c22c1d
test bl, 2
je 0x1c230ef
push edi
push 1
lea ecx, [ebp - 0x460]
and ebx, 0xfffffffd
call fcn.01c225cc
test bl, 1
je 0x1c23105
push edi
push 1
lea ecx, [ebp - 0x478]
and ebx, 0xfffffffe
call fcn.01c225cc
cmp dword [ebp - 0x438], 0
jne 0x1c23121
push edi
push 1
lea ecx, [ebp - 0x448]
call fcn.01c225cc
jmp 0x1c231e8
mov esi, str..pipeGoogleCrashServices_
push esi
call fcn.01c23335
pop ecx
push eax
push esi
lea ecx, [ebp - 0x430]
call fcn.01c22737
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x430]
call fcn.01c2328f
push edi
push 1
lea ecx, [ebp - 0x448]
call fcn.01c225cc
push 0xc8
call fcn.01c25483
mov edi, eax
pop ecx
test edi, edi
je 0x1c231ba
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x448]
call fcn.01c22c42
or ebx, 4
lea esi, [ebp - 0x430]
cmp dword [ebp - 0x41c], 8
cmovae esi, dword [ebp - 0x430]
call fcn.01c22c9f
push eax
push esi
push 0x160
push 7
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
lea eax, [ebp - 0x448]
push eax
call fcn.01c238b5
jmp 0x1c231bc
xor eax, eax
mov dword [0x1c3c9cc], eax
test bl, 4
je 0x1c231da
push 0
push 1
lea ecx, [ebp - 0x448]
call fcn.01c225cc
mov eax, dword [0x1c3c9cc]
xor edi, edi
cmp dword [eax + 0xc], edi
je 0x1c231e8
mov byte [eax + 0xbd], 1
push edi
push 1
lea ecx, [ebp - 0x430]
call fcn.01c225cc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01c256c8
mov esp, ebp
pop ebp
ret
Function at 0x1c233aa
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1c3c114]
xor eax, ebp
mov dword [ebp - 4], eax
push str.IsSandboxedProcess
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1c233e5
call eax
test al, al
je 0x1c233e5
mov dword [0x1c3d3d8], 1
jmp 0x1c2344c
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
test ecx, ecx
je 0x1c23441
push edi
mov esi, str.___type
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebp - 0x18]
xor edi, edi
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x1c23409
lea eax, [ebp - 0x18]
sub esi, edx
push eax
push ecx
sar esi, 1
call fcn.01c26cba
pop ecx
pop ecx
pop edi
test eax, eax
je 0x1c23441
movzx eax, word [eax + esi*2]
test ax, ax
je 0x1c23441
mov dword [0x1c3d3d8], 1
cmp eax, 0x20
jne 0x1c2344b
mov dword [0x1c3d3d8], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01c256c8
mov esp, ebp
pop ebp
ret

Function at 0x1c234a3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1c3c114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.01c26b60
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ebx, 0x104
push ebx
push eax
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c2350a
cmp eax, ebx
jae 0x1c2350a
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.01c27f5d
add esp, 0xc
test eax, eax
jne 0x1c2350a
mov al, 1
jmp 0x1c2353c
push ebx
lea eax, [ebp - 0x20c]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c2353a
cmp eax, ebx
jae 0x1c2353a
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.01c27f5d
add esp, 0xc
test eax, eax
je 0x1c23506
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01c256c8
mov esp, ebp
pop ebp
ret