joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x73b643cc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x5f552f95
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100b17c
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
inc edi
mov dword [esi + 8], edi
call fcn.0100af89
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100b1a2
push 0x1388
push dword [esi + 0x38]
call ebx
push dword [esi + 0x3c]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [esi + 0x64]
call ebx
cmp eax, 0x102
jne 0x100b1cd
push 0
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x64], 0
pop edi
pop esi
pop ebx
ret

Function at 0x100b6f2
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
call fcn.0100b15d
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x18], ebx
cmp dword [esi + 0x64], ebx
jne 0x100b748
push edi
push dword [esi + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
call edi
push dword [esi + 0x3c]
call edi
lea eax, [esi + 0x68]
push eax
push ebx
push esi
push 0x100b264
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x64], eax
pop edi
jmp 0x100b75a
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1014057
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x228
mov eax, 0x101c6fd
call fcn.01019fd8
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x230], eax
call sub.MFC42u.dll_CString::CString
and dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call sub.MFC42u.dll_CString::CString
lea eax, [ebp - 0x218]
push eax
mov esi, 0x104
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
jbe 0x10140f9
push 0x10016f0
mov ecx, edi
call fcn.01019546
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.01019576
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call fcn.01019576
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.01019576
xor eax, eax
call fcn.0101a06a
ret 0xc
push 0x4b6
lea ecx, [ebp - 0x220]
call sub.MFC42u.dll_CString::LoadStringW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.01019546
push dword [0x1024374]
lea ecx, [ebp - 0x224]
call sub.MFC42u.dll_CString::CString_1
mov esi, eax
push 1
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 3
call sub.MFC42u.dll_CString::Right
push dword [esi]
mov ecx, eax
call fcn.01008944
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ebp - 0x228]
inc bl
call fcn.01019576
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
call fcn.01019576
test bl, bl
je 0x10141a7
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
call sub.MFC42u.dll_operator
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 4
call fcn.01019552
lea ecx, [ebp - 0x224]
jmp 0x101421c
push dword [0x1024374]
lea ecx, [ebp - 0x234]
call sub.MFC42u.dll_CString::CString_1
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push eax
mov byte [ebp - 4], 5
call sub.MFC42u.dll_operator
lea ecx, [ebp - 0x220]
push ecx
push eax
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 6
call sub.MFC42u.dll_operator
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 7
call fcn.01019552
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 6
call fcn.01019576
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 5
call fcn.01019576
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.01019576
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x101423e
push dword [ebp - 0x230]
lea eax, [ebp - 0x21c]
push eax
call fcn.01013554
push esi
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x10142a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10142a3
push 0x1002e3d
mov ecx, edi
call fcn.010198ca
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.01019576
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call fcn.01019576
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.01019576
mov eax, esi
jmp 0x10140f1
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.01019552
xor esi, esi
inc esi
jmp 0x101426f
Function at 0x101466c
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx + 8]
mov eax, ecx
lea edx, [eax + 2]
push esi
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x101467b
sub eax, edx
sar eax, 1
pop esi
jne 0x101469a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x10146ad
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
push ecx
push dword [eax]
push dword [ebp + 8]
call sub.msvcrt.dll_wcsncpy_s
add esp, 0x10
leave
ret 8

Function at 0x1015012
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1015079
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 4
jb 0x1015072
push esi
lea eax, [ebp + 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1015072
cmp dword [ebp + 8], 4
jne 0x1015072
cmp dword [ebp - 4], 0xe011cfd0
jne 0x1015072
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x1015bc0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x58
mov eax, 0x101c81c
call fcn.01019f65
mov esi, ecx
mov edi, dword [esi + 0x37c]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x1015c13
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1015c13
push dword [esi + 0x37c]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1015c13
push 0
push 0
push 0x301
push dword [esi + 0x37c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1015d67
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::CString
and dword [ebp - 4], 0
push 0x10016f0
lea ecx, [ebp - 0x10]
call fcn.01019546
mov ecx, esi
call fcn.01014362
mov dword [ebp - 0x24], eax
test eax, eax
je 0x1015d5b
mov edx, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call dword [edx + 0x18]
and dword [ebp - 0x5c], 0
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
mov dword [ebp - 0x64], 4
push 0xffffffffffffffff
mov ebx, 0x100c
jmp 0x1015ce8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0x104b
push dword [esi + 0x14]
call edi
test eax, eax
je 0x1015ce3
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x20]
jge 0x1015cd6
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x1c], 0
jle 0x1015cd6
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
push 0
lea edx, [ebp - 0x28]
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x44]
call dword [eax + 0x28]
test eax, eax
je 0x1015ccb
cmp dword [ebp - 0x14], 0
je 0x1015cc0
push 0x1002e28
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::operator_2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::operator
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jl 0x1015c95
push 0x10072e4
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::operator_2
push 2
push dword [ebp - 0x18]
push ebx
push dword [esi + 0x14]
call edi
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x1015c69
push dword [esi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1015d5b
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1015d55
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 8]
lea edi, [eax + eax + 2]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1015d55
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x1015d55
push edi
push dword [ebp - 0x10]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.01019576
call fcn.0101a051
ret
Function at 0x10179e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x240
mov eax, 0x101ca22
call fcn.01019fd8
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], ebx
call sub.MFC42u.dll_CString::CString_1
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 4], ebx
call fcn.010148a5
test eax, eax
jne 0x1017b21
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1017a3f
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x21c]
mov esi, eax
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call sub.MFC42u.dll_CString::CString
push 0x18f
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call sub.MFC42u.dll_CString::LoadStringW
push 0x75
lea ecx, [ebp - 0x224]
call sub.MFC42u.dll_CString::LoadStringW
cmp esi, ebx
je 0x1017aca
push 0x802
call fcn.01019af2
pop ecx
mov dword [ebp - 0x238], eax
cmp eax, ebx
je 0x1017aa7
push ebx
push 0x400
push eax
push ebx
push esi
push edi
call fcn.01014a60
add esp, 0x18
push 0x10073a8
lea ecx, [ebp - 0x21c]
call sub.MFC42u.dll_CString::operator_2
push dword [ebp - 0x238]
lea ecx, [ebp - 0x21c]
call sub.MFC42u.dll_CString::operator_2
jmp 0x1017acd
push 2
pop esi
mov eax, dword [ebp - 0x21c]
cmp dword [eax - 8], ebx
je 0x1017ae9
push ebx
push dword [ebp - 0x224]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.01019576
lea ecx, [ebp - 0x21c]
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
cmp dword [edi + 0x20], ebx
je 0x1017b5d
push 4
lea eax, [ebp - 0x238]
push eax
lea ecx, [edi + 0xc]
call sub.MFC42u.dll_CString::Right
push 0x10072f8
push dword [eax]
mov dword [ebp - 0x220], 1
call esi
pop ecx
pop ecx
mov byte [ebp - 0x229], 1
test eax, eax
je fcn.01017b63
mov byte [ebp - 0x229], bl
Function at 0x1018df0
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push edi
lea eax, [ebp - 0x10]
mov edi, ecx
and dword [edi + 0x3e0], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x1018f6f
mov eax, dword [ebp - 0x10]
push 2
pop ecx
cmp eax, ecx
jl 0x1018f6f
push esi
xor esi, esi
inc esi
dec eax
cmp eax, esi
jl 0x1018f6e
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + esi*4]
movzx ecx, word [eax]
cmp cx, 0x2d
je 0x1018e56
cmp cx, 0x2f
jne 0x1018f78
inc eax
inc eax
push 0x10073fc
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1018f8d
push 0x10073f0
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1018f8d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jge 0x1018f6e
push 0x10073e8
push dword [ebp - 8]
inc esi
inc dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1018ece
mov dword [0x10268ac], 1
push dword [ebx + esi*4]
lea ecx, [edi + 0x3f0]
call fcn.01019546
or dword [ebp - 4], 2
jmp 0x1018f50
push 0x10073d8
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1018f00
mov dword [0x10268ac], 1
push dword [ebx + esi*4]
lea ecx, [edi + 0x3ec]
call fcn.01019546
or dword [ebp - 4], 4
jmp 0x1018f50
push 0x10073c4
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1018f32
mov dword [0x10268b0], 1
push dword [ebx + esi*4]
lea ecx, [edi + 0x3e4]
call fcn.01019546
or dword [ebp - 4], 8
jmp 0x1018f50
push 0x10073b0
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1018f4c
or dword [ebp - 4], 0x10
jmp 0x1018f50
or dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
inc esi
inc dword [ebp - 0xc]
dec eax
cmp esi, eax
jle 0x1018e40
cmp dword [ebp - 4], 0
je 0x1018f6e
push dword [ebp - 4]
call fcn.010193cb
pop esi
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret 4
cmp esi, 1
jne 0x1018f60
push dword [ebx + 4]
lea ecx, [edi + 0x3e8]
call fcn.01019546
jmp 0x1018f60
mov dword [edi + 0x3e0], 1
jmp 0x1018f6e
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xe4c6d3b
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2b917e9c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x561746c
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x65f90b86
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4824b0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x10], 0
je 0x4825db
mov edi, dword [ebp + 0xc]
push 0x2d
push str.....chromeupdaterwin_setup_setup_util.cc
call fcn.0055f480
add esp, 8
test eax, eax
jle 0x48251c
lea ebx, [ebp - 0xb0]
mov ecx, ebx
push 0xffffffffffffffff
push 0x26c
push str.....chromeupdaterwin_setup_setup_util.cc
call fcn.004ba430
lea eax, [ebp - 0xa8]
push 0x18
push 0x77db68
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, ebx
call fcn.004ba910
lea ebx, [ebp - 0xb0]
mov ecx, edi
push ebx
call fcn.004be700
push 0x60
call fcn.005c5789
add esp, 4
mov edi, eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb4], 0x80000030
mov dword [ebp - 0xb8], 0x2d
add eax, 0x5a
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
cmp edi, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4825d9
mov esi, dword [ebp + 8]
push 0x5a
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push edi
call fcn.005c9580
add esp, 0xc
mov word [edi + 0x5a], 0
lea edi, [ebp - 0xbc]
mov ecx, dword [ebp + 0x10]
push 1
push ebx
push esi
push 0
push edi
push SysReAllocStringLen
call fcn.00623a30
cmp byte [edi + 0xb], 0
jns 0x4825ad
push dword [ebp - 0xbc]
call fcn.005c57c0
add esp, 4
cmp byte [ebp - 0xa5], 0
jns 0x4825c4
push dword [ebp - 0xb0]
call fcn.005c57c0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
int3

Function at 0x4825e0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x2d
push str.....chromeupdaterwin_setup_setup_util.cc
call fcn.0055f480
add esp, 8
test eax, eax
jle 0x48263f
lea esi, [ebp - 0xb0]
mov ecx, esi
push 0xffffffffffffffff
push 0x274
push str.....chromeupdaterwin_setup_setup_util.cc
call fcn.004ba430
lea eax, [ebp - 0xa8]
push 0x1a
push str.UnregisterUserRunAtStartup
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, esi
call fcn.004ba910
push 0x60
call fcn.005c5789
add esp, 4
mov esi, eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xa8], 0x80000030
mov dword [ebp - 0xac], 0x2d
add eax, 0x5a
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
cmp esi, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4826d8
mov edi, dword [ebp + 8]
push 0x5a
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push esi
call fcn.005c9580
add esp, 0xc
mov word [esi + 0x5a], 0
lea esi, [ebp - 0xb0]
push edi
push 0
push esi
push SysReAllocStringLen
call fcn.00622150
add esp, 0x10
mov ebx, eax
cmp byte [esi + 0xb], 0
jns 0x4826c1
push dword [ebp - 0xb0]
call fcn.005c57c0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
ud2

Function at 0x484b50
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.00484b60
Function at 0x485cc0
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00484b60
Function at 0x48ca60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x130
mov dword [ebp - 0x13c], ecx
movzx eax, word [ebp + 8]
mov ecx, dword [0x808040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, dword [0x80d5b0]
push 0xf0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor edi, edi
inc edi
test eax, eax
je 0x48cac3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x48cac3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x48cac3
movzx ecx, word [eax]
test cx, cx
jne 0x48cb73
jmp 0x48cac3
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, edi
add esp, 0x130
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x130]
pcmpeqd xmm0, xmm0
movdqu xmmword [eax + 0xc], xmm0
movdqu xmmword [eax], xmm0
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0xffffffff
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], eax
lea ecx, [ebp - 0x114]
push 3
push edi
call fcn.0048cc10
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x130], eax
lea ecx, [ebp - 0x110]
cmp eax, ecx
je 0x48cb3c
push eax
call fcn.004bfb50
add esp, 4
lea eax, [ebp - 0x138]
push eax
push 0
push 0x40b
push ebx
mov eax, dword [ebp - 0x13c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
je 0x48cc08
lea eax, [edi + esi]
movzx ecx, word [edi + esi]
test cx, cx
je 0x48cac0
movzx ebx, cx
movzx ecx, word [eax + 2]
lea edi, [eax + 8]
mov esi, dword [eax + 4]
cmp ecx, 0x1234
je 0x48cadc
cmp ecx, 0x403
jne 0x48cb63
push 0x100
push 0xff
lea eax, [ebp - 0x110]
push eax
call fcn.005c9b00
add esp, 0xc
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], eax
lea ecx, [ebp - 0x114]
push 3
push edi
call fcn.0048cc10
push dword [ebp - 0x114]
push 0
push 0x143
push ebx
mov eax, dword [ebp - 0x13c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov ebx, eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
cmp eax, ecx
je 0x48cbff
push eax
call fcn.004bfb50
add esp, 4
cmp ebx, 0xffffffff
jne 0x48cb63
xor edi, edi
jmp 0x48cac3