joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453cd8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x453cef
add esp, 0xfffffff0
call fcn.00403598
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041afac
mov eax, dword [0x486258]
cmp word [eax + 2], 0
jne 0x453d17
mov eax, dword [0x486258]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004553b0
mov eax, dword [0x486394]
cmp word [eax + 2], 0
jne 0x453d31
mov eax, dword [0x486394]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004555a8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411d14]
call fcn.00403244
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411d14]
call fcn.00403244
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d4f0]
call fcn.00424c3c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x453eb8
mov eax, dword [0x4860e8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042500c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x455b58
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4860e8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c764
test eax, eax
je 0x453e26
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408934
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c78c
test eax, eax
je 0x453e3a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004042b8
mov eax, dword [0x485ec0]
cmp byte [eax], 0
jne 0x453e6e
mov eax, ebx
call fcn.00453fe0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00455d34
mov eax, ebx
call fcn.004566f8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x453eae
call fcn.004035f0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454260
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x487bb4]
cmp dword [eax + 0x30], 0
je 0x45430a
cmp dword [ebx + 0x94], 0
jne 0x454304
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4541f0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x454304
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4542ca
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x454304
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004143cc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4542d9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454e6c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454ea1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404138
jmp 0x454eae
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040409c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455f10
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455f51
mov eax, esi
call fcn.0043c1cc
test al, al
je 0x455f51
mov eax, dword [ebx + 0x84]
call fcn.0043bec8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455f51
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043bec8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x459618
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x459646
mov eax, ebx
call fcn.0045a0cc
cmp dword [ebx + 0x40], 0
je 0x45963f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4596b7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4596a9
cmp dword [ebx + 8], 0
je 0x459668
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45967a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4596a9
cmp dword [ebx + 8], 0
je 0x45965b
cmp eax, 3
je 0x45968d
dec eax
jne 0x45965b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45965b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45965b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4596d5
cmp dword [ebx + 0x14], 0xcc
je 0x4596d5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004596e0
pop ebx
ret
Function at 0x477a4c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x477a54
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x477c46
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x477c5c
mov eax, esi
call fcn.004758d8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040409c
lea ecx, [ebp - 0x10]
mov edx, 0x477c70
mov eax, esi
call fcn.004758d8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040409c
lea ecx, [ebp - 0x14]
mov edx, 0x477c88
mov eax, esi
call fcn.004758d8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040409c
lea ecx, [ebp - 0x18]
mov edx, 0x477ca4
mov eax, esi
call fcn.004758d8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040409c
lea ecx, [ebp - 0x1c]
mov edx, 0x477cc0
mov eax, esi
call fcn.004758d8
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040409c
lea ecx, [ebp - 0x24]
mov edx, 0x477cd8
mov eax, esi
call fcn.004758d8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407fd0
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004083b0
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x477cf0
mov eax, esi
call fcn.004758d8
mov eax, dword [ebp - 0x28]
call fcn.0046f3b0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x477d00
mov eax, esi
call fcn.004758d8
mov eax, dword [ebp - 0x2c]
call fcn.0046f3b0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x477d18
mov eax, esi
call fcn.004758d8
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004083b0
inc eax
je 0x477be9
lea ecx, [ebp - 0x34]
mov edx, 0x477d18
mov eax, esi
call fcn.004758d8
mov eax, dword [ebp - 0x34]
call fcn.00408374
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.004098a4
fstp qword [ebp - 0x3c]
wait
call fcn.00409c08
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x477c04
lea ecx, [ebp - 0x40]
mov edx, 0x477d18
mov eax, esi
call fcn.004758d8
mov eax, dword [ebp - 0x40]
call fcn.0046f3b0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x477d28
mov eax, esi
call fcn.004758d8
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040409c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477c4d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040406c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040406c
ret
Function at 0x47e9d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47ea32
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047e9c8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0046df20
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0046db20
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ea39
lea eax, [ebp - 4]
call fcn.00404048
ret
Function at 0x10010730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001073f
pop dword [ebp - 0x44]
mov eax, 0xbb1dc1ac
add eax, 0x54e34593
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xd5063d8
sub dword [ebp - 0x54], 0xbefe1e8d
mov dword [ebp - 0x50], 0x9b20b83
sub dword [ebp - 0x50], 0xd77ebf3e
mov dword [ebp - 0x4c], 0xd9c2e8f5
sub dword [ebp - 0x4c], 0x8d76a4c7
mov dword [ebp - 0x48], 0xfe005be7
sub dword [ebp - 0x48], 0xfe005be7
lea eax, [ebp - 0x54]
push eax
mov eax, 0xca874a5f
add eax, 0x457a65b1
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xd2b8f18e
add dword [ebp - 0x54], 0xa1b977c8
mov dword [ebp - 0x50], 0x406dd4b0
add dword [ebp - 0x50], 0xfe8cc5
mov dword [ebp - 0x4c], 0xfc53c998
add dword [ebp - 0x4c], 0x671ba2d4
mov dword [ebp - 0x48], 0xac54202b
sub dword [ebp - 0x48], 0xac54202b
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xc715a659
add eax, 0x48ec09bb
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3e117
push 0
call eax
mov ecx, 0x93e67d9d
add ecx, 0x6c19c999
xor ebx, ebx
add ebx, eax
mov edi, 0x2e2b62da
sub edi, 0x1e28b2da
add edi, dword [ebp - 0x44]
mov edx, 0x5eca24ff
add edx, 0x706c5784
xor dword [ebp - 8], edi
mov esi, dword [edi]
add dword [ebp - 0x2c], ebx
sub esi, edx
mov dword [ebp - 0x28], 0x5f13a4a
mov dword [ebx], esi
add dword [ebp - 0x2c], eax
add ebx, 4
add edi, 0xd22bf0d1
add edi, 0x2dd40f33
loop 0x10010863
add eax, 0x5add57ac
sub eax, 0x5adc4801
mov ebx, eax
add eax, 0x955e99eb
add eax, 0x6aa1661a
mov ecx, 0x6a0d7e51
add ecx, 0xa5f281af
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x18005d9e
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x18005e1f
mov byte [esi + 8], 1
call fcn.18112f4d
cmp dword [esi + 0x10], 0
je 0x18005e1f
test al, al
je 0x18005dbe
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.180063ad
test al, al
jne 0x18005de5
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call fcn.18112f4d
cmp dword [esi + 0x18], 0
jne 0x18005e0c
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x18005e1f
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x180063ad
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x180063ba
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x180063f3
cmp eax, 0x80
je 0x180063f3
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x180063b6
mov al, 1
pop esi
ret

Function at 0x18006d4e
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x18006d84
lea esi, [edi + 4]
test esi, esi
je 0x18006d84
call fcn.1800436d
test al, al
je 0x18006d84
mov ecx, edi
call fcn.1800436d
test al, al
je 0x18006d84
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x18006d86
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x18009077
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push edi
push str.Global_MSIExecute
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x180090ac
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x180090ed
test eax, eax
jle 0x180090db
movzx edi, ax
or edi, 0x80070000
jmp 0x180090ed
push 0x493e0
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x180090e6
cmp eax, 0x80
je 0x180090e6
cmp eax, 0x102
je 0x180090df
cmp eax, 0xffffffff
je 0x180090d6
mov edi, 0x80004005
jmp 0x180090ed
call fcn.180125ee
mov edi, eax
jmp 0x180090ed
mov edi, 0x800705b4
jmp 0x180090ed
push esi
call dword [sym.imp.kernel32.dll_ReleaseMutex]
test esi, esi
je 0x180090f8
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x1801c602
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
and dword [esi + 0x1c], 0
test ecx, ecx
je 0x1801c616
mov eax, dword [ecx]
push 1
call dword [eax]
push 0
lea ecx, [esi + 0x18]
call fcn.18112f4d
mov ecx, dword [0x181b95a8]
pop esi
mov ecx, dword [ecx]
jmp fcn.18015985
Function at 0x18030f76
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x180310c9
mov edx, 0x10000000
cmp eax, 0x7c
je 0x180310c9
cmp eax, 0x29
jne 0x18030faf
cmp dword [esi + 0x10], 0
jne 0x180310c9
test dword [esi + 0x50], edx
je 0x180310cf
cmp eax, 0x2e
jne 0x18030fca
push 5
lea ecx, [esi + 0x24]
call fcn.18112f4d
mov ecx, esi
call fcn.18030f4d
jmp 0x180310b3
cmp eax, 0x5c
jne 0x1803101f
mov ecx, esi
call fcn.18030f4d
test byte [esi + 0x50], 0x80
je 0x18031013
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x18030ffb
push 4
lea ecx, [esi + 0x24]
call fcn.18112f4d
mov ecx, esi
call fcn.18030f4d
jmp 0x180310ba
cmp eax, 0x42
jne 0x18031013
push 4
lea ecx, [esi + 0x24]
call fcn.18112f4d
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x18030fef
mov ecx, esi
call fcn.18031cd0
jmp 0x180310b3
cmp eax, 0x5b
jne 0x1803103f
mov ecx, esi
call fcn.18030f4d
mov ecx, esi
call fcn.18031c84
cmp dword [esi + 0x4c], 0x5d
je 0x18030fbe
push 4
jmp 0x180310d1
cmp eax, 0x28
jne 0x1803105c
mov ecx, esi
call fcn.18030f4d
mov ecx, esi
call fcn.18031da9
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x180310cf
jmp 0x180310a8
cmp eax, 0x5e
jne 0x18031065
push 2
jmp 0x18030fe7
cmp eax, 0x24
jne 0x18031071
push 3
jmp 0x18030fe7
cmp eax, 0x2a
je 0x180310c5
cmp eax, 0x2b
je 0x180310c5
cmp eax, 0x3f
je 0x180310c5
cmp eax, 0x7b
je 0x180310c5
cmp eax, 0x7d
jne 0x1803108f
test dword [esi + 0x50], edx
je 0x180310c1
cmp eax, 0x5d
jne 0x18031099
test dword [esi + 0x50], edx
je 0x18031038
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.18112f4d
mov bl, 1
mov ecx, esi
call fcn.18030f4d
test bl, bl
je 0x180310ba
mov ecx, esi
call fcn.18112f4d
mov cl, 1
jmp 0x18030f7d
push 6
jmp 0x180310d1
push 0xa
jmp 0x180310d1
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.18112f4d
int3

Function at 0x1803d198
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 2
xor edi, edi
push edi
push dword [ecx]
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x1803d1db
push str.GOOGLEUPDATEAPPLICATIONCOMMANDS
push 1
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1803d1db
push ebx
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
cmp eax, 4
jne 0x1803d209
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x1803d1f2
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1803d20e
movzx edi, di
or edi, 0x80070000
jmp 0x1803d20e
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x1803d204
mov edi, 0x80070006
jmp 0x1803d20e
cmp dword [eax], 1
je 0x1803d20e
mov edi, 0x8000ffff
test esi, esi
je 0x1803d219
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x1807fd23
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ebx, dword [edi]
test bl, bl
je 0x1807fd98
test bl, 1
je 0x1807fd3e
lea ecx, [esi + 0x14]
call fcn.1804f11e
test bl, 2
je 0x1807fd4b
mov ecx, dword [esi + 0x18]
call fcn.18054ab6
test bl, 4
je 0x1807fd58
mov ecx, dword [esi + 0x1c]
call fcn.180550d8
test bl, 8
je 0x1807fd65
mov ecx, dword [esi + 0x20]
call fcn.18112f4d
test bl, 0x10
je 0x1807fd72
mov ecx, dword [esi + 0x24]
call fcn.1805b3c3
test bl, 0x20
je 0x1807fd7f
mov ecx, dword [esi + 0x28]
call fcn.1805b3c3
test bl, 0x40
je 0x1807fd8c
mov ecx, dword [esi + 0x2c]
call fcn.180712a9
test bl, bl
jns 0x1807fd98
mov ecx, dword [esi + 0x30]
call fcn.180550d8
test ebx, 0xff00
je 0x1807fe24
test ebx, 0x100
je 0x1807fdb4
mov ecx, dword [esi + 0x34]
call fcn.18053630
test ebx, 0x200
je 0x1807fdc4
mov ecx, dword [esi + 0x38]
call fcn.180719f8
test ebx, 0x400
je 0x1807fdd4
mov ecx, dword [esi + 0x3c]
call fcn.180725e6
test ebx, 0x800
je 0x1807fde4
mov ecx, dword [esi + 0x40]
call fcn.180725e6
test ebx, 0x1000
je 0x1807fdf4
mov ecx, dword [esi + 0x44]
call fcn.18112f4d
test ebx, 0x2000
je 0x1807fe04
mov ecx, dword [esi + 0x48]
call fcn.18052fd5
test ebx, 0x4000
je 0x1807fe14
mov ecx, dword [esi + 0x4c]
call fcn.18052fd5
test ebx, 0x8000
je 0x1807fe24
mov ecx, dword [esi + 0x50]
call fcn.180550d8
test ebx, 0xff0000
je 0x1807feb0
test ebx, 0x10000
je 0x1807fe40
mov ecx, dword [esi + 0x54]
call fcn.180550d8
test ebx, 0x20000
je 0x1807fe50
mov ecx, dword [esi + 0x58]
call fcn.18075505
test ebx, 0x40000
je 0x1807fe60
mov ecx, dword [esi + 0x5c]
call fcn.180550d8
test ebx, 0x80000
je 0x1807fe70
mov ecx, dword [esi + 0x60]
call fcn.18112f4d
test ebx, 0x100000
je 0x1807fe80
mov ecx, dword [esi + 0x64]
call fcn.18053630
test ebx, 0x200000
je 0x1807fe90
mov ecx, dword [esi + 0x68]
call fcn.180550d8
test ebx, 0x400000
je 0x1807fea0
mov ecx, dword [esi + 0x6c]
call fcn.180550d8
test ebx, 0x800000
je 0x1807feb0
mov ecx, dword [esi + 0x70]
call fcn.180550d8
test ebx, 0xff000000
je 0x1807ff47
test ebx, 0x1000000
je 0x1807fecc
mov ecx, dword [esi + 0x74]
call fcn.18072005
test ebx, 0x2000000
je 0x1807fedc
mov ecx, dword [esi + 0x78]
call fcn.180550d8
test ebx, 0x4000000
je 0x1807feec
mov ecx, dword [esi + 0x7c]
call fcn.1805b3c3
test ebx, 0x8000000
je 0x1807feff
mov ecx, dword [esi + 0x80]
call fcn.18058c43
test ebx, 0x10000000
je 0x1807ff12
mov ecx, dword [esi + 0x84]
call fcn.18075ae1
test ebx, 0x20000000
je 0x1807ff25
mov ecx, dword [esi + 0x88]
call fcn.180550d8
test ebx, 0x40000000
je 0x1807ff38
mov ecx, dword [esi + 0x8c]
call fcn.1807ccea
test ebx, ebx
jns 0x1807ff47
mov ecx, dword [esi + 0x90]
call fcn.18054756
test byte [esi + 0xc], 1
je 0x1807ff58
mov ecx, dword [esi + 0x94]
call fcn.1807024c
push 8
push 0
push edi
call fcn.1813c650
add esp, 0xc
lea ecx, [esi + 4]
test byte [ecx], 1
pop edi
pop esi
pop ebx
jne fcn.1808603e
ret
Function at 0x180a0f06
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push dword [edi + 4]
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [edi + 8]
cmp eax, esi
je 0x180a0f31
test eax, eax
je 0x180a0f2c
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], esi
mov eax, esi
test eax, eax
je 0x180a0f43
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
setne bl
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x180b2e5f
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x181b3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.1813c650
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 3
call dword [sym.imp.kernel32.dll_GetComputerNameExW]
xor ebx, ebx
inc ebx
test eax, eax
je 0x180b2ec6
push ebx
mov edx, str..google.com
lea ecx, [ebp - 0x204]
call fcn.18112f4d
pop ecx
test al, al
jne 0x180b2f0b
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x208]
push esi
push eax
push 0x64
push 0
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov esi, dword [ebp - 0x208]
test eax, eax
jne 0x180b2f01
cmp dword [esi + 8], eax
je 0x180b2f01
push str.google
push dword [esi + 8]
call fcn.18112f4d
pop ecx
pop ecx
test eax, eax
je 0x180b2f03
xor bl, bl
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.18139b3f
leave
ret

Function at 0x180b7880
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x180b7890
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x180b7896
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x180b78be
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x18187550]
test ax, ax
jne 0x180b78a5
mov esi, ecx
jmp 0x180b78c1
movzx esi, si
pop edi
cmp cx, si
je 0x180b78de
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x18187550]
test cx, cx
jne 0x180b78c2
mov eax, 0x18171bbc
jmp 0x180b78e6
imul eax, edx, 0x1a
add eax, 0x18187552
push eax
mov ecx, ebx
call fcn.18112f4d
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x180c4536
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jg 0x180c43f2
movzx ecx, byte [0x181baf06]
neg ecx
sbb ecx, ecx
and ecx, 0x181ba200
je 0x180c43cd
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x10], ecx
inc eax
mov dword [ebp - 0xc], edx
push eax
push edx
mov dword [ebp - 8], eax
call fcn.18112f4d
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str._Google_Update_core_is_shutting_down..._
push eax
call fcn.18112f4d
pop ecx
pop ecx
push 0
push 0
push 0x12
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x180c43f2
push 0x80004004
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
xor eax, eax
pop esi
leave
ret
push esi
mov esi, ecx
call fcn.18112f4d
mov ecx, esi
pop esi
test al, al
je 0x180c437c
jmp fcn.180c454e