joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40baec
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40bc34
xor ecx, ecx
cmp word [eax], cx
je 0x40bc34
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x40bb45
cmp eax, 3
jne 0x40bb7f
cmp word [esp + 0xa], 0x3a
jne 0x40bb7f
cmp eax, 2
jne 0x40bb63
lea eax, [esp + 8]
push 0x428370
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40bc34
push 0xfffffffffffffffe
pop edi
jmp 0x40bc34
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x40bb94
cmp ax, bx
jne 0x40bb9e
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x40bb87
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x40bbdd
test byte [esp + 0x21c], 0x10
je 0x40bbc4
push 0xfffffffffffffffe
pop edi
jmp 0x40bbd4
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40bc32
cmp word [esp + 0x10], bp
jne 0x40bbeb
cmp word [esp + 0x12], bp
je 0x40bc0a
cmp word [esp + 0x10], bx
jne 0x40bbf9
cmp word [esp + 0x12], bx
je 0x40bc0a
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x40bc32
cmp word [esp + 0x12], ax
jne 0x40bc32
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x40bc1f
test al, 0x10
je 0x40bc32
jmp 0x40bc2f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40bc32
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x40dcd0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x40dcff
push esi
call fcn.0040deb0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x40dcf8
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x40dd82
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x40dd6d
mov eax, dword [esi + 8]
test eax, eax
je 0x40dd25
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x40dd68
cmp eax, 2
je 0x40dd6d
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40dd16
cmp eax, 3
je 0x40dd4d
cmp eax, 1
jne 0x40dd16
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x40dd16
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x40dd16
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0040ddb0
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x40dda4
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0040ddb0
add esp, 4
pop edi
pop esi
ret

Function at 0x40ddb0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x40dddc
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x40de62
lea ebx, [esi + 0x78]
jmp 0x40ddf0
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x40de36
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40de15
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x40de78
cmp eax, dword [esi + 0x60]
jb 0x40ddf7
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x40ddf0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x40eff0
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.0041b210
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.0041b1e0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40f037
push edi
call fcn.0041b220
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.0040ec80
mov dword [esi + 4], fcn.0040eb10
mov dword [esi + 8], fcn.0040ebe0
mov dword [esi + 0xc], fcn.0040ea60
mov dword [esi + 0x10], 0x40f350
mov dword [esi + 0x14], 0x40f2e0
mov dword [esi + 0x18], 0x40f140
mov dword [esi + 0x1c], 0x40e910
mov dword [esi + 0x20], 0x40e7c0
mov dword [esi + 0x24], 0x40eef0
mov dword [esi + 0x28], 0x40f3c0
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x40f11a
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x40f11a
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x40f109
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x40f111
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x4128e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x412905
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x41290b
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x412a20
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x41295d
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x4129b6
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x4129a0
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x412980
mov esi, dword [esp + 0x14]
test esi, esi
je 0x412a01
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x4129e0
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x4129e0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x412940
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ebx, ebx
mov ebx, ebx
mov esi, eax
xor eax, eax
mov ebx, eax
mov ebx, esi
mov esi, eax
mov ebx, esi
xor esi, esi
sub eax, 0x42
ror eax, 0x40
inc edx
rol esi, 0xee
neg edi
dec eax
mov eax, 0xce
inc ebx
sbb esi, 0xb9
mov ebx, 0xc0
dec eax
rol edx, 0xac
rol edi, 0x44
or edx, 0xc0
rol esi, 1
neg esi
ror edi, 0x30
or edx, 4
neg esi
mov edi, 0x42
and eax, 0x8d
neg edi
not ebx
dec esi
rcr edx, 0x1e
bswap edx
inc eax
rcl esi, 0xed
rcl edi, 0x26
bswap edx
neg edi
rol esi, 0x69
dec edi
bswap esi
bswap edi
mov edi, 0x48
sbb edi, 9
rcl ebx, 0xbe
inc edx
bswap eax
dec edi
sbb eax, 7
ror esi, 0x3a
and edx, 0x88
dec edx
and edi, 6
neg eax
inc esi
inc edi
not edx
xor ecx, ecx
xor edi, edi
xor esi, eax
mov esi, ebx
mov eax, ebx
xor esi, eax
xor ebx, eax
xor esi, ebx
neg eax
neg ebx
dec esi
sbb edi, 0x3d
ror ebx, 0xee
ror ebx, 5
and ebx, 0x87
rol edx, 0x59
neg eax
imul edx
bswap edi
bswap esi
not edi
add ebx, 0xfa
rol ebx, 0xf9
not ebx
not edi
dec edx
bswap edx
inc esi
not esi
dec edx
rcr ebx, 0x61
neg ebx
mov edx, 0xe3
rcl edi, 0x64
add eax, 0x90
bswap ebx
neg edi
mov edi, 0x92
not edi
sub edx, 0xea
neg esi
neg esi
not esi
neg eax
or edi, 0x34
rol edi, 0x27
add edx, 0x5e
inc ebx
dec eax
not eax
bswap ebx
inc esi
add esi, 0x48
dec edx
imul eax
add esi, 0xef
not edi
imul eax
xor ebx, esi
xor eax, eax
mov ebx, eax
mov esi, esi
mov esi, eax
xor esi, ebx
mov eax, eax
mov ebx, esi
mov esi, eax
mov ecx, dword [ebp + 0xc]
sbb ebx, 0x92
rcr esi, 0x63
sbb eax, 0x95
rcr edi, 0xce
ror edi, 0x54
mov ebx, 0xf9
or edi, 0x30
and ebx, 0x48
bswap eax
neg esi
not edi
neg eax
rcl esi, 0xa8
or edi, 0x30
bswap edx
rcr ebx, 0xed
imul esi
or ebx, 0x17
mov esi, 0x98
sbb ebx, 0xfb
dec edx
not edx
bswap ebx
imul edi
rcr esi, 0x65
mov edx, 0xcf
imul edx
sbb edi, 0x7f
add eax, 0x82
bswap edx
rol esi, 1
or edx, 0xc3
sbb edi, 0x88
rol esi, 0x13
rol esi, 0x79
inc eax
or edi, 0x2e
mov esi, 0xf6
or ebx, 0xb9
rcl ebx, 0x40
neg ebx
rol edi, 0x40
or ebx, 0x84
and edi, 3
bswap edi
add eax, 0x95
bswap ebx
bswap ebx
ror edx, 7
mov ebx, pe_nt_image_headers32
mov edi, dword [ebp + 8]
xor ebx, ebx
xor ebx, ebx
xor esi, esi
mov eax, eax
mov ebx, esi
mov ebx, ebx
mov eax, eax
mov ebx, ebx
mov eax, ebx
not byte [edi]
xor esi, esi
xor esi, esi
mov eax, eax
xor ebx, eax
mov eax, eax
xor ebx, esi
mov eax, ebx
mov ebx, eax
xor esi, esi
xor esi, eax
xor ebx, ebx
mov eax, ebx
sub byte [edi], 0x1d
add byte [edi], 0x40
xor ebx, ebx
xor eax, esi
mov esi, esi
mov eax, ebx
mov eax, ebx
mov esi, ebx
mov esi, ebx
mov esi, ebx
xor eax, esi
imul byte [edi]
inc edi
loop 0x4011f3
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a51b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a5b8
push ebx
push esi
call fcn.0040a4e4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a478
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a565
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a5b7
push edi
push eax
call fcn.00408e7b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a585
call fcn.00408ec9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a5b6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a478
add esp, 0x20
test eax, eax
jne 0x40a5a4
push edi
call fcn.00408ec9
jmp 0x40a5ac
push ebx
call fcn.00408ec9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b7c7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45e3e0
push 0x45e3d8
push str.FlsAlloc
push 0x1f
call fcn.0040b686
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b7fb
push dword [ebp + 8]
mov ecx, esi
call dword [0x412130]
call esi
jmp 0x40b801
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b845
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45e3f0
push 0x45e3e8
push str.FlsGetValue
push 0x21
call fcn.0040b686
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b87c
push dword [ebp + 8]
mov ecx, esi
call dword [0x412130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40b884
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45e3f8
push 0x45e3f0
push str.FlsSetValue
push 0x22
call fcn.0040b686
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b8be
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x412130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x410c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410cad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410cad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401170
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4024bd
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 3
jb 0x401224
cmp edx, 0x10
lea esi, [ebp + 8]
lea eax, [ecx + 3]
cmovae esi, dword [ebp + 8]
mov dword [ebp + 0x18], eax
cmp esi, 0x4031bb
jae 0x4011e8
lea eax, [esi + ecx]
cmp eax, 0x4031b8
jb 0x4011e8
cmp esi, 0x4031b8
ja 0x4011de
xor edi, edi
jmp 0x4011ed
mov edi, esi
sub edi, 0x4031b8
jmp 0x4011ed
mov edi, 3
lea eax, [ecx + 1]
push eax
lea eax, [esi + 3]
push esi
push eax
call sub.VCRUNTIME140.dll_memmove
push edi
push 0x4031b8
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, 3
sub eax, edi
push eax
lea eax, [edi + 0x4031bb]
push eax
lea eax, [esi + edi]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
jmp 0x40123a
push 3
sub esp, 8
mov byte [ebp - 0x1c], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x1c]
push 3
call fcn.00401620
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp - 0x18]
mov dword [ebp - 0x48], eax
xorps xmm0, xmm0
lea eax, [ebp + 8]
movlpd qword [ebp - 0x34], xmm0
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x18], 0x2e646d63
mov dword [ebp - 0x14], 0x657865
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4012b2
or esi, 0xffffffff
jmp 0x4012d6
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x40130c
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401302
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401302
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004017a1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401763
mov esp, ebp
pop ebp
ret

Function at 0x402009
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402048
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402048
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402048
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402048
cmp dword [ecx + 0x74], 0xe
jbe 0x402048
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x18005d9e
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x18005e1f
mov byte [esi + 8], 1
call fcn.180793ab
cmp dword [esi + 0x10], 0
je 0x18005e1f
test al, al
je 0x18005dbe
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.180063ad
test al, al
jne 0x18005de5
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call fcn.180793ab
cmp dword [esi + 0x18], 0
jne 0x18005e0c
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x18005e1f
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x180063ad
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x180063ba
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x180063f3
cmp eax, 0x80
je 0x180063f3
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x180063b6
mov al, 1
pop esi
ret

Function at 0x18006d4e
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x18006d84
lea esi, [edi + 4]
test esi, esi
je 0x18006d84
call fcn.1800436d
test al, al
je 0x18006d84
mov ecx, edi
call fcn.1800436d
test al, al
je 0x18006d84
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x18006d86
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x18009077
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push edi
push str.Global_MSIExecute
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x180090ac
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x180090ed
test eax, eax
jle 0x180090db
movzx edi, ax
or edi, 0x80070000
jmp 0x180090ed
push 0x493e0
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x180090e6
cmp eax, 0x80
je 0x180090e6
cmp eax, 0x102
je 0x180090df
cmp eax, 0xffffffff
je 0x180090d6
mov edi, 0x80004005
jmp 0x180090ed
call fcn.180125ee
mov edi, eax
jmp 0x180090ed
mov edi, 0x800705b4
jmp 0x180090ed
push esi
call dword [sym.imp.kernel32.dll_ReleaseMutex]
test esi, esi
je 0x180090f8
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x1801c602
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
and dword [esi + 0x1c], 0
test ecx, ecx
je 0x1801c616
mov eax, dword [ecx]
push 1
call dword [eax]
push 0
lea ecx, [esi + 0x18]
call fcn.180793ab
mov ecx, dword [0x181b95a8]
pop esi
mov ecx, dword [ecx]
jmp fcn.18015985
Function at 0x18030f76
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x180310c9
mov edx, 0x10000000
cmp eax, 0x7c
je 0x180310c9
cmp eax, 0x29
jne 0x18030faf
cmp dword [esi + 0x10], 0
jne 0x180310c9
test dword [esi + 0x50], edx
je 0x180310cf
cmp eax, 0x2e
jne 0x18030fca
push 5
lea ecx, [esi + 0x24]
call fcn.180793ab
mov ecx, esi
call fcn.18030f4d
jmp 0x180310b3
cmp eax, 0x5c
jne 0x1803101f
mov ecx, esi
call fcn.18030f4d
test byte [esi + 0x50], 0x80
je 0x18031013
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x18030ffb
push 4
lea ecx, [esi + 0x24]
call fcn.180793ab
mov ecx, esi
call fcn.18030f4d
jmp 0x180310ba
cmp eax, 0x42
jne 0x18031013
push 4
lea ecx, [esi + 0x24]
call fcn.180793ab
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x18030fef
mov ecx, esi
call fcn.18031cd0
jmp 0x180310b3
cmp eax, 0x5b
jne 0x1803103f
mov ecx, esi
call fcn.18030f4d
mov ecx, esi
call fcn.18031c84
cmp dword [esi + 0x4c], 0x5d
je 0x18030fbe
push 4
jmp 0x180310d1
cmp eax, 0x28
jne 0x1803105c
mov ecx, esi
call fcn.18030f4d
mov ecx, esi
call fcn.18031da9
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x180310cf
jmp 0x180310a8
cmp eax, 0x5e
jne 0x18031065
push 2
jmp 0x18030fe7
cmp eax, 0x24
jne 0x18031071
push 3
jmp 0x18030fe7
cmp eax, 0x2a
je 0x180310c5
cmp eax, 0x2b
je 0x180310c5
cmp eax, 0x3f
je 0x180310c5
cmp eax, 0x7b
je 0x180310c5
cmp eax, 0x7d
jne 0x1803108f
test dword [esi + 0x50], edx
je 0x180310c1
cmp eax, 0x5d
jne 0x18031099
test dword [esi + 0x50], edx
je 0x18031038
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.180793ab
mov bl, 1
mov ecx, esi
call fcn.18030f4d
test bl, bl
je 0x180310ba
mov ecx, esi
call fcn.180793ab
mov cl, 1
jmp 0x18030f7d
push 6
jmp 0x180310d1
push 0xa
jmp 0x180310d1
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.180793ab
int3

Function at 0x1803d198
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 2
xor edi, edi
push edi
push dword [ecx]
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x1803d1db
push str.GOOGLEUPDATEAPPLICATIONCOMMANDS
push 1
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1803d1db
push ebx
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
cmp eax, 4
jne 0x1803d209
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x1803d1f2
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1803d20e
movzx edi, di
or edi, 0x80070000
jmp 0x1803d20e
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x1803d204
mov edi, 0x80070006
jmp 0x1803d20e
cmp dword [eax], 1
je 0x1803d20e
mov edi, 0x8000ffff
test esi, esi
je 0x1803d219
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x180793ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x180793ba
pop dword [ebp - 0x28]
mov eax, 0xe822d8f9
sub eax, 0xd01b453f
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0xc7488
push 0
mov eax, 0x3e4737c6
sub eax, 0x2630f38e
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x80c18a40
add ecx, 0x7f3eb886
mov edi, eax
mov esi, 0x181daa00
add esi, dword [ebp - 0x28]
mov ebx, 0xaf1486f8
mov edx, dword [esi]
add dword [ebp - 0x18], ecx
sub edx, ebx
mov dword [ebp - 0x20], 0xc5d43856
mov dword [edi], edx
xor dword [ebp - 0x24], 0x8016878
add edi, 0xecf47f61
add edi, 0x130b80a3
add esi, 0x8b7cb064
add esi, 0x74834fa0
loop 0x1807940d
add eax, 0x955d80ca
sub eax, 0x955c82df
xor ebx, ebx
add ebx, eax
add eax, 0xaf7c0ea5
add eax, 0x5083f160
mov ecx, 0xb1ad03e6
sub ecx, 0x99ad03e6
add ecx, dword [ebp - 0x28]
call ebx
leave
ret