joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801e4fe
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
call fcn.1800fcdd
test al, al
jne 0x1801e517
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
call fcn.1801f913
test al, al
jne 0x1801e510
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1801e57f
call fcn.1800fc86
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
mov ebx, eax
je 0x1801e57b
push 0xfffffffffffffffe
pop edi
push edi
push 2
pop esi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._OpenSCManager_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
mov eax, ebx
jmp 0x1801e512
lea eax, [ebp - 8]
push eax
call fcn.18055fa8
pop ecx
push 2
pop esi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1801e605
call fcn.1800fc86
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
mov dword [ebp - 4], eax
je 0x1801e5eb
push 0xfffffffffffffffe
pop edi
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._OpenService_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.18004250
push dword [ebp - 0xc]
call ebx
mov eax, esi
jmp 0x1801e512
lea ecx, [ebp - 0x14]
push ecx
push 3
pop edi
push edi
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1801e66b
call fcn.1800fc86
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
mov dword [ebp - 4], eax
je 0x1801e664
push 0xfffffffffffffffe
pop edi
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._ChangeServiceConfig2_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
push dword [ebp - 0x10]
call ebx
jmp 0x1801e5eb
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
je 0x1801e6a1
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._SetDelayedAutoStart_succeeded_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
pop ecx
pop ecx
push dword [ebp - 0x10]
call ebx
xor esi, esi
jmp 0x1801e5ee
Function at 0x1801e6ad
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [0x180fb8d9]
sub esp, 0x1c
push ebx
push esi
neg ecx
push edi
sbb ecx, ecx
and ecx, 0x180fbb80
push 2
pop edi
je 0x1801e70a
push 3
pop esi
push esi
push edi
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
call fcn.18055fa8
pop ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push str._DeleteService___s_
push eax
call fcn.18001000
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, 0xfffffff0
call fcn.18004250
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1801e72a
call fcn.1800fc86
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0xc]
push eax
call fcn.18055fa8
mov eax, dword [eax]
mov dword [esp], 0x10002
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.18004250
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x1801e76d
call fcn.1800fc86
mov edi, eax
push dword [ebp - 8]
call esi
mov eax, edi
jmp 0x1801e725
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1801e7cd
call fcn.1800fc86
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
mov dword [ebp - 4], eax
je 0x1801e7bc
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
push dword [ebp - 4]
or dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push str._DeleteService_failed__0x_x_
push eax
mov dword [ebp - 0x10], edi
call fcn.18001000
add esp, 0xc
cmp dword [ebp - 4], 0x80070430
je 0x1801e7cd
push ebx
call esi
mov edi, dword [ebp - 4]
jmp 0x1801e764
push ebx
call esi
xor edi, edi
jmp 0x1801e764
Function at 0x1801e7d4
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, eax
push esi
push edi
mov ecx, ebx
call fcn.1801fb32
test al, al
je 0x1801e7f1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1801e80e
call fcn.1800fc86
jmp 0x1801e7ec
lea eax, [ebp - 4]
push eax
call fcn.18055fa8
mov dword [esp], 0xf01ff
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x1801e851
call fcn.1800fc86
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.18004250
push dword [ebp - 8]
call esi
mov eax, edi
jmp 0x1801e7ec
lea eax, [ebp - 0xc]
push eax
push 1
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1801e873
call fcn.1800fc86
push edi
mov ebx, eax
call esi
mov edi, ebx
jmp 0x1801e83d
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
je 0x1801e8b1
push 3
push 2
pop ebx
push ebx
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push str._service_description_changed_successfully_
push eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], ebx
call fcn.18001000
pop ecx
pop ecx
push edi
call esi
xor edi, edi
jmp 0x1801e83d
Function at 0x1801ea96
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
call fcn.1800fcdd
test al, al
jne 0x1801eaaf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
call fcn.180201ed
test al, al
jne 0x1801eaa8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1801eb17
call fcn.1800fc86
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
mov ebx, eax
je 0x1801eb13
push 0xfffffffffffffffe
pop edi
push edi
push 2
pop esi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._OpenSCManager_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
mov eax, ebx
jmp 0x1801eaaa
lea eax, [ebp - 8]
push eax
call fcn.18056078
pop ecx
push 2
pop esi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1801eb9d
call fcn.1800fc86
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
mov dword [ebp - 4], eax
je 0x1801eb83
push 0xfffffffffffffffe
pop edi
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._OpenService_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.18004250
push dword [ebp - 0xc]
call ebx
mov eax, esi
jmp 0x1801eaaa
lea ecx, [ebp - 0x14]
push ecx
push 3
pop edi
push edi
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1801ec03
call fcn.1800fc86
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
mov dword [ebp - 4], eax
je 0x1801ebfc
push 0xfffffffffffffffe
pop edi
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._ChangeServiceConfig2_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
push dword [ebp - 0x10]
call ebx
jmp 0x1801eb83
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
je 0x1801ec39
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._SetDelayedAutoStart_succeeded_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
pop ecx
pop ecx
push dword [ebp - 0x10]
call ebx
xor esi, esi
jmp 0x1801eb86
Function at 0x1801ec45
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [0x180fb8d9]
sub esp, 0x1c
push ebx
push esi
neg ecx
push edi
sbb ecx, ecx
and ecx, 0x180fbb80
push 2
pop edi
je 0x1801eca2
push 3
pop esi
push esi
push edi
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
call fcn.18056078
pop ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push str._DeleteService___s_
push eax
call fcn.18001000
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, 0xfffffff0
call fcn.18004250
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1801ecc2
call fcn.1800fc86
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0xc]
push eax
call fcn.18056078
mov eax, dword [eax]
mov dword [esp], 0x10002
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.18004250
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x1801ed05
call fcn.1800fc86
mov edi, eax
push dword [ebp - 8]
call esi
mov eax, edi
jmp 0x1801ecbd
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1801ed65
call fcn.1800fc86
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
mov dword [ebp - 4], eax
je 0x1801ed54
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
push dword [ebp - 4]
or dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push str._DeleteService_failed__0x_x_
push eax
mov dword [ebp - 0x10], edi
call fcn.18001000
add esp, 0xc
cmp dword [ebp - 4], 0x80070430
je 0x1801ed65
push ebx
call esi
mov edi, dword [ebp - 4]
jmp 0x1801ecfc
push ebx
call esi
xor edi, edi
jmp 0x1801ecfc
Function at 0x1801ed6c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, eax
push esi
push edi
mov ecx, ebx
call fcn.1802040c
test al, al
je 0x1801ed89
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1801eda6
call fcn.1800fc86
jmp 0x1801ed84
lea eax, [ebp - 4]
push eax
call fcn.18056078
mov dword [esp], 0xf01ff
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x1801ede9
call fcn.1800fc86
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.18004250
push dword [ebp - 8]
call esi
mov eax, edi
jmp 0x1801ed84
lea eax, [ebp - 0xc]
push eax
push 1
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1801ee0b
call fcn.1800fc86
push edi
mov ebx, eax
call esi
mov edi, ebx
jmp 0x1801edd5
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
je 0x1801ee49
push 3
push 2
pop ebx
push ebx
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push str._service_description_changed_successfully_
push eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], ebx
call fcn.18001000
pop ecx
pop ecx
push edi
call esi
xor edi, edi
jmp 0x1801edd5
Function at 0x18021587
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0xff
push 0x100
push eax
mov esi, ecx
call fcn.1809d7f5
xor eax, eax
mov word [ebp - 6], ax
xor edi, edi
add esp, 0x14
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x260], edi
jne 0x180215e1
push eax
call fcn.180a0a2e
pop ecx
add esi, 0x40
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
cmp esi, edi
je 0x18021610
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1809cca5
leave
ret

Function at 0x18021f45
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [0x180fb8d9]
sub esp, 0x18
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
push ebx
push esi
je 0x18021f89
push 3
pop ebx
push ebx
push 7
pop esi
push esi
mov dword [ebp - 0x14], ecx
call fcn.18001d8a
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push str._StartMonitor_
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
call fcn.18001000
pop ecx
pop ecx
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
cmp eax, esi
jne 0x18021fa0
xor eax, eax
jmp 0x18021fc7
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x18021fcb
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, esi
jne 0x18021fc5
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x18022823
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x180fc154], 0
jne 0x18022853
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1802284c
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x180fc158], eax
mov byte [0x180fc154], 1
mov eax, dword [0x180fc158]
test eax, eax
je 0x1802286b
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x18022877
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x1802287a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
mov dword [ebp - 0x21c], ecx
xor esi, esi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.180227e5
mov ebx, eax
cmp ebx, esi
je 0x180228e3
lea esi, [ebp - 0x214]
call fcn.1802295c
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809cca5
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x18022901
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.1802287a
cmp eax, esi
jne 0x18022948
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x180228eb
lea esi, [ebp - 0x214]
call fcn.1802295c
push dword [ebp - 0x21c]
mov esi, edi
call fcn.18022823
lea esi, [ebp - 0x214]
mov edi, eax
call fcn.1802295c
mov eax, edi
jmp 0x180228d2

Function at 0x18022982
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x18022990
push 0xd
pop eax
jmp 0x180229c3
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x18022997
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x180256fc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x10], esi
cmp esi, ebx
jne 0x18025720
call fcn.1800fc86
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [0x180fa248]
mov ecx, 0x180fa248
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
push str.GOOGLE_UPDATE_NO_CRASH_HANDLER
lea eax, [ebp - 8]
push eax
call fcn.18003097
push 0x180ccd70
lea eax, [ebp - 8]
push eax
call fcn.18003097
xor edi, edi
jmp 0x18025760
push esi
call fcn.1809d315
inc eax
pop ecx
add edi, eax
lea esi, [esi + eax*2]
cmp word [esi], bx
jne 0x18025753
mov eax, dword [ebp - 8]
mov esi, dword [eax - 0xc]
inc edi
inc esi
xor ecx, ecx
push 2
pop edx
lea eax, [esi + edi]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1809db14
add esi, esi
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
push eax
call fcn.1809cfb0
lea eax, [edi + edi]
push eax
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x10]
add esi, eax
push esi
call fcn.1809cfb0
add esp, 0x1c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x40
lea eax, [ebp - 0x68]
push ebx
push eax
mov dword [ebp - 0x6c], 0x44
call fcn.1809d820
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 0xc]
push 0x400
push ebx
push ebx
push ebx
call fcn.1800a9a4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1802581c
call fcn.1800fc86
mov ebx, eax
push dword [ebp - 0xc]
call fcn.1809ccb4
mov eax, dword [ebp - 8]
pop ecx
add eax, 0xfffffff0
call fcn.18004250
mov eax, ebx
jmp 0x1802571b
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
jmp 0x18025801

Function at 0x18029716
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push edi
mov edi, eax
mov dword [ebp - 4], 0x80004005
call esi
push eax
push edi
lea ebx, [ebp - 4]
call fcn.18029c4c
test al, al
je 0x180297ba
movzx eax, byte [edi + 0x44]
push eax
call fcn.1800485e
pop ecx
test eax, eax
jl 0x180297bd
call fcn.180048f6
movzx ecx, byte [0x180fb8d9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbb80
je 0x18029790
push 2
push 4
pop ebx
push ebx
mov dword [ebp - 0x14], ecx
call fcn.18001d8a
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push str._Calling_CAtlExeModuleT_GoogleUpdate_::WinMain_
push eax
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], ebx
call fcn.18001000
pop ecx
pop ecx
cmp byte [0x180fc104], 0
je 0x1802979e
or eax, 0xffffffff
jmp 0x180297bd
and dword [ebp - 4], 0
call esi
push eax
push edi
lea ebx, [ebp - 4]
call fcn.18029c4c
cmp al, 1
jne 0x180297ba
call fcn.1802a62e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1802a5eb
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
cmp eax, esi
jne 0x1802a604
xor eax, eax
jmp 0x1802a62b
push ebx
lea eax, [esp + 8]
push eax
push esi
push edi
push 0x1802bdce
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, esi
jne 0x1802a628
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop esi
pop ecx
ret

Function at 0x1802d7b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x180f51f0]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
xor ebx, ebx
xor eax, eax
push 0x206
mov word [esp + 0x2c], ax
lea eax, [esp + 0x2e]
push ebx
mov edi, 0x180c37b4
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.1809d820
add esp, 0xc
push 0x20008
lea esi, [esp + 0x1c]
call fcn.18008607
lea eax, [esp + 0x28]
push eax
push ebx
push dword [esp + 0x24]
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x1802d858
mov esi, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], edi
call fcn.1800865e
mov ecx, dword [esp + 0x234]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1809cca5
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
call fcn.18003fba
push dword [esp + 0x14]
lea ebx, [esp + 0x14]
call fcn.180045bc
mov esi, eax
mov eax, dword [esp + 0x14]
pop ecx
add eax, 0xfffffff0
call fcn.18004250
jmp 0x1802d834
Function at 0x1802d884
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
and dword [eax], 0
push ebx
push esi
push edi
push 1
call fcn.1806c1f0
mov esi, eax
neg eax
sbb eax, eax
and eax, dword [fcn.1800232e]
pop ecx
mov dword [ebp - 4], esi
jne 0x1802d8c1
test esi, esi
je 0x1802d8b7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x1802d9ea
mov eax, dword [0x180fa248]
mov ecx, 0x180fa248
call dword [eax + 0xc]
mov edi, eax
add edi, 0x10
push esi
lea ebx, [ebp - 0xc]
mov dword [ebp - 8], edi
call fcn.18022d1e
mov esi, dword [ebp - 0xc]
mov ebx, esi
test esi, esi
jle 0x1802d8f4
and ebx, 0xffff
or ebx, 0x80070000
test ebx, ebx
jge 0x1802d927
cmp esi, 0x80004005
je 0x1802d909
test esi, esi
jne 0x1802d909
call fcn.180043d4
lea eax, [edi - 0x10]
call fcn.18004250
cmp dword [ebp - 4], 0
je 0x1802d920
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1802d9ea
lea eax, [ebp - 8]
push eax
call fcn.1802d7b8
mov edi, eax
pop ecx
test edi, edi
jge 0x1802d953
cmp esi, 0x80004005
je 0x1802d948
test esi, esi
jne 0x1802d948
call fcn.180043d4
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
jmp 0x1802d9d4
mov ebx, dword [ebp - 8]
cmp dword [ebx - 0xc], 0
jne 0x1802d970
mov edi, 0x80004005
cmp esi, edi
je 0x1802d9d1
test esi, esi
jne 0x1802d9d1
call fcn.180043d4
jmp 0x1802d9d1
mov edi, dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.1802d669
mov edi, eax
pop ecx
pop ecx
test edi, edi
jge 0x1802d993
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, 0x80004005
jmp 0x1802d963
cmp esi, 0x80004005
je 0x1802d9a4
test esi, esi
jne 0x1802d9a4
call fcn.180043d4
push 0xb
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1802d9ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1802d9c8
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebx - 0x10]
call fcn.18004250
cmp dword [ebp - 4], 0
je 0x1802d9e8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret