joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180c4b81
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x181d6eb4
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
push 0x181d6eb4
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
mov dword [ebp + 8], eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 8], 0
jne 0x180c4bc3
test ebx, ebx
je 0x180c4c21
lea ebx, [edi + 0x1c]
mov ecx, edi
push ebx
push str.Counts
call fcn.180c4b58
test al, al
je 0x180c4c21
push dword [esi + 4]
lea ecx, [ebp - 4]
call fcn.1800e19e
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
xor edi, edi
mov edx, esi
push eax
mov ecx, ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.180c4e4a
mov eax, dword [ebp + 8]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
adc dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
pop ecx
push 8
push eax
push 3
push edi
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esi - 0x10]
call fcn.18004715
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x180c4c28
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x181cf008]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x181d6eb4
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 8
pop ecx
lea eax, [esi + 0x18]
push 0x20
mov esi, eax
lea edi, [esp + 0x34]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.18148b00
add esp, 0xc
push 0x181d6eb4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x30], 0
je 0x180c4d59
lea edi, [ebx + 0x28]
mov ecx, ebx
push edi
push str.Timings
call fcn.180c4b58
test al, al
je 0x180c4d59
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push dword [eax + 4]
call fcn.1800e19e
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov edx, esi
mov ecx, edi
call fcn.180c4e96
pop ecx
test al, al
jne 0x180c4cd9
push 0x20
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.18149380
add esp, 0xc
jmp 0x180c4d3d
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
adc dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x44]
cmp ecx, dword [esp + 0x24]
jg 0x180c4d07
mov eax, dword [esp + 0x40]
jl 0x180c4d0f
cmp eax, dword [esp + 0x20]
jb 0x180c4d0f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x2c], ecx
jg 0x180c4d2d
mov eax, dword [esp + 0x48]
jl 0x180c4d35
cmp dword [esp + 0x28], eax
jb 0x180c4d35
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
push 0x20
lea eax, [esp + 0x14]
push eax
push 3
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esi - 0x10]
call fcn.18004715
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18145fe4
mov esp, ebp
pop ebp
ret 4

Function at 0x180c4e4a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 8
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180c4e83
cmp dword [ebp - 8], 3
jne 0x180c4e83
test eax, eax
jne 0x180c4e83
cmp dword [ebp - 4], esi
jne 0x180c4e83
mov al, 1
jmp 0x180c4e93
push esi
push 0
push dword [ebp + 8]
call fcn.18148b00
add esp, 0xc
xor al, al
pop esi
leave
ret
Function at 0x180c4e96
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x20
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180c4ecf
cmp dword [ebp - 8], 3
jne 0x180c4ecf
test eax, eax
jne 0x180c4ecf
cmp dword [ebp - 4], esi
jne 0x180c4ecf
mov al, 1
jmp 0x180c4edf
push esi
push 0
push dword [ebp + 8]
call fcn.18148b00
add esp, 0xc
xor al, al
pop esi
leave
ret

Function at 0x180c8a1d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jg 0x180c8a93
movzx ecx, byte [0x181d7aa2]
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c8a6e
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x10], ecx
inc eax
mov dword [ebp - 0xc], edx
push eax
push edx
mov dword [ebp - 8], eax
call fcn.18005e59
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str._Google_Update_core_is_shutting_down..._
push eax
call fcn.18004253
pop ecx
pop ecx
push 0
push 0
push 0x12
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x180c8a93
push 0x80004004
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
pop esi
leave
ret
push esi
mov esi, ecx
call fcn.180c8703
mov ecx, esi
pop esi
test al, al
je 0x180c8a1d
jmp fcn.180c8bef

Function at 0x180c8bd7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jg 0x180c8a93
movzx ecx, byte [0x181d7aa2]
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c8a6e
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x10], ecx
inc eax
mov dword [ebp - 0xc], edx
push eax
push edx
mov dword [ebp - 8], eax
call fcn.18005e59
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str._Google_Update_core_is_shutting_down..._
push eax
call fcn.18004253
pop ecx
pop ecx
push 0
push 0
push 0x12
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x180c8a93
push 0x80004004
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
pop esi
leave
ret
push esi
mov esi, ecx
call fcn.180c8703
mov ecx, esi
pop esi
test al, al
je 0x180c8a1d
jmp fcn.180c8bef
Function at 0x180c90b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ebx, ecx
call fcn.180b59e0
call fcn.180b6ff4
mov dword [ebp - 0xc], eax
call fcn.180b6ff4
mov edx, str.AuCheckPeriodMs
mov ecx, str.HKLMSoftwareGoogleUpdateDev_
mov esi, eax
call fcn.18012f3f
test al, al
jne 0x180c9108
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x180c9108
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x927c1
div ecx
lea esi, [edx + 0x493e0]
push 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x181bf020
sub esp, 0x28
mov dword [ebp - 0x20], eax
mov eax, esp
mov dword [ebp - 0x40], ebx
sub esp, 0x30
mov dword [ebp - 8], eax
mov edi, esp
and dword [edi + 0x24], 0
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x180c913d
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 8]
mov ecx, eax
call fcn.180c9733
push dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.180c9697
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.1802c05a
test esi, esi
jns 0x180c91a2
movzx ecx, byte [0x181d7aa2]
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c919b
or dword [ebp - 0x14], 0xffffffff
push 7
pop eax
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
call fcn.18005e59
push esi
push str._Failed_to_start_update_worker_scheduler__0x_08x_
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.18004253
add esp, 0xc
mov eax, esi
jmp 0x180c9223
call fcn.180b70aa
push 1
sub esp, 0x28
mov dword [ebp - 0x44], 0x181beff0
mov esi, eax
mov dword [ebp - 0x40], ebx
mov edi, esp
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x20], eax
and dword [edi + 0x24], 0
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x180c91d6
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov ecx, dword [ebp + 8]
push esi
push esi
call fcn.180c9697
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.1802c05a
test esi, esi
jns 0x180c9221
movzx ecx, byte [0x181d7aa2]
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c919b
or dword [ebp - 0x14], 0xffffffff
push 7
pop eax
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
call fcn.18005e59
push esi
push str._Failed_to_start_code_red_scheduler__0x_08x_
jmp 0x180c918c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x180c9bdc
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp ebx, 0x800c
je 0x180c9c32
cmp ebx, 0x8004
je 0x180c9c32
movzx ecx, byte [0x181d7aa2]
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c9d8e
push 9
pop eax
push 0xfffffffffffffffe
pop edx
push edx
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
call fcn.18005e59
push ebx
push str._VerifyInit__Invalid_signature_algorithm___d_
jmp 0x180c9d7f
mov esi, dword [ebp + 0x10]
push esi
call fcn.180c9ea1
sub esi, 1
js 0x180c9c56
mov ebx, dword [ebp + 0xc]
lea eax, [esi + ebx]
mov ecx, edi
push eax
call fcn.180c9ef5
sub esi, 1
jns 0x180c9c43
mov ebx, dword [ebp + 8]
and dword [ebp + 0x10], 0
lea eax, [ebp - 8]
and dword [ebp - 8], 0
mov esi, 0x10001
push eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], 0xc
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x180c9bbc
push eax
push 0x8001
push dword [ebp + 0x18]
mov dword [ebp - 0xc], 0x180c9bcc
push dword [ebp + 0x14]
push 8
push esi
call dword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
test eax, eax
jne 0x180c9cdb
call fcn.18013e1e
movzx ecx, byte [0x181d7aa2]
mov esi, eax
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c9d8e
push 9
pop eax
push 0xfffffffffffffffe
pop edx
push edx
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
call fcn.18005e59
push esi
push str._VerifyInit__CryptDecodeObjectEx_failed___x_
jmp 0x180c9d7f
lea eax, [edi + 0x14]
push eax
push dword [ebp + 0x10]
push esi
push dword [edi + 0xc]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
push dword [ebp + 0x10]
mov esi, eax
call fcn.1814c926
pop ecx
test esi, esi
jne 0x180c9d33
call fcn.18013e1e
movzx ecx, byte [0x181d7aa2]
mov esi, eax
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c9d8e
push 9
pop eax
push 0xfffffffffffffffe
pop edx
push edx
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
call fcn.18005e59
push esi
push str._VerifyInit__CryptImportPublicKeyInfo_failed___x_
jmp 0x180c9d7f
lea eax, [edi + 0x10]
push eax
push 0
push 0
push ebx
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x180c9d92
call fcn.18013e1e
movzx ecx, byte [0x181d7aa2]
mov esi, eax
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c9d8e
push 9
pop eax
push 0xfffffffffffffffe
pop edx
push edx
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
call fcn.18005e59
push esi
push str._VerifyFinal__CryptVerifySignature_failed___x_
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
call fcn.18004253
add esp, 0xc
xor al, al
jmp 0x180c9d94
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x180c9d9b
Capabilities:
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x180c9dfc
call fcn.18013e1e
movzx ecx, byte [0x181d7aa2]
mov esi, eax
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c9dfc
push 9
pop edx
push 0xfffffffffffffffe
pop eax
push eax
push edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
call fcn.18005e59
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str._VerifyUpdate__CryptHashData_failed___x_
push eax
call fcn.18004253
add esp, 0xc
pop esi
leave
ret 8

Function at 0x180ca049
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
mov esi, edx
test esi, esi
jne 0x180ca05d
mov eax, 0x80070057
jmp 0x180ca0c7
push edi
xor eax, eax
mov dword [ebp - 0x54], 0x44
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
xor edi, edi
push edi
push eax
call fcn.18148b00
add esp, 0xc
mov dword [ebp - 0x28], 0x80
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
jne 0x180ca0b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180ca0c7
movzx eax, ax
or eax, 0x80070000
jmp 0x180ca0c7
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
pop esi
leave
ret
Function at 0x180ca321
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov bl, cl
mov esi, edx
mov ecx, dword [ebp + 0xc]
push edi
call fcn.18006eee
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
push edi
push dword [esi]
movzx eax, bl
sub eax, 0x7fffffff
mov dword [ebp - 4], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180ca36d
jle 0x180ca445
movzx eax, ax
or eax, 0x80070000
jmp 0x180ca445
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push 0
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
push eax
push 0
push dword [edi]
push dword [ebp - 4]
call ebx
mov esi, eax
test esi, esi
je 0x180ca3b4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x180ca443
movzx esi, si
or esi, 0x80070000
jmp 0x180ca443
cmp dword [ebp - 0x10], 1
je 0x180ca3c0
cmp dword [ebp - 0x10], 2
jne 0x180ca3c6
cmp dword [ebp - 8], 0
jne 0x180ca3d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x8007000d
jmp 0x180ca445
call fcn.180040b1
push eax
lea ecx, [ebp - 0xc]
call fcn.1800717c
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
shr eax, 1
push eax
call fcn.18007072
lea ecx, [ebp - 8]
push ecx
push eax
push 0
push 0
push dword [edi]
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x180ca42d
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
shr eax, 1
push eax
call fcn.18007047
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.18006dec
test esi, esi
jle 0x180ca438
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.18004715
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x180ca848
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x181cf008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebx + 0x10]
push esi
mov dword [ebp - 0xd8], ecx
xor ecx, ecx
push edi
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x34], cl
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
lea ecx, [ebp - 0xfc]
push eax
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x20], 0xf
call fcn.180471ee
push 0xc
call fcn.1800a762
mov esi, eax
lea edi, [ebp - 0xfc]
pop ecx
mov dword [ebp - 0xe4], esi
lea ecx, [esi + 0xc]
mov dword [ebp - 0xdc], ecx
push edi
mov ecx, esi
call fcn.180471ee
add edi, 0xc
lea eax, [ebp - 0xf0]
add esi, 0xc
cmp edi, eax
jne 0x180ca8e2
mov edi, dword [ebp - 0xc8]
lea eax, [ebp - 0xbc]
push 3
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xc0], eax
push dword [edi]
call fcn.180bbd6f
mov ecx, dword [ebp - 0xc0]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], al
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x180ca939
sub ecx, edx
push ecx
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x1c]
call fcn.18020cd8
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0x34]
push ecx
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.18133eac
add esp, 0x10
lea ecx, [ebp - 0x1c]
test eax, eax
setne byte [ebp - 0xc1]
call fcn.1800e44a
lea eax, [ebp - 0xbc]
cmp dword [ebp - 0xc0], eax
je 0x180ca9a0
push dword [ebp - 0xc0]
call fcn.1814c926
pop ecx
lea ecx, [ebp - 0xe4]
call fcn.180cabb2
lea ecx, [ebp - 0xfc]
call fcn.1800b469
lea ecx, [ebp - 0xf0]
call fcn.1800b4aa
cmp byte [ebp - 0xc1], 0
je 0x180ca9d6
mov dword [ebp - 0xcc], 0x80092009
jmp 0x180caa4f
mov esi, dword [ebp - 0xd4]
mov ecx, edi
mov edx, esi
call fcn.181340ae
test al, al
jne 0x180ca9f5
mov dword [ebp - 0xcc], 0x8000ffff
jmp 0x180caa4f
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.180071f9
add eax, 0x10
lea ecx, [ebp - 0xc8]
push str.GoogleUpdateSetup.exe
mov dword [ebp - 0xc8], eax
call fcn.18009e3d
mov esi, dword [ebp - 0xc8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180caa35
mov dword [ebp - 0xcc], 0x80070002
jmp 0x180caa47
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xc8]
push eax
call fcn.18006dec
lea ecx, [esi - 0x10]
call fcn.18004715
lea ecx, [ebp - 0x34]
call fcn.1800e44a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xcc]
xor ecx, ebp
pop edi
pop esi
call fcn.18145fe4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x180e5e79
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.180e5acd
push eax
push esi
push dword [ebp + 8]
call fcn.180e5a82
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.180e5acd
push eax
push esi
push dword [ebp + 8]
call fcn.180e5a82
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.180e5abd
jbe 0x180e5f95
inc ebp
invalid

Function at 0x180e5f3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ds
pop ebx
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.180e5abd
inc esi
arpl word [0x7c858dc4], ax
invalid
Function at 0x180e61c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x180e6194
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x180e61b2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x180e6210
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x180e61f7
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x180e6200
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x180e620a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x180e61ec
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x180e6176
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x180e625d
dec eax
je 0x180e6254
sub eax, 3
je 0x180e624b
mov dword [ebp - 4], 0x40
jmp 0x180e627a
mov dword [ebp - 4], 4
jmp 0x180e6260
mov dword [ebp - 4], 0x20
jmp 0x180e6260
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x180e62ac
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x180e622c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.180e5abd
xor byte [ecx + 0x75ffcf41], ah
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x180e62b8

Function at 0x180e62e5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
inc dword [eax - 0x3a]
test dword [eax + 0x56fffffc], edi
Function at 0x180e65ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, 0xc6
test dword [ecx - 0x62000007], esp
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.180e5acd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.180e5a82
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.180e5acd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.180e5a82
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.180e5abd
push ebx
invalid