joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180c6c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov bl, cl
mov esi, edx
mov ecx, dword [ebp + 0xc]
push edi
call fcn.18006b69
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
push edi
push dword [esi]
movzx eax, bl
sub eax, 0x7fffffff
mov dword [ebp - 4], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180c6c8c
jle 0x180c6d64
movzx eax, ax
or eax, 0x80070000
jmp 0x180c6d64
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push 0
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
push eax
push 0
push dword [edi]
push dword [ebp - 4]
call ebx
mov esi, eax
test esi, esi
je 0x180c6cd3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x180c6d62
movzx esi, si
or esi, 0x80070000
jmp 0x180c6d62
cmp dword [ebp - 0x10], 1
je 0x180c6cdf
cmp dword [ebp - 0x10], 2
jne 0x180c6ce5
cmp dword [ebp - 8], 0
jne 0x180c6cf5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x8007000d
jmp 0x180c6d64
call fcn.18003fd3
push eax
lea ecx, [ebp - 0xc]
call fcn.18006df7
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
shr eax, 1
push eax
call fcn.18006ced
lea ecx, [ebp - 8]
push ecx
push eax
push 0
push 0
push dword [edi]
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x180c6d4c
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
shr eax, 1
push eax
call fcn.18006cc2
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.18006a67
test esi, esi
jle 0x180c6d57
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.18004637
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x180c7167
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x181c7008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebx + 0x10]
push esi
mov dword [ebp - 0xd8], ecx
xor ecx, ecx
push edi
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x34], cl
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
lea ecx, [ebp - 0xfc]
push eax
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x20], 0xf
call fcn.18046f8f
push 0xc
call fcn.1800a608
mov esi, eax
lea edi, [ebp - 0xfc]
pop ecx
mov dword [ebp - 0xe4], esi
lea ecx, [esi + 0xc]
mov dword [ebp - 0xdc], ecx
push edi
mov ecx, esi
call fcn.18046f8f
add edi, 0xc
lea eax, [ebp - 0xf0]
add esi, 0xc
cmp edi, eax
jne 0x180c7201
mov edi, dword [ebp - 0xc8]
lea eax, [ebp - 0xbc]
push 3
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xc0], eax
push dword [edi]
call fcn.180b84e3
mov ecx, dword [ebp - 0xc0]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], al
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x180c7258
sub ecx, edx
push ecx
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x1c]
call fcn.18020b98
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0x34]
push ecx
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1813027b
add esp, 0x10
lea ecx, [ebp - 0x1c]
test eax, eax
setne byte [ebp - 0xc1]
call fcn.1800e379
lea eax, [ebp - 0xbc]
cmp dword [ebp - 0xc0], eax
je 0x180c72bf
push dword [ebp - 0xc0]
call fcn.18148166
pop ecx
lea ecx, [ebp - 0xe4]
call fcn.180c74d1
lea ecx, [ebp - 0xfc]
call fcn.1800b398
lea ecx, [ebp - 0xf0]
call fcn.1800b3d9
cmp byte [ebp - 0xc1], 0
je 0x180c72f5
mov dword [ebp - 0xcc], 0x80092009
jmp 0x180c736e
mov esi, dword [ebp - 0xd4]
mov ecx, edi
mov edx, esi
call fcn.1813047d
test al, al
jne 0x180c7314
mov dword [ebp - 0xcc], 0x8000ffff
jmp 0x180c736e
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.18006e74
add eax, 0x10
lea ecx, [ebp - 0xc8]
push str.GoogleUpdateSetup.exe
mov dword [ebp - 0xc8], eax
call fcn.18009baa
mov esi, dword [ebp - 0xc8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180c7354
mov dword [ebp - 0xcc], 0x80070002
jmp 0x180c7366
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xc8]
push eax
call fcn.18006a67
lea ecx, [esi - 0x10]
call fcn.18004637
lea ecx, [ebp - 0x34]
call fcn.1800e379
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xcc]
xor ecx, ebp
pop edi
pop esi
call fcn.18141824
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x180e41db
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x181c7008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
call fcn.180d3a69
dec eax
xor ebx, ebx
push 0xf
pop edi
cmp eax, 9
ja case.default.0x180e4203
jmp dword [eax*4 + 0x180e438f]
push 0xb
push str.Unsupported
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], str.T:_srcpipergoogle3_third_party_protobuf_legacy_opensource_src_google_protobuf_map_field.h
mov dword [ebp - 0x20], 0x11f
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov byte [ebp - 0x1c], bl
call fcn.1804cdff
lea eax, [ebp - 0x28]
push eax
call fcn.180c82e2
lea ecx, [ebp - 0x1c]
call fcn.1800e379
push edi
push str.Cant_get_here.
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], str.T:_srcpipergoogle3_third_party_protobuf_legacy_opensource_src_google_protobuf_map_field.h
mov dword [ebp - 0x20], 0x137
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov byte [ebp - 0x1c], bl
call fcn.1804cdff
lea eax, [ebp - 0x28]
push eax
call fcn.180c82e2
lea ecx, [ebp - 0x1c]
call fcn.1800e379
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18141824
leave
ret 4
mov ecx, esi
call fcn.180d3f66
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x180e42aa
mov eax, dword [eax]
push ecx
push eax
push 0x811c9dc5
call fcn.18030483
add esp, 0xc
jmp 0x180e4287
mov ecx, esi
call fcn.180d3af3
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov edx, 0x811c9dc5
movzx eax, byte [ebp + ecx - 0x30]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x180e42cf
mov eax, edx
jmp 0x180e4287
mov ecx, esi
call fcn.180d3cbf
mov ecx, esi
call fcn.180d3cbf
mov dword [ebp - 0x2c], eax
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x2c]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x180e42fe
jmp 0x180e42e2
mov ecx, esi
call fcn.180d3bd9
mov ecx, esi
call fcn.180d3bd9
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov edx, 0x811c9dc5
movzx eax, byte [ebp + ecx - 0x30]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x180e432e
jmp 0x180e42e2
mov ecx, esi
call fcn.180d3da2
mov ecx, esi
call fcn.180d3da2
mov dword [ebp - 0x2c], eax
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x2c]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x180e435b
jmp 0x180e42e2
mov ecx, esi
call fcn.180d3e83
movzx eax, al
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
jmp 0x180e4287
Function at 0x180fcc30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
mov edi, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.180e7bc1
imul esi, dword [eax + 4], 0x1000193
imul eax, dword [eax], 0x100011b
xor eax, esi
and eax, dword [edi + 0x18]
pop edi
pop esi
leave
ret 4

Function at 0x180fcccd
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.180e79d5
mov esi, eax
lea edx, [esi + 4]
push edx
call fcn.180d9e60
imul ecx, dword [esi], 0x1000193
xor eax, ecx
and eax, dword [edi + 0x18]
pop edi
pop esi
leave
ret 4

Function at 0x180fce2d
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
mov dword [ebp - 4], esi
mov edi, ecx
lea eax, [esi + 4]
push eax
call fcn.180d9e60
imul esi, dword [esi], 0x1000193
mov ebx, eax
xor ebx, esi
mov esi, dword [edi + 0xc]
and ebx, dword [edi + 0x18]
mov esi, dword [esi + ebx*8]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
cmp dword [eax + ebx*8], ecx
jne 0x180fce66
mov eax, ecx
jmp 0x180fce6c
mov eax, dword [eax + ebx*8 + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x180fce9e
mov edx, dword [ebp - 4]
lea ecx, [esi + 8]
call fcn.18101327
test al, al
jne 0x180fce83
mov esi, dword [esi]
jmp 0x180fce57
mov ecx, dword [ebp - 4]
lea edx, [esi + 8]
call fcn.18101327
test al, al
jne 0x180fce99
mov esi, dword [edi + 4]
mov ecx, esi
jmp 0x180fcea0
mov ecx, dword [edi + 4]
jmp 0x180fcea0
mov esi, ecx
cmp esi, ecx
jne 0x180fcea8
xor eax, eax
jmp 0x180fceab
mov eax, dword [esi + 0x14]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1810124f
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
lea eax, [ebx + 4]
push eax
call fcn.180d9e60
imul edx, dword [ebx], 0x1000193
mov esi, dword [edi + 0xc]
xor eax, edx
and eax, dword [edi + 0x18]
mov dword [ebp + 0xc], eax
push eax
mov esi, dword [esi + eax*8]
jmp 0x1810128e
lea ecx, [esi + 8]
mov edx, ebx
call fcn.18101327
test al, al
jne 0x181012be
mov esi, dword [esi]
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.180db5cb
cmp esi, dword [eax]
jne 0x1810127b
mov esi, dword [edi + 4]
mov eax, esi
cmp esi, eax
jne 0x181012d1
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push ecx
push dword [ebp + 8]
mov ecx, edi
call fcn.18102e15
mov eax, dword [ebp + 8]
jmp 0x181012da
lea edx, [esi + 8]
mov ecx, ebx
call fcn.18101327
test al, al
je 0x1810129d
mov eax, dword [edi + 4]
jmp 0x181012a2
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x18104fd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 4], esi
lea eax, [edi + 4]
push eax
call fcn.180d9e60
imul edx, dword [edi], 0x1000193
mov ebx, eax
lea eax, [ebp - 8]
mov ecx, esi
xor ebx, edx
and ebx, dword [esi + 0x18]
push ebx
push eax
call fcn.180db5cb
mov edi, dword [eax]
jmp 0x18105018
mov edi, dword [edi + 4]
mov ecx, dword [ebp + 0xc]
lea edx, [edi + 8]
call fcn.18101327
test al, al
jne 0x18105038
mov ecx, dword [esi + 0xc]
cmp edi, dword [ecx + ebx*8]
jne 0x18105006
mov esi, dword [ebp + 0x10]
cmp edi, dword [esi]
je 0x18105052
push dword [esi]
push esi
push edi
call fcn.18044d97
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xc]
jmp 0x18105055
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 4]
call fcn.181051ac
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 0
jmp 0x1810509e
mov edx, dword [ebp - 4]
mov eax, dword [ecx + ebx*8]
cmp eax, dword [edx + 4]
jne 0x18105069
mov dword [ecx + ebx*8], esi
mov eax, dword [edx + 0xc]
mov dword [eax + ebx*8 + 4], esi
jmp 0x1810508e
cmp eax, edi
jne 0x18105072
mov dword [ecx + ebx*8], esi
jmp 0x1810508e
mov eax, dword [ecx + ebx*8 + 4]
mov eax, dword [eax]
mov dword [ecx + ebx*8 + 4], eax
cmp eax, esi
je 0x1810508e
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx + ebx*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebx*8 + 4], eax
mov ecx, edx
call fcn.181050f9
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x18118aa7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x181c7008]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [esp + 0x18], ecx
push ecx
mov ecx, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
call fcn.180cfc2e
mov eax, dword [eax + 0x28]
test eax, eax
je 0x18118b68
mov ecx, dword [esp + 0xc]
sub esp, 0xc
push edi
push dword [esp + 0x24]
call fcn.180cf3b7
mov dword [esp + 0xc], eax
mov edi, ebx
cmp dword [eax + 4], ebx
jle 0x18118b36
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + edi*4 + 4]
mov eax, dword [esi + 4]
mov dword [esp + 0x18], ecx
cmp dword [esi + 8], eax
je 0x18118b1f
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x18118b2c
lea ecx, [esp + 0x18]
push ecx
push eax
mov ecx, esi
call fcn.1800a482
mov eax, dword [esp + 0xc]
inc edi
cmp edi, dword [eax + 4]
jl 0x18118b04
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.180fa9dc
push dword [eax + 0x18]
push dword [esi + 4]
push dword [esi]
call fcn.18119d63
mov ecx, dword [esp + 0x90]
add esp, 0xc
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18141824
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.180fa9dc
mov ebx, dword [esp + 0xc]
mov edx, eax
push edx
mov dword [esp + 0x14], edx
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
call dword [eax + 4]
push edi
push dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov ecx, ebx
lea eax, [esp + 0x28]
push eax
call fcn.180cf56d
mov ecx, ebx
jmp 0x18118c05
mov ecx, dword [esp + 0x18]
push 0
mov eax, dword [ecx]
call dword [eax + 8]
mov ebx, eax
lea ecx, [esp + 0x28]
mov eax, dword [esp + 0x10]
mov edx, ebx
push dword [eax + 0x18]
call fcn.18118c46
mov eax, dword [esp + 0x14]
mov edx, ebx
pop ecx
lea ecx, [esp + 0x48]
mov eax, dword [eax + 0x18]
add eax, 0x30
push eax
call fcn.18118d9e
mov eax, dword [esi + 4]
pop ecx
mov dword [esp + 0x1c], ebx
cmp dword [esi + 8], eax
je 0x18118be6
mov dword [eax], ebx
add dword [esi + 4], 4
jmp 0x18118bf3
lea ecx, [esp + 0x1c]
push ecx
push eax
mov ecx, esi
call fcn.1800a482
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 0x48]
mov ecx, dword [esp + 0xc]
push edi
push dword [esp + 0x18]
lea eax, [esp + 0x58]
push eax
call fcn.180cf5c2
mov ecx, dword [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
mov edx, dword [ecx]
call dword [edx + 0x10]
lea ecx, [esp + 0x50]
mov bl, al
call fcn.180cb763
test bl, bl
je 0x18118b9b
lea ecx, [esp + 0x20]
call fcn.180cb763
mov bl, 1
jmp 0x18118b3a
Function at 0x1811b609
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x181c7008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 8
mov ebx, ecx
lea edi, [ebp - 0x24]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 0x20
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x1811b64c
push ecx
mov ecx, 0x181cb550
call fcn.1803f7b6
mov eax, 0x80040884
jmp 0x1811b6ef
push esi
call fcn.18003fd3
push eax
lea ecx, [ebp - 0x28]
call fcn.18006df7
push ecx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24]
call fcn.1800ce37
push dword [ebx]
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
call fcn.1811be3d
movzx eax, byte [ebx + 0x10]
mov esi, dword [ebp - 0x28]
push esi
push eax
mov eax, dword [ebx]
add eax, 0xc
push str._d:_S
push eax
call fcn.1800f1a9
mov edx, dword [ebx]
lea ecx, [ebp - 0x28]
add esp, 0x1c
call fcn.1800dc13
mov ecx, dword [ebx]
push eax
add ecx, 0x10
call fcn.18006a67
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.18004637
push 0
push 0x3f
lea ecx, [ebx + 4]
call fcn.18009d97
mov ecx, str._1cup2key_2cup2hreq_3
cmp eax, 0xffffffff
jne 0x1811b6cc
mov ecx, str._1_cup2key_2cup2hreq_3
mov eax, dword [ebx]
push dword [eax + 0x10]
push dword [eax + 0xc]
add eax, 0x14
push dword [ebx + 4]
push ecx
push eax
call fcn.1803982c
add esp, 0x14
lea ecx, [esi - 0x10]
call fcn.18004637
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.18141824
leave
ret
Function at 0x1811c214
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x181c7008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x124], edi
mov esi, ebx
lea edx, [edi + 0x10]
movzx ecx, byte [edx]
lea edx, [edx + 4]
movzx eax, byte [edx - 3]
shl eax, 0x10
shl ecx, 0x18
or ecx, eax
movzx eax, byte [edx - 2]
shl eax, 8
or ecx, eax
movzx eax, byte [edx - 1]
or ecx, eax
mov dword [ebp + esi*4 - 0x104], ecx
inc esi
cmp esi, 0x10
jl 0x1811c239
push 0x40
pop eax
cmp esi, eax
jge 0x1811c2c1
sub eax, esi
lea ebx, [ebp + esi*4 - 0x10c]
mov dword [ebp - 0x108], eax
mov edi, eax
mov ecx, dword [ebx - 0x34]
mov esi, ecx
mov edx, dword [ebx]
mov eax, ecx
rol esi, 0xe
lea ebx, [ebx + 4]
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub edi, 1
jne 0x1811c27f
mov edi, dword [ebp - 0x124]
xor ebx, ebx
mov eax, dword [edi + 0x50]
mov edx, dword [edi + 0x54]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], eax
mov eax, dword [edi + 0x58]
mov dword [ebp - 0x114], eax
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0x120], eax
mov eax, dword [edi + 0x60]
mov dword [ebp - 0x10c], eax
mov eax, dword [edi + 0x64]
mov dword [ebp - 0x118], eax
mov eax, dword [edi + 0x68]
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x6c]
mov edi, dword [ebp - 0x128]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x108], eax
mov ecx, edx
mov esi, edi
xor ecx, edi
ror esi, 0xd
and ecx, dword [ebp - 0x114]
and edx, edi
xor ecx, edx
mov eax, edi
rol eax, 0xa
xor esi, eax
mov eax, edi
ror eax, 2
xor esi, eax
add esi, ecx
mov ecx, dword [ebp - 0x10c]
mov edx, ecx
mov eax, ecx
rol eax, 7
ror edx, 0xb
xor edx, eax
mov eax, ecx
ror eax, 6
not ecx
and ecx, dword [ebp - 0x11c]
xor edx, eax
mov eax, dword [ebp - 0x118]
and eax, dword [ebp - 0x10c]
xor ecx, eax
mov eax, dword [ebp - 0x11c]
add edx, ecx
mov ecx, dword [ebp - 0x120]
add edx, dword [ebx + 0x1819d3f0]
add edx, dword [ebp + ebx - 0x104]
add ebx, 4
add edx, dword [ebp - 0x108]
mov dword [ebp - 0x108], eax
add ecx, edx
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x110], edi
lea edi, [edx + esi]
mov edx, dword [ebp - 0x110]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x114], eax
cmp ebx, 0x100
jl 0x1811c315
mov eax, dword [ebp - 0x12c]
add eax, edi
mov edi, dword [ebp - 0x124]
add dword [edi + 0x60], ecx
add dword [edi + 0x54], edx
mov ecx, dword [ebp - 0x118]
add dword [edi + 0x64], ecx
mov edx, dword [ebp - 0x114]
add dword [edi + 0x58], edx
mov ecx, dword [ebp - 0x11c]
add dword [edi + 0x68], ecx
mov ecx, dword [ebp - 0x108]
add dword [edi + 0x6c], ecx
mov edx, dword [ebp - 0x120]
add dword [edi + 0x5c], edx
mov ecx, dword [ebp - 4]
mov dword [edi + 0x50], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.18141824
leave
ret
Function at 0x1811c437
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov dword [eax], fcn.1811c437
mov dword [eax + 0x50], 0x6a09e667
mov dword [eax + 0x54], 0xbb67ae85
mov dword [eax + 0x58], 0x3c6ef372
mov dword [eax + 0x5c], 0xa54ff53a
mov dword [eax + 0x60], 0x510e527f
mov dword [eax + 0x64], 0x9b05688c
mov dword [eax + 0x68], 0x1f83d9ab
mov dword [eax + 0x6c], 0x5be0cd19
pop ebp
ret

Function at 0x1811eae6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push 9
sub edx, ecx
pop esi
mov eax, dword [edx + ecx]
xor eax, dword [ecx]
and eax, dword [ebp + 8]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x1811eaef
pop esi
pop ebp
ret
Function at 0x1811f7f4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov ecx, 0x181cb710
push edi
call fcn.18016d9f
mov ecx, 0x181cb610
mov dword [esi + 0xc], 0xc
call fcn.18016d9f
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.18003fd3
push eax
lea ecx, [ebp - 4]
call fcn.18006df7
push 0x181aad48
mov esi, 0x181b37d0
lea eax, [ebp - 4]
push esi
push eax
call fcn.1800f1a9
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.1811f5ca
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x1811f8d1
cmp ebx, dword [ebp - 0x18]
je 0x1811f86b
mov edi, 0x80040712
jmp 0x1811f9e9
push str.uninstall
lea eax, [ebp - 4]
push esi
push eax
call fcn.1800f1a9
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.1811f5ca
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x1811f8d1
cmp ebx, dword [ebp - 0x18]
je 0x1811f89e
mov edi, 0xa0430721
jmp 0x1811f9e9
push 0x181aad38
lea eax, [ebp - 4]
push esi
push eax
call fcn.1800f1a9
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.1811f5ca
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x1811f8d1
cmp ebx, dword [ebp - 0x18]
je 0x1811f8d1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x1811f8db
mov edi, 0x80040706
jmp 0x1811f9e9
push eax
lea ecx, [ebp - 8]
call fcn.18006abf
mov esi, dword [ebp - 8]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x1811f9dc
js 0x1811f9dc
mov edx, str.GoogleUpdate.exe
mov ecx, esi
call fcn.1800c2f3
mov edi, eax
test edi, edi
je 0x1811f9dc
sub edi, esi
sar edi, 1
cmp edi, 0xffffffff
je 0x1811f9dc
push str.GoogleUpdate.exe
call fcn.181482a3
pop ecx
add eax, edi
lea ecx, [ebp - 8]
push eax
mov dword [ebp - 0x10], eax
call fcn.18006c57
push 0x22
pop ecx
cmp cx, ax
mov ecx, dword [ebp - 0x10]
jne 0x1811f940
inc ecx
mov eax, dword [esi - 0xc]
sub eax, ecx
lea ecx, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.18009ce0
lea ecx, [ebp - 0xc]
call fcn.1803192c
mov edi, dword [ebp - 0x18]
and dword [ebp - 0x10], 0
sub edi, ebx
sar edi, 2
test edi, edi
je 0x1811f9b8
call fcn.18003fd3
push eax
lea ecx, [ebp - 8]
call fcn.18006df7
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 8]
mov ecx, dword [ebx + ecx*4]
call fcn.180100c4
test eax, eax
js 0x1811f9a2
cmp dword [ebp - 0xc], 0
je 0x1811f9a2
push 0
push dword [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.1800df76
cmp eax, 0xffffffff
jne 0x1811f9ca
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.18004637
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0x1811f96a
mov edi, 0x80040711
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18004637
jmp 0x1811f9e1
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18004637
mov edi, 0x80040710
jmp 0x1811f9bd
mov edi, 0x80040706
lea ecx, [esi - 0x10]
call fcn.18004637
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004637
test ebx, ebx
je 0x1811fa09
mov ecx, dword [ebp - 0x14]
sub ecx, ebx
and ecx, 0xfffffffc
push ecx
push ebx
call fcn.1800a5dc
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4