joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18016b26
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1826b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x420], eax
mov ecx, eax
call fcn.18007010
mov ax, word [0x18218228]
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push 0
push eax
call fcn.180c7aa0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x18016b8e
call fcn.18016093
jmp 0x18016c39
mov eax, dword [0x18233cf4]
mov dword [ebp - 0xc], eax
mov ax, word [0x18233cf8]
mov word [ebp - 8], ax
mov ax, word [ebp - 0x214]
push esi
lea esi, [ebp - 0x214]
push edi
test ax, ax
je 0x18016c32
movzx ecx, ax
mov ax, word [0x18218228]
push 0x206
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push 0
push eax
mov word [ebp - 0xc], cx
call fcn.180c7aa0
add esp, 0xc
lea eax, [ebp - 0x41c]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x18016c1b
lea eax, [ebp - 0x41c]
push eax
call fcn.180d0fcb
mov edi, eax
lea eax, [ebp - 0x41c]
push edi
push eax
push ebx
call fcn.180d645a
add esp, 0x10
test eax, eax
je 0x18016c46
push esi
call fcn.180d0fcb
pop ecx
lea esi, [esi + eax*2]
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x18016bb7
mov eax, 0x8007000f
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.180b1200
leave
ret
lea eax, [ebx + edi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x18233cfc
push dword [ebp - 0x420]
call fcn.18012ab4
add esp, 0x10
xor eax, eax
jmp 0x18016c37
Function at 0x18017ab9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0xc]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0xc], esi
push 4
mov edx, str.LastCheckPeriodSec
mov ecx, str.HKLMSoftwareMicrosoftEdgeUpdateDev_
call fcn.18014f3f
add esp, 0xc
test eax, eax
js 0x18017af4
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov eax, dword [ebp - 0xc]
jmp 0x18017bbe
mov eax, dword [edi + 0x5c]
mov ebx, 0x80004005
mov ecx, dword [edi + 0x58]
sub eax, ecx
mov dword [ebp - 8], esi
cmp eax, 8
jb 0x18017b98
mov ecx, dword [ecx + esi*8]
mov eax, dword [ecx]
call dword [eax + 8]
test al, al
jne 0x18017b2b
mov eax, dword [edi + 0x5c]
inc esi
mov ecx, dword [edi + 0x58]
sub eax, ecx
sar eax, 3
cmp esi, eax
jne 0x18017b0d
jmp 0x18017b98
mov eax, dword [edi + 0x58]
lea edx, [ebp - 8]
push edx
mov ecx, dword [eax + esi*8]
mov eax, dword [ecx]
call dword [eax + 0xc]
movzx ecx, byte [0x1827e6e4]
mov ebx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x1827e000
je 0x18017b98
push 7
pop eax
push 5
pop edx
push edx
push eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
call fcn.18008c56
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x58]
mov eax, dword [eax + esi*8]
mov eax, dword [eax]
cmp dword [eax + 4], 0x18016d51
mov eax, str.GroupPolicyManager
je 0x18017b83
mov eax, str.DeviceManagement
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push str._GetLastCheckPeriodMinutes___s___d_
push eax
call fcn.18006ca0
add esp, 0x10
mov eax, dword [ebp + 8]
shr ebx, 0x1f
xor bl, 1
mov byte [eax], bl
je 0x18017c5e
cmp dword [ebp - 8], 0x4444444
jbe 0x18017bb7
or eax, 0xffffffff
jmp 0x18017bbb
imul eax, dword [ebp - 8], 0x3c
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x18017c06
movzx ecx, byte [0x1827e6e4]
neg ecx
sbb ecx, ecx
and ecx, 0x1827e000
je 0x18017c02
push 5
push 7
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x14], 5
call fcn.18008c56
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push str._GetLastCheckPeriodSec__0__policy_period_sec_
push eax
call fcn.18006ca0
pop ecx
pop ecx
xor eax, eax
jmp 0x18017c74
mov esi, 0x7fffffff
cmp eax, esi
ja 0x18017c18
mov esi, eax
push 0x3c
pop eax
cmp esi, eax
jl 0x18017c74
movzx ecx, byte [0x1827e6e4]
neg ecx
sbb ecx, ecx
and ecx, 0x1827e000
je 0x18017c5a
push 5
push 7
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x14], 5
call fcn.18008c56
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push str._GetLastCheckPeriodSec__period_sec___d_
push eax
call fcn.18006ca0
add esp, 0xc
mov eax, esi
jmp 0x18017c74
call fcn.180182b5
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xffff9d90
add eax, 0x8b74
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x180180fc
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push 4
mov edx, str.AutoUpdateJitterMs
mov ecx, str.HKLMSoftwareMicrosoftEdgeUpdateDev_
call fcn.18014f3f
add esp, 0xc
test eax, eax
js 0x18018134
mov eax, dword [ebp - 4]
cmp eax, 0xea60
jb 0x18018159
mov eax, 0xea5f
leave
ret
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
movzx eax, al
mov ecx, 0xea60
neg eax
sbb eax, eax
xor edx, edx
and eax, dword [ebp - 8]
div ecx
mov eax, edx
leave
ret

Function at 0x1801abc4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x1826b00c]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x208
mov dword [esp + 0x10], eax
xor edi, edi
lea eax, [esp + 0x2c]
mov bl, dl
push edi
push eax
mov esi, ecx
call fcn.180c7aa0
add esp, 0xc
lea eax, [esp + 0x28]
push 0x104
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1801ac2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1801ac7f
movzx eax, ax
or eax, 0x80070000
jmp 0x1801ac7f
lea ecx, [esp + 0x10]
call fcn.1800b1a5
lea eax, [esp + 0x10]
mov dl, bl
push eax
lea ecx, [esp + 0x2c]
call fcn.1800b7fb
pop ecx
push dword [esp + 0x10]
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
test eax, eax
jne 0x1801ac74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1801ac74
movzx edi, di
or edi, 0x80070000
lea ecx, [esp + 0x10]
call fcn.1800b1ce
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.180b1200
mov esp, ebp
pop ebp
ret
Function at 0x1801acc4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10820
call fcn.180f1290
mov eax, dword [0x1826b00c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0x1081c], esi
mov ecx, dword [edi]
call fcn.1800da32
test al, al
jne 0x1801ad00
mov eax, 0x80070002
jmp 0x1801adf9
mov ecx, esi
call fcn.180168dd
push 0x10000
lea eax, [ebp - 0x1080c]
push 0
push eax
call fcn.180c7aa0
add esp, 0xc
lea eax, [ebp - 0x1080c]
push dword [edi]
push 0x8000
push eax
push 0
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 0x10814], 0
mov dword [ebp - 0x10818], eax
test eax, eax
je 0x1801adf7
push 0x800
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.180c7aa0
mov eax, dword [ebp - 0x10814]
lea ecx, [ebp - 0x1080c]
add esp, 0xc
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x10810]
call fcn.18006fb5
push dword [edi]
lea eax, [ebp - 0x80c]
push 0x400
push eax
push 0
push dword [ebp - 0x10810]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x10810]
mov ecx, esi
push eax
call fcn.1801bcb2
mov esi, eax
lea eax, [ebp - 0x80c]
push eax
call fcn.180d0fcb
pop ecx
push eax
lea eax, [ebp - 0x80c]
mov ecx, esi
push eax
call fcn.180070d0
mov eax, dword [ebp - 0x10810]
mov esi, dword [ebp - 0x10814]
inc esi
add esi, dword [eax - 0xc]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x10814], esi
call fcn.18006a60
cmp esi, dword [ebp - 0x10818]
mov esi, dword [ebp - 0x1081c]
jb 0x1801ad4c
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.180b1200
leave
ret
Function at 0x1801ae08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], eax
push ebx
xor ebx, ebx
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
jne 0x1801ae28
xor eax, eax
inc eax
jmp 0x1801af08
push esi
mov edx, 0x18235b54
lea ecx, [ebp - 8]
call fcn.1800c93c
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], ebx
jne 0x1801ae4a
call fcn.18016093
mov ebx, eax
jmp 0x1801aefd
push edi
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1801ae75
call fcn.18016093
mov ebx, eax
jmp 0x1801aefc
call fcn.18006a78
push eax
lea ecx, [ebp - 4]
call fcn.18007187
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
call fcn.1800f42d
push dword [eax]
lea eax, [ebp - 4]
push 0xbf
push 0xbb
push 0xef
push str._c_c_c_s
push eax
call fcn.18012ac9
mov ecx, dword [ebp - 0xc]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.18006a60
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ebx
push ecx
mov dword [ebp - 0x10], ebx
push dword [eax - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1801aede
call fcn.18016093
mov ebx, eax
jmp 0x1801aeea
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
call fcn.18009d7d
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18006a60
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
lea ecx, [esi - 0x10]
call fcn.18006a60
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x1801b747
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov bl, cl
call fcn.18019bdb
test al, al
je 0x1801b765
mov eax, 0x80004005
jmp 0x1801b895
xor esi, esi
mov dword [ebp - 0xc], 0x18233758
lea edx, [ebp - 0xc]
mov dword [ebp - 8], esi
mov cl, bl
call fcn.1801b336
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
call dword [eax + 4]
mov dword [ebp - 0x18], 0x18232d80
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x200
call fcn.180175e4
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
test bl, bl
jne 0x1801b7a8
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push esi
push ecx
push 0xf003f
push ecx
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.18014c7f
mov edi, eax
test edi, edi
js 0x1801b873
push esi
push esi
push esi
push esi
push 0x182359b4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1801b7e1
mov edi, esi
jmp 0x1801b873
call fcn.18006a78
push eax
lea ecx, [ebp - 4]
call fcn.18007187
lea ecx, [ebp - 4]
call fcn.1800c8e3
mov esi, dword [ebp - 4]
test eax, eax
js 0x1801b869
xor edi, edi
lea ecx, [ebp - 0x18]
inc edi
push edi
push esi
push 0x182359b4
call fcn.180153a6
test eax, eax
js 0x1801b869
mov ecx, 0x18272e18
call fcn.18019d30
lea ecx, [ebp - 0x18]
call fcn.1801b6f0
xor eax, eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
call fcn.1801b0b1
test eax, eax
js 0x1801b85f
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x1801b85f
sub esp, 0xc
lea eax, [ebp - 0x24]
mov ecx, esp
push eax
call fcn.1801bd24
mov cl, bl
call fcn.1801b397
add esp, 0xc
mov edi, eax
lea ecx, [ebp - 0x24]
call fcn.18009ef6
jmp 0x1801b86b
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.18006a60
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x18232d80
call fcn.18014bd4
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
call dword [eax + 8]
lea ecx, [ebp - 0xc]
call fcn.18011e7f
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x18021519
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1826b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x414], eax
xor eax, eax
push 0x60
push eax
push esi
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x410], eax
call ebx
mov edi, eax
push 2
pop eax
test edi, edi
jne 0x18021584
push eax
push edi
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x18021584
call fcn.18007492
mov esi, eax
jmp 0x1802165c
push dword [ebp - 0x414]
push dword [ebp - 0x418]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x180215a7
call fcn.18007492
jmp 0x1802164f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1802159d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x180215d0
mov esi, 0x8007000e
jmp 0x18021651
push 2
pop ecx
mul ecx
test edx, edx
ja 0x18021688
jb 0x180215e8
cmp eax, 0xffffffff
ja 0x18021688
cmp eax, 0x400
jbe 0x180215fd
push eax
lea ecx, [ebp - 0x410]
call fcn.180266c8
jmp 0x18021609
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
je 0x180215c6
push esi
push dword [ebp - 0x410]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1802159d
mov eax, dword [ebp - 0x410]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x420]
push dword [ebp - 0x410]
call fcn.18022092
mov esi, eax
test edi, edi
je 0x1802165c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x40c]
cmp dword [ebp - 0x410], eax
je 0x18021675
lea ecx, [ebp - 0x410]
call fcn.18025ccb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.180b1200
leave
ret 0x10
push 0x80070216
call fcn.18006715
int3
Function at 0x1802315b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ecx + 0x94]
cmp dword [esi], 0
jne 0x180231bb
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [esi + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor edi, edi
inc edi
test eax, eax
je 0x180231b8
jmp 0x180231b2
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 4]
cmp edx, eax
jae 0x180231a9
or ecx, 0xffffffff
sub ecx, eax
add ecx, edx
cmp ecx, dword [ebp - 8]
jae 0x180231b8
cmp dword [esi + 4], 0
jg 0x18023188
xchg dword [esi], edi
pop edi
pop esi
leave
ret
Function at 0x180237b4
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ecx + 0x7c]
xor eax, eax
push 2
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0xc], eax
cmp edi, dword [ecx + 0x80]
je 0x180237e0
xor edx, edx
cmp dword [edi + 0x14], eax
setne dl
mov dword [ebp - 8], edx
mov esi, edx
mov al, byte [ecx + 0x89]
mov bl, byte [ecx + 0x11]
mov dword [ebp - 8], eax
call fcn.180175e4
push esi
push ebx
mov ebx, dword [ebp - 4]
push dword [ebp - 8]
mov dl, byte [eax + 1]
mov ecx, dword [ebx + 0xc]
call fcn.18024cbb
movzx ecx, byte [0x1827e6e4]
add esp, 0xc
neg ecx
mov byte [ebx + 0x88], al
mov byte [ebp - 4], al
sbb ecx, ecx
push 7
pop edi
push 1
pop eax
and ecx, 0x1827e000
je 0x1802385e
push eax
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call fcn.18008c56
mov dword [ebp - 0x10], eax
movzx eax, byte [ebx + 0x88]
push eax
lea eax, [ebp - 0x1c]
push str._is_machine:__d_
push eax
call fcn.18006ca0
mov al, byte [ebx + 0x88]
add esp, 0xc
mov byte [ebp - 4], al
push dword [ebp - 4]
mov ecx, 0x18273250
call fcn.1801947a
cmp byte [ebx + 0x88], 0
je 0x18023882
call fcn.18012f16
test al, al
je 0x18023882
xor eax, eax
inc eax
jmp 0x18023884
xor al, al
mov cl, al
call fcn.1804c07d
mov edx, dword [ebx]
lea ecx, [ebp - 8]
call fcn.18011619
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
je 0x180239a0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x180239a0
movzx ecx, byte [0x1827e6e4]
neg ecx
sbb ecx, ecx
and ecx, 0x1827e000
je 0x18023903
push 3
pop eax
push eax
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call fcn.18008c56
mov edx, esi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 4]
call fcn.18006cbf
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push str._Current_dir___s_
push eax
call fcn.18006ca0
mov ecx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.18006a60
mov edx, dword [ebx + 0x7c]
cmp edx, dword [ebx + 0x80]
je 0x1802395a
mov edi, dword [ebx + 0x74]
lea ecx, [ebp - 4]
call fcn.1800c264
mov ecx, dword [ebx + 0x7c]
mov edx, eax
push edi
cmp dword [ecx + 0x14], 0
setne cl
call fcn.1801c152
pop ecx
mov ecx, dword [ebp - 4]
mov edi, eax
add ecx, 0xfffffff0
call fcn.18006a60
mov ecx, edi
call fcn.18016ce6
test edi, edi
jns 0x1802395a
cmp edi, 0x80070005
jne 0x1802395a
mov eax, dword [ebx + 0x7c]
cmp dword [eax + 0x14], 0
je 0x1802395a
call fcn.18012f16
mov cl, byte [ebx + 0x88]
call fcn.18024bb2
push dword [ebx + 0xc]
call fcn.18023fb9
test al, al
je 0x18023983
mov ecx, ebx
call fcn.1802400a
test al, al
je 0x18023983
mov edi, 0xa0430607
jmp 0x180239a7
lea eax, [ebp - 8]
mov ecx, ebx
push eax
push dword [ebx + 0xc]
call fcn.1802406c
mov edi, eax
mov ecx, edi
call fcn.18016ce6
test edi, edi
js 0x180239a7
jmp 0x180239aa
call fcn.18016093
mov edi, eax
mov dword [ebp - 0xc], edi
lea ecx, [esi - 0x10]
call fcn.18006a60
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x18024895
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
call fcn.180175e4
cmp byte [edi + 0x88], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
jne 0x180248b8
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push eax
lea ecx, [ebp - 0xc]
call fcn.18006fb5
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
and dword [ebp - 0x18], 0
push 0x20019
push esi
mov dword [ebp - 0x1c], 0x18232d80
mov dword [ebp - 0x14], 0x200
call fcn.18014d78
mov ebx, eax
mov ecx, ebx
call fcn.18016ce6
test ebx, ebx
js 0x18024a1d
lea ecx, [ebp - 0x1c]
call fcn.18015a37
test eax, eax
je 0x18024a18
push str.Clients
lea ecx, [ebp - 0x1c]
call fcn.18014dbf
test al, al
je 0x18024a18
push str.ClientState
lea ecx, [ebp - 0x1c]
call fcn.18014dbf
test al, al
je 0x18024a18
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
push eax
push eax
push eax
push eax
push str.version
push dword [ebp - 0x18]
call ebx
test eax, eax
jne 0x18024a18
push eax
push eax
push eax
push eax
push str.path
push dword [ebp - 0x18]
call ebx
test eax, eax
jne 0x18024a18
call fcn.18006a78
push eax
lea ecx, [ebp - 4]
call fcn.18007187
lea eax, [ebp - 4]
push eax
push str.version
lea ecx, [ebp - 0x1c]
call fcn.18015221
mov ebx, eax
mov ecx, ebx
call fcn.18016ce6
test ebx, ebx
js 0x18024a0b
call fcn.180175e4
cmp byte [edi + 0x88], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
jne 0x180249a7
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
push eax
lea ecx, [ebp - 0x10]
call fcn.18006fb5
call fcn.18006a78
push eax
lea ecx, [ebp - 8]
call fcn.18007187
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
mov edx, 0x18235ebc
mov ecx, edi
call fcn.180167ef
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.18016ce6
mov esi, dword [ebp - 8]
test ebx, ebx
js 0x180249f8
push esi
lea ecx, [ebp - 4]
call fcn.18009f3a
test eax, eax
je 0x180249f6
mov ebx, 0xa043090b
jmp 0x180249f8
xor ebx, ebx
lea ecx, [esi - 0x10]
call fcn.18006a60
lea ecx, [edi - 0x10]
call fcn.18006a60
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18006a60
jmp 0x18024a1d
mov ebx, 0x80070003
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x18232d80
call fcn.18014bd4
lea ecx, [esi - 0x10]
call fcn.18006a60
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x180254e5
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.180121de
test al, al
je 0x1802557c
call fcn.18025e3a
test al, al
jne 0x1802557c
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18025522
call fcn.18016093
mov ebx, eax
jmp 0x18025578
lea ecx, [ebp - 4]
call fcn.18056609
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18025554
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1802555b
call fcn.18016093
mov ebx, eax
test esi, esi
je 0x18025566
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18006a60
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x1802557e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18025807
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.180121de
test al, al
je 0x1802589e
call fcn.18026185
test al, al
jne 0x1802589e
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18025844
call fcn.18016093
mov ebx, eax
jmp 0x1802589a
lea ecx, [ebp - 4]
call fcn.18056576
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18025876
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1802587d
call fcn.18016093
mov ebx, eax
test esi, esi
je 0x18025888
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18006a60
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x180258a0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret