joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18018d9a
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp ecx, 0xffffffff
je 0x18018de2
lea eax, [ebp - 8]
xor edx, edx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edx
push eax
push 8
push ecx
push edx
mov dword [ebp - 8], edx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x18018de2
mov eax, dword [ebp - 0xc]
push esi
push eax
mov esi, dword [eax]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
pop esi
sete al
jmp 0x18018de4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.18117a58
leave
ret

Function at 0x18018df0
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x181cd158]
mov eax, dword [0x181cd154]
push esi
push edi
test edx, edx
jne 0x18018ea6
test eax, eax
jne 0x18018ea6
xor esi, esi
cmp ecx, 0xffffffff
je 0x18018ea2
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
push 0x18
push ecx
push esi
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x18018e5e
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x18018e5e
mov esi, dword [eax + 0xc8]
mov edi, dword [eax + 0xcc]
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov edx, edi
jmp 0x18018ea4
movzx ecx, byte [0x181cc106]
neg ecx
sbb ecx, ecx
and ecx, 0x181cc000
je 0x18018ea2
push 7
pop edx
push 0xfffffffffffffffe
pop eax
push eax
push edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.18008bfd
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str._GetLogonTime_WTSQuerySessionInformation_failed__0x_x_
push eax
call fcn.180072d0
add esp, 0xc
mov edx, esi
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18117a58
leave
ret
Function at 0x18018eb4
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0xb8], edx
push edi
mov ebx, ecx
mov dword [ebp - 8], esi
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x24], 0x181943e8
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.18018588
test al, al
jne 0x18018f01
mov esi, 0x80004005
jmp 0x18019078
push 0x60
lea eax, [ebp - 0xa8]
push esi
push eax
call fcn.1812c700
add esp, 0xc
lea ecx, [ebp - 0xa8]
call fcn.1800a54f
push ecx
push ecx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x24]
call fcn.1800ff42
test al, al
jne 0x18018f3d
mov esi, 0x80004005
jmp 0x1801906d
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0x14], 0x181943c0
lea edi, [ebp - 0x44]
mov dword [ebp - 0x10], esi
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x44]
call fcn.1800ac39
push 0x12
push 1
mov edi, 0x18194384
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.1800a5c2
add esp, 0x10
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x44]
push esi
push 0xc0100000
push eax
call fcn.1800acd5
lea ecx, [ebp - 0x118]
call fcn.1800a6ab
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.1800a5c2
add esp, 0x14
lea eax, [ebp - 0x118]
mov edi, 0xc0100000
lea ecx, [ebp - 0x44]
push esi
push edi
push eax
call fcn.1800acd5
lea ecx, [ebp - 0x118]
call fcn.1800a6ab
push esi
push edi
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x44]
call fcn.1800acd5
push ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x14]
call fcn.1800b7aa
lea ecx, [ebp - 0x14]
call fcn.1800b92f
mov eax, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0xb0], eax
inc edi
push esi
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], 0xc
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xac], edi
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1801904f
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1801904f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xb8]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ecx], eax
jmp 0x18019056
call fcn.1801b6cc
mov esi, eax
lea ecx, [ebp - 0x44]
call fcn.1800ac82
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x181943c0
call fcn.18007c90
lea ecx, [ebp - 0xa8]
call fcn.1800a6ab
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x181943e8
call fcn.1800bbd0
cmp dword [ebp - 0xc], 0
je 0x18019096
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x180190a5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x18019ffd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x14], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov edi, 0x80070003
call fcn.1800759a
lea ecx, [ebp - 0x14]
call fcn.1801ac91
mov esi, dword [ebp - 0x14]
test eax, eax
je 0x1801a158
xor ecx, ecx
mov dword [ebp - 0x10], 0x1819440c
push ecx
push ecx
or edx, 0xf003f
mov dword [ebp - 0xc], ecx
push edx
push ecx
push ecx
push esi
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0x200
call fcn.18019d1c
mov edi, eax
test edi, edi
jne 0x1801a143
mov eax, dword [ebp + 8]
sub eax, 1
je 0x1801a100
sub eax, 1
je 0x1801a0fc
sub eax, 1
je 0x1801a0cd
sub eax, 1
je 0x1801a0be
sub eax, 3
je 0x1801a0ab
sub eax, 4
je 0x1801a099
mov edi, 0x8007065d
jmp 0x1801a110
push dword [ebx + 4]
lea ecx, [ebp - 0x10]
push dword [ebx]
push dword [ebp - 0x18]
call fcn.1801a688
jmp 0x1801a10e
push 7
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
push ebx
push dword [ebp - 0x18]
call fcn.1801a6ee
jmp 0x1801a10e
push dword [ebx]
lea ecx, [ebp - 0x10]
push dword [ebp - 0x18]
call fcn.1801a65e
jmp 0x1801a10e
mov eax, ebx
neg eax
lfence
sbb eax, eax
and eax, dword [ebp + 0x10]
push eax
push ebx
push 3
push 0
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jle 0x1801a110
movzx edi, di
or edi, 0x80070000
jmp 0x1801a110
push 2
jmp 0x1801a102
push 1
push ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.1801a6b2
mov edi, eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
test eax, eax
je 0x1801a13b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
test ecx, ecx
jle 0x1801a12f
movzx ecx, cx
or ecx, 0x80070000
xor eax, eax
mov dword [ebp - 8], 0x200
mov dword [ebp - 0xc], eax
test edi, edi
jne 0x1801a146
mov edi, ecx
jmp 0x1801a146
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x1819440c
test eax, eax
je 0x1801a158
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1801a452
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], eax
mov edi, ecx
xor ecx, ecx
lea eax, [ebp - 0xc]
push eax
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
push ecx
push ebx
push dword [edi + 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x1801a49d
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x1801a4f0
mov eax, dword [ebp - 0xc]
xor ecx, ecx
shr eax, 1
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.18118338
cmp dword [ebp - 0xc], 0
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
je 0x1801a4eb
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x1801a4f0
movzx esi, si
or esi, 0x80070000
jmp 0x1801a4f0
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret 8

Function at 0x1801a503
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push edx
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], edx
push ecx
push edx
push eax
push dword [ebx + 4]
mov dword [ebp - 8], edx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x1801a54e
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x1801a5bf
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x1801a5b8
shr edx, 1
add edx, 1
js 0x1801a5d2
mov eax, dword [edi]
xor ecx, ecx
inc ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or ecx, eax
jge 0x1801a57a
push edx
mov ecx, edi
lfence
call fcn.180077dc
cmp dword [edi], 0
jne 0x1801a586
mov esi, 0x8007000e
jmp 0x1801a5ad
lea eax, [ebp - 0xc]
push eax
push dword [edi]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebx + 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x1801a5ad
movzx esi, si
or esi, 0x80070000
push 0xffffffffffffffff
mov ecx, edi
call fcn.18009f73
jmp 0x1801a5bf
mov ecx, edi
call fcn.180075e6
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret 8
push 0x80070057
call fcn.18006c85
int3
Function at 0x1801ab95
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x181c600c]
xor eax, esp
mov dword [esp + 0x220], eax
and dword [esp + 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0x1819440c
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0x200
mov eax, dword [edi + 8]
or eax, 0xf003f
push eax
push ebx
push dword [edi + 4]
call fcn.18019e96
mov esi, eax
cmp esi, 0x80070002
je 0x1801abf4
cmp esi, 0x80070003
jne 0x1801ac39
xor esi, esi
inc esi
cmp dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x1819440c
je 0x1801ac10
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18117a58
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.1801ab95
mov esi, eax
test esi, esi
jne 0x1801abf7
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1801ac29
cmp dword [esp + 0x14], esi
je 0x1801ac82
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x200
push ebx
mov ecx, edi
call fcn.18019c59
mov esi, eax
jmp 0x1801abf7

Function at 0x1801b365
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
mov word [ebp - 0xc], 0x500
push eax
mov esi, ecx
lea eax, [ebp - 0x10]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
push eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
test eax, eax
je 0x1801b3cd
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop esi
call fcn.18117a58
leave
ret
Function at 0x1801b70c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1801b77b
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x1801b757
push ebx
push edi
push eax
call fcn.1812c180
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x1801b772
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x1801cb15
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x420], eax
mov ecx, eax
call fcn.180075e6
mov ax, word [0x1816bb7c]
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push 0
push eax
call fcn.1812c700
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x1801cb7d
call fcn.1801b6cc
jmp 0x1801cc28
mov eax, dword [0x181998bc]
mov dword [ebp - 0xc], eax
mov ax, word [0x181998c0]
mov word [ebp - 8], ax
mov ax, word [ebp - 0x214]
push esi
lea esi, [ebp - 0x214]
push edi
test ax, ax
je 0x1801cc21
movzx ecx, ax
mov ax, word [0x1816bb7c]
push 0x206
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push 0
push eax
mov word [ebp - 0xc], cx
call fcn.1812c700
add esp, 0xc
lea eax, [ebp - 0x41c]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1801cc0a
lea eax, [ebp - 0x41c]
push eax
call fcn.18130750
mov edi, eax
lea eax, [ebp - 0x41c]
push edi
push eax
push ebx
call fcn.18135c1a
add esp, 0x10
test eax, eax
je 0x1801cc35
push esi
call fcn.18130750
pop ecx
lea esi, [esi + eax*2]
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x1801cba6
mov eax, 0x8007000f
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
lea eax, [ebx + edi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push str._s_s
push dword [ebp - 0x420]
call fcn.1801682d
add esp, 0x10
xor eax, eax
jmp 0x1801cc26
Function at 0x1801e972
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
mov dword [ebp - 0xc], esi
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0xc]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1801e9a8
push edx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1802521d
mov ecx, dword [0x181cc128]
mov eax, dword [eax + 4]
test eax, eax
jne 0x1801e9d8
mov eax, ecx
cmp eax, ecx
je 0x1801e9ea
add eax, 0xc
lea ecx, [ebp - 8]
push eax
call fcn.18009f25
jmp 0x1801ea00
or esi, 0x4000
lea edx, [ebp - 8]
mov ecx, esi
call fcn.1800cac4
mov esi, eax
test esi, esi
js 0x1801ea6f
mov eax, dword [ebp - 8]
xor edx, edx
mov esi, dword [edi]
inc edx
mov edi, 0x104
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x1801ea25
push edi
lea ecx, [ebp - 8]
call fcn.180077dc
mov eax, dword [ebp - 8]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
mov esi, eax
call fcn.18009f73
test esi, esi
jne 0x1801ea44
mov esi, 0x80040709
jmp 0x1801ea6f
mov esi, dword [ebp - 8]
test esi, esi
jne 0x1801ea4f
xor eax, eax
jmp 0x1801ea56
push esi
call fcn.18130750
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.1800768d
cmp byte [ebp + 8], 0
je 0x1801ea6d
mov ecx, dword [ebp - 8]
call fcn.1800c996
xor esi, esi
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.18007012
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret

Function at 0x18021d6a
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 0
push eax
push 4
mov edx, str.AutoUpdateJitterMs
mov ecx, str.HKLMSoftwareMicrosoftEdgeUpdateDev_
call fcn.1801a171
add esp, 0xc
test eax, eax
js 0x18021dad
mov eax, dword [ebp - 8]
cmp eax, 0xea60
jb 0x18021dd2
mov eax, 0xea5f
jmp 0x18021dd2
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
movzx eax, al
mov ecx, 0xea60
neg eax
sbb eax, eax
xor edx, edx
and eax, dword [ebp - 0xc]
div ecx
mov eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.18117a58
leave
ret
Function at 0x180264c4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, dword [ebp + 0xc]
test cl, cl
je 0x180265e7
call fcn.180159b1
test al, al
je 0x180265e7
call fcn.18016d6c
test al, al
je 0x180265e7
xor ebx, ebx
lea ecx, [ebp - 0x11]
mov byte [ebp - 0x11], bl
call fcn.1800d6f5
test eax, eax
sets al
dec al
and byte [ebp - 0x11], al
je 0x18026527
push ecx
mov edx, edi
mov ecx, esi
call fcn.1801bb1e
pop ecx
jmp 0x180265fe
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push dword [esi]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x180265d1
cmp dword [ebp - 0xc], ebx
jne 0x1802654d
xor edi, edi
inc edi
jmp 0x180265d8
push dword [esi]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.1800759a
mov dword [ebp - 8], ebx
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
xor edi, edi
inc edi
cmp dword [ebp - 0xc], edi
jle 0x180265aa
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], ebx
je 0x18026585
push 0x20
lea ecx, [ebp - 8]
call fcn.18009fc2
mov ebx, dword [esi + edi*4]
test ebx, ebx
jne 0x18026590
xor eax, eax
jmp 0x18026597
push ebx
call fcn.18130750
pop ecx
push eax
push ebx
lea ecx, [ebp - 8]
call fcn.18009fef
inc edi
push 0
pop ebx
cmp edi, dword [ebp - 0xc]
jl 0x18026573
push ecx
lea edx, [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.18016fda
pop ecx
mov ecx, dword [ebp - 8]
mov edi, eax
add ecx, 0xfffffff0
call fcn.18007012
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.18007012
jmp 0x180265dc
call fcn.1801b6cc
mov edi, eax
test esi, esi
je 0x180265e3
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x180265fe
push 0
mov edx, edi
mov ecx, esi
call fcn.1801b861
pop ecx
test eax, eax
jns 0x180265fc
lfence
jmp 0x180265fe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1802741d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x181c600c]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x208
mov dword [esp + 0x10], eax
xor edi, edi
lea eax, [esp + 0x2c]
mov bl, dl
push edi
push eax
mov esi, ecx
call fcn.1812c700
add esp, 0xc
lea eax, [esp + 0x28]
push 0x104
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x18027484
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180274d8
movzx eax, ax
or eax, 0x80070000
jmp 0x180274d8
lea ecx, [esp + 0x10]
call fcn.1800bf95
lea eax, [esp + 0x10]
mov dl, bl
push eax
lea ecx, [esp + 0x2c]
call fcn.1800c6bf
pop ecx
push dword [esp + 0x10]
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
test eax, eax
jne 0x180274cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x180274cd
movzx edi, di
or edi, 0x80070000
lea ecx, [esp + 0x10]
call fcn.1800bfbe
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18117a58
mov esp, ebp
pop ebp
ret

Function at 0x1802751d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10820
call fcn.18153500
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0x1081c], esi
mov ecx, dword [edi]
call fcn.1801051d
test al, al
jne 0x18027559
mov eax, 0x80070002
jmp 0x18027659
mov ecx, esi
call fcn.1801c8ad
push 0x10000
lea eax, [ebp - 0x1080c]
push 0
push eax
call fcn.1812c700
add esp, 0xc
lea eax, [ebp - 0x1080c]
push dword [edi]
push 0x8000
push eax
push 0
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 0x10814], 0
mov dword [ebp - 0x10818], eax
test eax, eax
je 0x18027657
push 0x800
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.1812c700
mov eax, dword [ebp - 0x10814]
lea ecx, [ebp - 0x1080c]
and dword [ebp - 0x10810], 0
add esp, 0xc
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x10810]
call fcn.1800759a
push dword [edi]
lea eax, [ebp - 0x80c]
push 0x400
push eax
push 0
push dword [ebp - 0x10810]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x10810]
mov ecx, esi
push eax
call fcn.180288a1
mov esi, eax
lea eax, [ebp - 0x80c]
push eax
call fcn.18130750
pop ecx
push eax
lea eax, [ebp - 0x80c]
mov ecx, esi
push eax
call fcn.1800768d
mov eax, dword [ebp - 0x10810]
mov esi, dword [ebp - 0x10814]
inc esi
add esi, dword [eax - 0xc]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x10814], esi
call fcn.18007012
cmp esi, dword [ebp - 0x10818]
mov esi, dword [ebp - 0x1081c]
jb 0x180275a5
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x18027668
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x18], edx
push edi
xor edi, edi
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
jne 0x18027690
xor eax, eax
inc eax
jmp 0x18027776
mov edx, 0x1819d8e0
mov dword [ebp - 0xc], edi
lea ecx, [ebp - 0xc]
call fcn.1800eb26
mov eax, dword [ebp - 0xc]
cmp dword [eax - 0xc], edi
jne 0x180276b4
call fcn.1801b6cc
mov edi, eax
jmp 0x18027769
push esi
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x180276df
call fcn.1801b6cc
mov edi, eax
jmp 0x18027768
mov dword [ebp - 8], edi
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
mov edx, ebx
lea ecx, [ebp - 0x14]
call fcn.18012430
push dword [eax]
lea eax, [ebp - 8]
push 0xbf
push 0xbb
push 0xef
push str._c_c_c_s
push eax
call fcn.18016842
mov ecx, dword [ebp - 0x14]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.18007012
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push edi
push ecx
mov dword [ebp - 0x10], edi
push dword [eax - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1802774a
call fcn.1801b6cc
mov edi, eax
jmp 0x18027756
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
call fcn.18009f25
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18007012
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret