joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18057c0c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x18057c74
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18057c6d
push 0xfffffffffffffffe
pop ebx
push ebx
push 7
pop edi
push edi
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edi
call fcn.1800fc86
push eax
lea eax, [ebp - 0x18]
push str._OpenSCManager_fail__0x_x_
push eax
call fcn.18001000
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
leave
ret
push 4
mov esi, str.Schedule
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x18057cd9
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18057cce
push 0xfffffffffffffffe
pop ebx
push ebx
push 7
pop edi
push edi
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edi
call fcn.1800fc86
push eax
push esi
lea eax, [ebp - 0x18]
push str._OpenService_failed___s__0x_x_
push eax
call fcn.18001000
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18057c6d
push 6
mov dword [ebp - 0x34], edi
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x18057d54
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18057d3b
push 0xfffffffffffffffe
pop ebx
push ebx
push 7
pop edi
push edi
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edi
call fcn.1800fc86
push eax
push esi
lea eax, [ebp - 0x18]
push str._QueryServiceStatus_failed___s__0x_x_
push eax
call fcn.18001000
add esp, 0x10
xor bl, bl
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 8]
call esi
mov al, bl
jmp 0x18057c6f
cmp dword [ebp - 0x30], 4
je 0x18057d3d
cmp dword [ebp - 0x30], 2
je 0x18057d3d
jmp 0x18057d3b

Function at 0x18058118
Capabilities:
Check mutex on windows

Disassembly:
push edi
push dword [esi + 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov eax, dword [esi + 8]
cmp eax, edi
je 0x1805813d
test eax, eax
je 0x1805813a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
cmp dword [esi + 8], 0
pop edi
jne 0x18058147
xor al, al
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne al
ret
Function at 0x1805a3a5
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x10]
push ecx
push 1
mov edi, eax
xor eax, eax
push eax
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push str.gupdate
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x1805a3ed
call fcn.1800fc86
jmp 0x1805a42e
mov eax, edi
call fcn.18006659
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [edi + 0xc]
mov dword [ebp + 8], eax
add eax, ecx
lea esi, [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.180182cf
push dword [ebp + 8]
mov eax, dword [ebp - 8]
push dword [ebp + 8]
mov esi, edi
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.1805a4ce
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1805a433
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x10]
push ecx
push 1
mov edi, eax
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x1805a488
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1805a481
call fcn.1800fc86
jmp 0x1805a4c9
mov eax, 0x8007000d
jmp 0x1805a4c9
mov eax, edi
call fcn.18006659
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [edi + 0xc]
mov dword [ebp + 8], eax
add eax, ecx
lea esi, [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.180182cf
push dword [ebp + 8]
mov eax, dword [ebp - 8]
push dword [ebp + 8]
mov esi, edi
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.1805a4ce
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1805d463
Capabilities:
Create pipe

Disassembly:
mov eax, dword [esi + 0x80]
test eax, eax
je 0x1805d470
xor al, al
ret
push edi
xor edi, edi
push edi
push 1
push edi
mov dword [esi + 0x80], 2
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x5c], eax
cmp eax, edi
je 0x1805d4ea
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x98], eax
cmp eax, edi
je 0x1805d4ea
push 4
push 0xffffffffffffffff
push esi
push 0x1805db4f
push eax
lea eax, [esi + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x1805d4ea
cmp dword [esi + 0x4c], 8
jb 0x1805d4c7
mov eax, dword [esi + 0x38]
jmp 0x1805d4ca
lea eax, [esi + 0x38]
push dword [esi + 0x50]
push edi
push 0x40
push 0x40
push 1
push 6
push 0x40080003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x54], eax
cmp eax, 0xffffffff
jne 0x1805d4ee
xor al, al
pop edi
ret
mov eax, esi
call fcn.1805d550
mov eax, dword [esi + 0x80]
xor ecx, ecx
cmp eax, 1
setne cl
mov al, cl
pop edi
ret

Function at 0x1805d5f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push edi
push 0x2c
lea edi, [esi + 0x9c]
push 0
push edi
call fcn.1809d820
add esp, 0xc
lea eax, [esi + 0x88]
push eax
lea eax, [ebp - 4]
push eax
push 0x2c
push edi
push dword [esi + 0x54]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne bl
test bl, bl
je 0x1805d638
xor eax, eax
jmp 0x1805d63e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
test bl, bl
pop ebx
jne 0x1805d657
cmp eax, 0x3e5
je 0x1805d657
push 0xa
pop ecx
mov eax, esi
call fcn.1805d8bf
leave
ret
mov dword [esi + 0x80], 5
leave
ret

Function at 0x1805d95f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.1805d127
mov dword [ebp - 0x30], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push esi
lea eax, [ebp - 0x30]
call fcn.1805d8e0
test al, al
jne 0x1805d9bb
cmp dword [ebp - 0x10], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1805d9a1
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], 0
je 0x1805d9ac
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 8], 0
je 0x1805d9b7
push dword [ebp - 8]
call esi
xor al, al
jmp 0x1805da0c
and dword [ebp - 4], 0
push ebx
lea eax, [esi + 0x88]
push eax
lea eax, [ebp - 4]
push eax
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [esi + 0x54]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
test bl, bl
je 0x1805d9e7
xor eax, eax
jmp 0x1805d9ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
jne 0x1805d9fc
cmp eax, 0x3e5
je 0x1805d9fc
xor al, al
jmp 0x1805da0b
push dword [ebp + 8]
mov ebx, esi
call fcn.1805dacd
test al, al
setne al
pop ebx
pop esi
leave
ret 4
Function at 0x1805da11
Capabilities:
Connect pipe

Disassembly:
push esi
mov esi, eax
mov al, byte [esi + 0x84]
test al, al
jne 0x1805d54e
mov eax, dword [esi + 0x58]
test eax, eax
je 0x1805d526
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
and dword [esi + 0x58], 0
mov eax, dword [esi + 0x54]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1805d53b
push eax
call edi
and dword [esi + 0x54], 0
add esi, 0x98
mov eax, dword [esi]
test eax, eax
je 0x1805d54d
push eax
call edi
and dword [esi], 0
pop edi
pop esi
ret
push esi
mov esi, eax
push dword [esi + 0x98]
xor eax, eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x90], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1805d886
call fcn.1805d8a8
pop esi
ret
push dword [esi + 0x54]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
je 0x1805d87f
mov al, byte [esi + 0x84]
test al, al
jne 0x1805d884
push 2
pop ecx
mov eax, esi
pop esi
jmp fcn.1805d8bf
push esi
mov esi, eax
mov al, byte [esi + 0x84]
test al, al
je 0x1805da36
push dword [esi + 0x98]
mov dword [esi + 0x80], 1
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop esi
ret
mov eax, dword [esi + 0x80]
dec eax
cmp eax, 9
ja case.default.0x1805da42
jmp dword [eax*4 + 0x1805daa5]
mov eax, esi
pop esi
jmp 0x1805d507
mov eax, esi
pop esi
jmp fcn.1805d550
call fcn.1805d5a9
pop esi
ret
call fcn.1805d5f7
pop esi
ret
call fcn.1805d663
pop esi
ret
push edi
mov edi, esi
call fcn.1805d6ac
pop edi
pop esi
ret
call fcn.1805d755
pop esi
ret
call fcn.1805d798
pop esi
ret
call fcn.1805d7f9
pop esi
ret
mov eax, esi
pop esi
jmp 0x1805d84c
mov dword [esi + 0x80], 1
pop esi
ret
Function at 0x1805e3b6
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x69], 0
mov dword [ebp - 0x88], 0x40
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x50], 0xf
call fcn.18003cac
push edi
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x4c]
push eax
push 5
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x1805e452
push 0xa
lea eax, [ebp - 0x4c]
push edi
push eax
mov byte [ebp - 0x69], 1
call fcn.1809e859
mov esi, dword [ebp - 0x54]
add esp, 0xc
mov dword [ebp - 0x7c], eax
cmp esi, eax
ja 0x1805e452
cmp dword [ebp - 0x50], eax
je 0x1805e452
push 1
push eax
lea ecx, [ebp - 0x68]
call fcn.18003b92
test al, al
je 0x1805e450
push esi
lea ecx, [ebp - 0x68]
call fcn.18003cac
xor edi, edi
push edi
mov dword [ebp - 0x78], edi
push edi
mov edi, dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
jmp 0x1805e4e6
cmp dword [ebp - 0x70], 0
jbe 0x1805e50a
mov ebx, dword [ebp - 0x70]
lea eax, [ebp - 0xa0]
call fcn.18054341
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x94]
jne 0x1805e48d
call fcn.1809e0d9
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x94]
push dword [ebp - 0x74]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, eax
test ebx, ebx
je 0x1805e4ff
mov eax, dword [ebp - 0x80]
test eax, eax
jbe 0x1805e4ff
add dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x94]
jne 0x1805e4c6
call fcn.1809e0d9
push dword [ebp - 0x80]
lea eax, [ebp - 0x68]
push dword [ebp - 0x94]
call fcn.1805eda2
lea esi, [ebp - 0xa0]
call fcn.180372a9
push 0
push 0
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
call edi
mov ebx, eax
test ebx, ebx
jne 0x1805e462
mov byte [ebp - 0x69], 0
jmp 0x1805e556
lea esi, [ebp - 0xa0]
call fcn.180372a9
test ebx, ebx
je 0x1805e4f9
cmp byte [ebp - 0x69], 0
je 0x1805e51c
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x78], eax
jne 0x1805e4f9
cmp dword [ebp - 0x84], 0
mov byte [ebp - 0x69], 1
je 0x1805e556
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x68]
call fcn.1805eb76
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x84]
xor ebx, ebx
call fcn.18027161
push ebx
push 1
lea esi, [ebp - 0xa4]
call fcn.18027253
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.18003cc8
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x69]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
Function at 0x1805f8a9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x3c], 0
mov dword [ebp - 0x28], edi
je 0x1805f9bc
cmp byte [edi + 0x41], 0
je 0x1805f9bc
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x1805f8e8
xor al, al
jmp 0x1805f9be
lea esi, [ebp - 0x20]
call fcn.1805f67d
lea eax, [edi + 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x20]
call fcn.1805f6f9
mov esi, eax
call fcn.1805f9cd
mov ebx, eax
add ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x20]
call fcn.1805f6f9
mov esi, eax
call fcn.1805f9cd
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x24]
push esi
push ebx
push eax
push dword [ebp - 0x2c]
call dword [edx + 0x18]
sub eax, 0
je 0x1805f954
dec eax
je 0x1805f958
dec eax
dec eax
je 0x1805f9b8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.18003cc8
mov al, bl
jmp 0x1805f9be
mov byte [edi + 0x41], 0
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x20]
call fcn.1805f6f9
mov esi, eax
call fcn.1805f9cd
mov ebx, dword [ebp - 0x24]
sub ebx, eax
je 0x1805f996
push dword [edi + 0x4c]
lea eax, [ebp - 0x40]
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.1805f6f9
mov esi, eax
call fcn.1805f9cd
push eax
call fcn.180b55c5
add esp, 0x10
cmp ebx, eax
jne 0x1805f942
cmp byte [edi + 0x41], 0
je 0x1805f9b8
test ebx, ebx
jne 0x1805f8f6
push ebx
push 8
pop ebx
lea edi, [ebp - 0x20]
call fcn.1805f6b5
mov edi, dword [ebp - 0x28]
jmp 0x1805f8f6
mov bl, 1
jmp 0x1805f944
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
Function at 0x1806b759
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x180c006c
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x18]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov edi, eax
test edi, edi
jge 0x1806b7e3
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1806b7d2
push 0xfffffffffffffffe
pop ebx
push ebx
push 4
pop esi
push esi
mov dword [ebp - 0x28], ecx
call fcn.18001d8a
push edi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push str._::CoCreateGuid_failed__0x_08x_
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
call fcn.18001000
add esp, 0xc
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
lea edi, [ebp - 0x18]
lea esi, [ebp - 0x2c]
call fcn.180055a7
lea eax, [ebp - 0x4c]
call fcn.180044b1
push dword [ebp + 0xc]
lea ebx, [ebp - 0x4c]
push dword [ebp - 0x2c]
call fcn.18004984
push dword [ebp - 0x34]
mov eax, ebx
call fcn.1806bb0b
movzx ecx, byte [0x180fb8f9]
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x1806b876
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1806b85e
push 0xffffffffffffffff
push 4
pop esi
push esi
mov dword [ebp - 0x28], ecx
call fcn.18001d8a
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
push edi
push dword [eax]
lea eax, [ebp - 0x28]
push str.__s__0x_08x_
push str._CreateEvent_failed_in_CreateUniqueEventInEnvironment_
push eax
mov dword [ebp - 0x1c], esi
call fcn.18001000
add esp, 0x14
lea esi, [ebp - 0x4c]
call fcn.180044d7
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
call fcn.18004250
jmp 0x1806b7d2
neg ecx
sbb ecx, ecx
mov ebx, 0x180fbba0
and ecx, ebx
push 4
pop esi
je 0x1806b8b5
push 3
pop edi
push edi
push esi
mov dword [ebp - 0x28], ecx
call fcn.18001d8a
push dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
push dword [eax]
lea eax, [ebp - 0x28]
push str._created_unique_event___s___s_
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
call fcn.18001000
add esp, 0x10
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x2c]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x1806b920
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, ebx
mov edi, eax
je 0x1806b907
push 0xfffffffffffffffe
pop ebx
push ebx
push esi
mov dword [ebp - 0x28], ecx
call fcn.18001d8a
push edi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push str._::SetEnvironmentVariable_failed___d_
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
call fcn.18001000
add esp, 0xc
test edi, edi
jle 0x1806b85e
and edi, 0xffff
or edi, 0x80070000
jmp 0x1806b85e
xor edi, edi
jmp 0x1806b85e
Function at 0x1806b927
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x224], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov esi, ecx
call fcn.1809d820
mov eax, dword [esi]
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1806b9f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x1806b9d5
push 0xffffffffffffffff
push 4
pop edi
push edi
mov dword [ebp - 0x220], ecx
call fcn.18001d8a
or dword [ebp - 0x218], 0xffffffff
push ebx
push dword [esi]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push str._Failed_to_read_environment_variable___s___d_
push eax
mov dword [ebp - 0x214], edi
call fcn.18001000
add esp, 0x10
test ebx, ebx
jle 0x1806b9e5
and ebx, 0xffff
or ebx, 0x80070000
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
push 4
pop edi
je 0x1806ba4b
push 3
pop ebx
push ebx
push edi
mov dword [ebp - 0x220], ecx
call fcn.18001d8a
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
push dword [esi]
lea eax, [ebp - 0x220]
push str._read_unique_event___s___s_
push eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], edi
call fcn.18001000
add esp, 0x10
lea eax, [ebp - 0x23c]
call fcn.180044b1
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
lea ebx, [ebp - 0x23c]
call fcn.18004984
pop ecx
pop ecx
push dword [ebp - 0x23c]
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ecx, dword [ebp - 0x224]
mov dword [ecx], eax
test eax, eax
jne 0x1806bb07
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov esi, eax
je 0x1806bae3
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x220], ecx
call fcn.18001d8a
or dword [ebp - 0x218], 0xffffffff
push esi
push dword [ebp - 0x23c]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push str._::OpenEvent_failed___s___d_
push eax
mov dword [ebp - 0x214], edi
call fcn.18001000
add esp, 0x10
test esi, esi
jle 0x1806baf3
and esi, 0xffff
or esi, 0x80070000
mov edi, esi
lea esi, [ebp - 0x23c]
call fcn.180044d7
mov eax, edi
jmp 0x1806b9e7
xor edi, edi
jmp 0x1806baf5
Function at 0x1806bbb8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10818
call fcn.180a6c10
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [ebx]
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x10814], esi
mov dword [ebp - 0x10810], edi
call fcn.1800c3b2
pop ecx
test al, al
jne 0x1806bbf7
mov eax, 0x80070002
jmp 0x1806bcda
call fcn.1800c234
xor eax, eax
push 0xfffe
mov word [ebp - 0x10808], ax
xor edi, edi
lea eax, [ebp - 0x10806]
push edi
push eax
call fcn.1809d820
mov eax, dword [ebx]
mov ecx, dword [esi]
add esp, 0xc
push eax
push 0x8000
lea eax, [ebp - 0x10808]
push eax
push edi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
call edi
xor esi, esi
mov dword [ebp - 0x10818], eax
test eax, eax
jbe 0x1806bcd8
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.1809d820
add esp, 0xc
lea eax, [ebp + esi*2 - 0x10808]
push eax
lea eax, [ebp - 0x1080c]
call fcn.18003fba
push dword [ebx]
lea eax, [ebp - 0x808]
push 0x400
push eax
mov eax, dword [ebp - 0x10814]
push 0
push dword [ebp - 0x1080c]
push dword [eax]
call edi
push dword [ebp - 0x10810]
lea eax, [ebp - 0x1080c]
call fcn.18026f3c
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1800422d
mov eax, dword [ebp - 0x1080c]
mov ecx, dword [eax - 0xc]
add eax, 0xfffffff0
lea esi, [esi + ecx + 1]
call fcn.18004250
cmp esi, dword [ebp - 0x10818]
jb 0x1806bc48
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1809ccb5
leave
ret