joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001488
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000152a
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000152a
call fcn.140001168
mov rdi, rax
test rax, rax
je 0x14000152a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call fcn.14000157c
test rax, rax
je 0x14000152a
and qword [rsp + 0x48], 0
mov rcx, rax
and ecx, 0xfff
mov r8d, 0x1000
sub r8, rcx
mov r9d, 1
mov rcx, qword [rbx + 0x20]
mov rdx, rax
cmp r8, rcx
cmovae r8, rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x14000152f
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400017a8
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000182f
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000182f
call fcn.140001168
mov rcx, qword [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
call fcn.14000157c
test rax, rax
je 0x14000182f
mov rdx, qword [rdi + 0x18]
lea r9, [rsp + 0x38]
mov rcx, rax
mov r8d, 0x1000
and ecx, 0xfff
sub r8, rcx
mov rcx, qword [rdi + 0x20]
cmp r8, rcx
cmovae r8, rcx
mov rcx, rax
call fcn.140001734
xor eax, eax
jmp 0x140001834
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7d22101e
Capabilities:
Get system information on windows

Disassembly:
jmp 0x7d22e560
sub rsp, 0x28
call fcn.7d2218ca
call fcn.7d22141a
call fcn.7d22136b
mov cl, 1
call fcn.7d221451
call fcn.7d221410
call fcn.7d2215d2
cmp dword [0x7d2abfb4], 0x2580
jb 0x7d22e59c
mov rcx, qword [0x7d2abf48]
call fcn.7d221537
mov cl, 1
add rsp, 0x28
jmp sym.imfsbDll.dll_SbieDll_StartCOM
Function at 0x7d221078
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
jmp 0x7d2839e0
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
cmp byte [0x7d2ad724], 0
jne 0x7d283c64
mov qword [rsp + 0x1b8], rbx
lea rcx, [rbp - 0x70]
xor ebx, ebx
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], rbx
mov dword [rbp - 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x7d283a39
cmp dword [rbp - 0x6c], 5
je 0x7d283c24
lea r8, [rbp + 0xe0]
mov edx, 8
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
test eax, eax
js 0x7d283c24
mov rcx, qword [rbp + 0xe0]
lea rax, [rbp + 0xd0]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xd8]
lea edx, [r9 + 0xe]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x7d283c24
mov ecx, dword [rbp + 0xd8]
lea eax, [rcx - 2]
cmp eax, 1
jbe 0x7d283c1e
cmp ecx, 1
jne 0x7d283c24
mov ecx, 0x2000
call fcn.7d2212da
mov rcx, qword [rbp + 0xe0]
mov rbx, rax
lea rax, [rbp + 0xd0]
mov r8, rbx
mov r9d, 0x2000
mov qword [rsp + 0x20], rax
mov edx, 2
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x7d283b31
xor ecx, ecx
mov dword [rbp + 0xd0], ecx
cmp dword [rbx], ecx
jbe 0x7d283b31
mov r8d, dword [0x7d2ab9b0]
mov r9, qword [0x7d2ab9a8]
nop word [rax + rax]
mov edx, ecx
add rdx, rdx
mov rax, qword [rbx + rdx*8 + 8]
cmp qword [rax], r9
jne 0x7d283b25
cmp dword [rax + 8], r8d
jne 0x7d283b25
cmp dword [rax + 0xc], 0x220
jne 0x7d283b25
test byte [rbx + rdx*8 + 0x10], 4
jne 0x7d283b49
inc ecx
mov dword [rbp + 0xd0], ecx
cmp ecx, dword [rbx]
jb 0x7d283b00
cmp dword [rbp + 0xd8], 2
jne 0x7d283b62
mov dword [0x7d2ab9b4], 2
jmp 0x7d283c24
mov dword [rbp + 0xd8], 2
mov dword [0x7d2ab9b4], 2
jmp 0x7d283c24
lea rax, [rsp + 0x30]
mov dword [rsp + 0x40], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea rdx, str._registrymachine_softwaremicrosoftwindowscurrentversionpolicies_system
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x58], 0x40
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r8, [rsp + 0x40]
mov edx, 0x20019
lea rcx, [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x7d283c24
lea rdx, str.EnableLUA
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp + 0xe8]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
mov r8d, 2
mov dword [rsp + 0x20], 0x20
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d283c24
cmp dword [rsp + 0x78], 4
jne 0x7d283c24
cmp dword [rsp + 0x7c], 0
je 0x7d283c24
mov eax, dword [rbp + 0xd8]
mov dword [0x7d2ab9b4], eax
jmp 0x7d283c24
mov dword [0x7d2ab9b4], ecx
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x7d283c36
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x7d283c43
mov rcx, rbx
call fcn.7d221938
mov rcx, qword [rbp + 0xe0]
mov rbx, qword [rsp + 0x1b8]
test rcx, rcx
je 0x7d283c5d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x7d2ad724], 1
mov eax, dword [0x7d2ab9b4]
add rsp, 0x1c0
pop rbp
ret
Function at 0x7d2210af
Capabilities:
Check mutex on windows

Disassembly:
jmp 0x7d260110
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov r8, qword [str.pP_]
lea rax, [0x7d294f98]
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 0x10], rdx
xor eax, eax
mov esi, 1
xor edx, edx
mov dword [rcx + 8], esi
xor ecx, ecx
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], rcx
mov qword [rbx + 0x50], rcx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x7d26021e
or edx, 0xffffffff
mov qword [rsp + 0x40], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8, qword [str.SBIE_ProtectedStorage_Section]
xor edx, edx
mov ecx, 0xf001f
xor dil, dil
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x7d2601d9
mov rax, qword [str.SBIE_ProtectedStorage_Section]
lea r8d, [rsi + 3]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 8
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
movzx edi, dil
mov qword [rbx + 0x20], rax
cmovne edi, esi
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x7d26020f
xor r9d, r9d
mov qword [rsp + 0x20], 8
xor r8d, r8d
mov edx, 0xf001f
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x50], rax
test dil, dil
je 0x7d26020f
mov rcx, qword [rbx + 0x48]
inc rcx
mov qword [rax], rcx
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret

Function at 0x7d2210f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x7d246310
xor r9d, r9d
jmp fcn.7d22167c

Function at 0x7d22113b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x7d22ee40
sub rsp, 0x28
mov ecx, dword [0x7d2aa49c]
cmp ecx, 0xffffffff
je 0x7d22eeeb
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x7d22eee6
mov ecx, dword [0x7d2aa49c]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ebp, ebp
mov rbx, rsi
mov edi, 0xc
mov rcx, qword [rbx]
test rcx, rcx
je 0x7d22eea5
mov edx, dword [rcx - 8]
add rcx, 0xfffffffffffffff8
call fcn.7d2218de
mov rcx, qword [rbx + 0x60]
mov qword [rbx], rbp
test rcx, rcx
je 0x7d22eebd
mov edx, dword [rcx - 8]
add rcx, 0xfffffffffffffff8
call fcn.7d2218de
mov qword [rbx + 0x60], rbp
add rbx, 8
sub rdi, 1
jne 0x7d22ee91
mov edx, dword [rsi - 8]
lea rcx, [rsi - 8]
call fcn.7d2218de
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x7d221159
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x7d227b00
push rbx
push rbp
push rsi
sub rsp, 0x50
cmp qword [0x7d2abc98], 0
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
jne 0x7d227b56
mov rcx, qword [0x7d2aa180]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.StringFromGUID2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7d2abc98], rax
test rax, rax
jne 0x7d227b56
movups xmm0, xmmword [str.unknown]
movups xmmword [rsi], xmm0
add rsp, 0x50
pop rsi
pop rbp
pop rbx
ret
mov rcx, rsi
mov qword [rsp + 0x70], rdi
sub rcx, rbx
mov qword [rsp + 0x78], r14
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x7d227b70
or rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
cmp word [rsi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x7d227b90
lea rbx, [rsi + rax*2]
mov rcx, rbp
mov eax, 0x5c
lea rdx, [rbx + 2]
mov word [rbx], ax
lea r8d, [rax - 0x2c]
call qword [0x7d2abc98]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000000
call qword [0x7d2abb88]
mov r8d, 0x60
lea rdx, [rbx + 2]
mov rcx, rsi
mov ebp, eax
call sub.ntdll.dll_memmove
cmp word [rsi + rdi*2 + 2], 0
lea rdi, [rdi + 1]
jne 0x7d227bf0
lea rbx, [rsi + rdi*2]
mov eax, 0x20
mov word [rbx], ax
xor r14d, r14d
add rbx, 2
test ebp, ebp
jne 0x7d227ca6
mov rdi, rbx
test bl, 3
je 0x7d227c27
lea rdi, [rbx + 3]
and rdi, 0xfffffffffffffffc
lea rdx, [0x7d28ed18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov r9, rdi
mov dword [rsp + 0x20], 0x80
mov r8d, 2
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test eax, eax
jne 0x7d227c97
mov ecx, dword [rdi + 8]
lea rdx, [rdi + 0xc]
shr ecx, 1
mov r8d, ecx
mov dword [rsp + 0x88], ecx
add r8, r8
mov rcx, rbx
call sub.ntdll.dll_memmove
mov ecx, dword [rsp + 0x88]
mov word [rbx + rcx*2], r14w
mov rcx, qword [rsp + 0x30]
call qword [0x7d2abb90]
test esi, esi
je 0x7d227cac
mov dword [rbx], 0x3f
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
pop rbp
pop rbx
ret

Function at 0x7d22117c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
jmp 0x7d282570
push rbx
sub rsp, 0x20
lea rdx, str.open
mov rbx, rcx
call fcn.7d2825c0
test rax, rax
jne 0x7d28259e
lea rdx, str.cplopen
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.7d2825c0
add rsp, 0x20
pop rbx
ret

Function at 0x7d221186
Capabilities:
Print debug messages
Terminate process

Disassembly:
jmp 0x7d22ee30
mov edx, 0x80
jmp fcn.7d2218de
Function at 0x7d22119f
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d227280
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
lea rdx, str.CoGetClassObject
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CoCreateInstance
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CoCreateInstanceEx
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CoUnmarshalInterface
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CoMarshalInterface
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CoTaskMemAlloc
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x7d28ea58]
mov rcx, rbx
mov qword [0x7d2abcb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7d2abcc0], rax
call sym.imfsbDll.dll_SbieDll_IsOpenCOM
test al, al
jne 0x7d22741b
lea r8, [0x7d2248d0]
mov rdx, rsi
lea rcx, str.CoGetClassObject
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2abc48], rax
test rax, rax
je 0x7d2273c0
lea rcx, str.cocreate
call fcn.7d2215e6
test al, al
jne 0x7d2273a8
lea r8, [0x7d2244d0]
mov rdx, r15
lea rcx, str.CoCreateInstance
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2abc58], rax
test rax, rax
je 0x7d2273c0
lea r8, [0x7d224670]
mov rdx, r14
lea rcx, str.CoCreateInstanceEx
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2abc60], rax
test rax, rax
je 0x7d2273c0
cmp dword [0x7d2abfb4], 0x20d0
jb 0x7d2273c4
mov rcx, rdi
call fcn.7d225ca0
test al, al
jne 0x7d2273e6
xor al, al
jmp 0x7d22741d
lea r8, [0x7d224cd0]
mov rdx, rdi
lea rcx, str.CoUnmarshalInterface
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2abc68], rax
test rax, rax
je 0x7d22741d
lea r8, [0x7d224b30]
mov rdx, rbp
lea rcx, str.CoMarshalInterface
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2abc88], rax
test rax, rax
je 0x7d2273c0
xor r8d, r8d
lea rcx, [0x7d29aeb8]
lea edx, [r8 + 4]
call sym.imfsbDll.dll_SbieDll_IsOpenClsid
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x7d221203
Capabilities:
Write file on windows

Disassembly:
jmp 0x7d258af0
push rbx
sub rsp, 0x60
mov eax, dword [rcx + 0x10]
mov rbx, rcx
test eax, eax
je 0x7d258b6d
mov qword [rsp + 0x40], 0
xor r9d, r9d
mov qword [rsp + 0x38], 0
xor r8d, r8d
mov dword [rsp + 0x30], eax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rsi
lea rsi, [rcx + 0x18]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, eax
test eax, eax
js 0x7d258b55
mov eax, dword [rbx + 0x10]
mov edx, 0xc000007f
cmp qword [rsp + 0x58], rax
cmovne ecx, edx
mov qword [rbx + 8], rsi
mov eax, ecx
mov rsi, qword [rsp + 0x70]
mov dword [rbx + 0x10], 0
add rsp, 0x60
pop rbx
ret
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x7d22128a
Capabilities:
Write file on windows

Disassembly:
jmp 0x7d258f20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rdi, r8
mov esi, edx
mov rbx, rcx
test edx, edx
je 0x7d258fc3
xor r14d, r14d
mov r15d, 0xc000007f
nop dword [rax]
cmp dword [rbx + 0x10], 0xfe0
jne 0x7d258fab
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
lea rbp, [rbx + 0x18]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x30], 0xfe0
xor r8d, r8d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x7d258f9f
mov ecx, dword [rbx + 0x10]
cmp qword [rsp + 0x58], rcx
cmovne eax, r15d
mov dword [rbx + 0x10], r14d
mov qword [rbx + 8], rbp
test eax, eax
js 0x7d258fc5
movzx eax, byte [rdi]
inc rdi
mov rcx, qword [rbx + 8]
mov byte [rcx], al
inc qword [rbx + 8]
inc dword [rbx + 0x10]
add esi, 0xffffffff
jne 0x7d258f50
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x7d2212ad
Capabilities:
Bypass uac via rpc

Disassembly:
jmp 0x7d27f060
sub rsp, 0x18
xor r8b, r8b
mov byte [rsp], r8b
cmp byte [0x7d2ad62a], r8b
jne 0x7d27f18b
cmp qword [0x7d2ad630], 0
jne 0x7d27f18b
test r9, r9
je 0x7d27f18b
mov rax, qword [r9]
test rax, rax
je 0x7d27f18b
cmp dword [rax], 0x70
jne 0x7d27f18b
cmp dword [rax + 0x2c], 1
jne 0x7d27f18b
cmp qword [rax + 0x30], 0
je 0x7d27f18b
mov rcx, qword [r9 + 8]
cmp rcx, 0x1fff
jb 0x7d27f18b
mov rax, qword [rcx + 0x18]
cmp rax, qword [0x7d2ab928]
jne 0x7d27f104
mov rax, qword [rcx + 0x20]
cmp rax, qword [0x7d2ab930]
jne 0x7d27f104
mov rax, qword [r9 + 0x58]
test rax, rax
je 0x7d27f18b
mov dword [0x7d2ad62c], 1
mov qword [0x7d2ad638], rax
jmp 0x7d27f17a
mov rax, qword [rcx + 0x18]
cmp rax, qword [0x7d2ab938]
jne 0x7d27f11e
mov rax, qword [rcx + 0x20]
cmp rax, qword [0x7d2ab940]
je 0x7d27f138
mov rax, qword [rcx + 0x18]
cmp rax, qword [0x7d2ab948]
jne 0x7d27f18b
mov rax, qword [rcx + 0x20]
cmp rax, qword [0x7d2ab950]
jne 0x7d27f18b
mov ecx, 3
mov dword [rsp + 4], ecx
cmp ecx, 0x10
jae 0x7d27f170
mov eax, ecx
cmp dword [r9 + rax*8 + 0x10], 0xffffffff
jne 0x7d27f16c
mov edx, 2
mov dword [0x7d2ad62c], edx
lea eax, [rcx + 1]
mov rax, qword [r9 + rax*8 + 0x10]
mov qword [0x7d2ad638], rax
jmp 0x7d27f176
inc ecx
jmp 0x7d27f13d
mov edx, dword [0x7d2ad62c]
test edx, edx
je 0x7d27f18b
mov rax, qword [r9]
mov qword [0x7d2ad630], rax
mov r8b, 1
mov byte [rsp], r8b
jmp 0x7d27f192
movzx eax, r8b
add rsp, 0x18
ret

Function at 0x7d2212da
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22edb0
push rbx
sub rsp, 0x20
lea ebx, [rcx + 8]
mov rcx, qword [0x7d2ac008]
mov edx, ebx
call fcn.7d221505
mov rcx, rax
test rax, rax
jne 0x7d22edf4
cmp qword [0x7d2abf58], rax
jne 0x7d22edde
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, ebx
mov qword [rcx], rax
lea rax, [rcx + 8]
add rsp, 0x20
pop rbx
ret
Function at 0x7d22132a
Capabilities:
Terminate process

Disassembly:
jmp 0x7d272810
push rbx
sub rsp, 0x60
mov rbx, rcx
lea rax, [rsp + 0x70]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x7d272855
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x7d272859
or rax, 0xffffffffffffffff
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rbx, rbx
je 0x7d272873
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x7d22137f
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x7d2838c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rdi, rdx
mov dword [rsp + 0x48], 0x30
mov rdx, qword [str._registrymachine_systemcurrentcontrolset_servicesimfsbSvc]
lea rax, [rsp + 0x38]
mov rsi, rcx
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x60], 0x40
movdqu xmmword [rsp + 0x68], xmm0
mov ebx, r8d
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r8, [rsp + 0x48]
mov edx, 0x20019
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jns 0x7d283936
xor al, al
jmp 0x7d283980
mov rdx, rsi
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov r9, rdi
mov dword [rsp + 0x20], ebx
mov r8d, 2
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
setns al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x7d221406
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x7d27f490
sub rsp, 0x28
mov rdx, qword [sym.imp.ntdll.dll_NtOpenProcess]
lea r8, [0x7d280100]
lea rcx, str.NtOpenProcess
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad5e0], rax
test rax, rax
jne 0x7d27f4c1
xor al, al
add rsp, 0x28
ret
mov rdx, qword [sym.imp.ntdll.dll_NtOpenThread]
lea r8, [0x7d280200]
lea rcx, str.NtOpenThread
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad5e8], rax
test rax, rax
je 0x7d27f4ba
mov rdx, qword [sym.imp.ntdll.dll_NtDuplicateObject]
lea r8, [0x7d27ff20]
lea rcx, str.NtDuplicateObject
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad5f0], rax
test rax, rax
je 0x7d27f4ba
mov rdx, qword [sym.imp.ntdll.dll_NtQuerySecurityObject]
lea r8, [0x7d280380]
lea rcx, str.NtQuerySecurityObject
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad5f8], rax
test rax, rax
je 0x7d27f4ba
mov rdx, qword [sym.imp.ntdll.dll_NtSetSecurityObject]
lea r8, [0x7d280510]
lea rcx, str.NtSetSecurityObject
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad600], rax
test rax, rax
je 0x7d27f4ba
mov rdx, qword [sym.imp.ntdll.dll_NtSetInformationToken]
lea r8, [0x7d2804e0]
lea rcx, str.NtSetInformationToken
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad610], rax
test rax, rax
je 0x7d27f4ba
mov rdx, qword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
lea r8, [0x7d27fee0]
lea rcx, str.NtAdjustPrivilegesToken
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad618], rax
test rax, rax
je 0x7d27f4ba
cmp dword [0x7d2abfb8], 0xa
jae 0x7d27f5e4
mov rdx, qword [sym.imp.ntdll.dll_NtQueryInformationToken]
lea r8, [0x7d280290]
lea rcx, str.NtQueryInformationToken
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad608], rax
test rax, rax
je 0x7d27f4ba
cmp dword [0x7d2abfb0], 0xa
mov qword [rsp + 0x20], rbx
jne 0x7d27f63b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
test rax, rax
je 0x7d27f63b
lea rdx, str.SCODEF:
mov rcx, rax
call sub.ntdll.dll_wcsstr
test rax, rax
je 0x7d27f63b
lea rdx, str.CREDAT:
mov rcx, rbx
call sub.ntdll.dll_wcsstr
movzx ecx, byte [0x7d2ad628]
test rax, rax
mov edx, 1
cmovne ecx, edx
mov byte [0x7d2ad628], cl
mov rcx, qword [0x7d2abf38]
lea rdx, str.RtlQueryElevationFlags
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x7d27f6fa
mov ecx, dword [0x7d2abfb0]
cmp ecx, 0xa
ja 0x7d27f670
mov eax, 0x442
bt eax, ecx
jb 0x7d27f69e
mov rcx, qword [0x7d2abf60]
lea rdx, str.SynTPEnh.exe
call sub.ntdll.dll__wcsicmp
test eax, eax
je 0x7d27f69e
mov rcx, qword [0x7d2abf60]
lea rdx, str.SynTPHelper.exe
call sub.ntdll.dll__wcsicmp
test eax, eax
jne 0x7d27f6fa
lea r8, [0x7d2806d0]
mov rdx, rbx
lea rcx, str.RtlQueryElevationFlags
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad620], rax
test rax, rax
jne 0x7d27f6ca
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp dword [0x7d2abfb0], 0xa
jne 0x7d27f6fa
cmp byte [0x7d2ad628], 0
jne 0x7d27f6f3
call fcn.7d2215eb
cmp eax, 0xa
jae 0x7d27f6f3
test qword [0x7d2abfa0], 0x100
je 0x7d27f6fa
mov byte [0x7d2ad629], 1
mov al, 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x7d221410
Capabilities:
Accept command line arguments
Set environment variable
Terminate process

Disassembly:
jmp 0x7d22b1f0
sub rsp, 0x2d8
mov rax, qword [0x7d2abfa0]
and eax, 0x48000042
cmp rax, 0x40000002
jne 0x7d22b329
mov eax, dword [0x7d2abfb0]
cmp eax, 0xa
je 0x7d22b226
add eax, 0xfffffff4
cmp eax, 2
ja 0x7d22b329
mov qword [rsp + 0x2d0], rbx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
test rax, rax
je 0x7d22b321
lea rdx, [0x7d290250]
mov rcx, rax
call sub.ntdll.dll_wcsstr
test rax, rax
jne 0x7d22b26c
lea rdx, str._Embedding
mov rcx, rbx
call sub.ntdll.dll_wcsstr
test rax, rax
je 0x7d22b321
mov r8d, 0x104
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0xc0]
lea rcx, str.00000000_SBIE_COMSRV_EXE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rbx
lea rcx, str.00000000_SBIE_COMSRV_CMD
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x68]
call sub.ntdll.dll_memset
mov cl, 1
mov dword [rsp + 0x50], 0x68
mov dword [rsp + 0x8c], 0x80
call fcn.7d221235
test eax, eax
je 0x7d22b318
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x7d28ed18]
lea rax, [rsp + 0x50]
lea rdx, str.COMSRV
mov qword [rsp + 0x20], rax
lea rcx, str.THREAD
call sym.imfsbDll.dll_SbieDll_RunSandboxed
test eax, eax
je 0x7d22b318
mov rcx, qword [rsp + 0x30]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2d8
ret