joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d221316
Capabilities:
Get file attributes

Disassembly:
jmp 0x7d28f050
sub esp, 0x40
push ebx
push ebp
push esi
push edi
push 0
call fcn.7d2216ef
mov ebp, eax
push ebp
call fcn.7d221cd5
test al, al
je 0x7d28f207
push 0x5c
push dword [ebp + 0x45c]
call sub.ntdll.dll_wcsrchr
push 0x5c
push dword [esp + 0x60]
mov ebx, eax
call sub.ntdll.dll_wcsrchr
add esp, 0x10
mov edi, eax
test ebx, ebx
je 0x7d28f207
mov esi, ebx
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x7d28f0a0
sub esi, ecx
sar esi, 1
je 0x7d28f207
test edi, edi
je 0x7d28f207
push esi
push edi
push ebx
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d28f207
push dword [0x7d2b6d80]
lea esi, [edi + esi*2]
push esi
call sub.ntdll.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x7d28f0f5
mov ebx, str.Manifest1.txt
mov dword [esp + 0x54], 0x16c
jmp 0x7d28f119
push dword [0x7d2b6d84]
push esi
call sub.ntdll.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x7d28f207
mov ebx, str.Manifest2.txt
mov dword [esp + 0x54], 0x5c
cmp byte [ebp + 0x45a], 0
jne 0x7d28f12e
mov ebx, str.Manifest0.txt
mov ebp, 2
jmp 0x7d28f132
mov ebp, dword [esp + 0x54]
push 0x410
call fcn.7d221505
mov edx, dword [0x7d2b7320]
mov edi, eax
mov dword [esp + 0x54], edi
mov esi, edi
nop word [eax + eax]
movzx ecx, word [edx]
lea edx, [edx + 2]
mov word [esi], cx
lea esi, [esi + 2]
test cx, cx
jne 0x7d28f150
mov edx, ebx
mov esi, ebx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x7d28f165
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x7d28f175
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 3
push 0
mov ecx, edx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x68]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
mov esi, eax
call fcn.7d221537
cmp esi, 0xffffffff
je 0x7d28f1f6
test esi, esi
je 0x7d28f1f6
push 0x22
push 0x38
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x7d28f1ef
cmp dword [esp + 0x40], ebp
jne 0x7d28f1ef
cmp dword [esp + 0x44], 0
jne 0x7d28f1ef
mov eax, dword [esp + 0x58]
pop edi
mov dword [eax], esi
mov al, 1
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 2]
push eax
push 0x89d
call sym.SbieDll.dll_SbieApi_Log
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x40
ret 8
Function at 0x7d2213ed
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x7d234450
push ecx
mov eax, dword [0x7d2b624c]
cmp eax, 0xffffffff
je 0x7d2344cb
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [esp + 4], ebx
test ebx, ebx
je 0x7d2344ca
push ebp
push esi
push edi
push 0
push dword [0x7d2b624c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebp, 0x10
mov esi, ebx
mov edi, 8
nop word [eax + eax]
mov eax, dword [esi]
test eax, eax
je 0x7d2344a2
push dword [eax - 4]
add eax, 0xfffffffc
push eax
call fcn.7d221451
mov dword [esi], 0
add esi, 0x40
sub edi, 1
jne 0x7d234490
add ebx, 4
sub ebp, 1
jne 0x7d234483
mov eax, dword [esp + 0x10]
add eax, 0xfffffffc
push dword [eax]
push eax
call fcn.7d221451
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x7d221415
Capabilities:
Extract resource via kernel32 functions
Parse pe header

Disassembly:
jmp 0x7d2752a0
push esi
push edi
push 0xa
push str.LOWLEVEL
push dword [0x7d2b72f8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x7d2753e4
push edi
push dword [0x7d2b72f8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x7d2753e4
push edi
push dword [0x7d2b72f8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x7d2753e4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x7d2753e4
movzx eax, word [edi]
mov ecx, 0x4d5a
push ebx
cmp ax, cx
je 0x7d275314
mov ecx, 0x5a4d
cmp ax, cx
jne 0x7d27533e
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x7d2753db
mov eax, 0x10b
cmp word [esi + 0x18], ax
jne 0x7d2753db
cmp dword [esi + 0x34], 0
jne 0x7d2753db
movzx eax, word [esi + 0x14]
lea ebx, [esi + 0x18]
add ebx, eax
cmp word [esi + 6], 2
jb 0x7d2753db
push 5
push 0x7d2a13a8
push ebx
call sub.ntdll.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x7d2753db
push 4
lea eax, [ebx + 0x28]
push 0x7d2a13b0
push eax
call sub.ntdll.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x7d2753db
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + edi]
sub ecx, dword [ebx + 0xc]
mov dword [0x7d2de7f0], ecx
mov edx, dword [eax + edi + 8]
sub edx, dword [ebx + 0xc]
mov dword [0x7d2de7f4], edx
mov eax, dword [ebx + 0x14]
add eax, edi
mov dword [0x7d2de7ec], eax
mov eax, dword [ebx + 0x10]
mov dword [0x7d2de7f8], eax
test ecx, ecx
je 0x7d2753db
test edx, edx
je 0x7d2753db
push str.LdrInitializeThunk
push dword [0x7d2b72fc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [0x7d2de800], eax
test eax, eax
mov edx, 0x33
pop ebx
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
ret
pop ebx
pop edi
mov eax, 0x22
pop esi
ret
pop edi
mov eax, 0x11
pop esi
ret
Function at 0x7d22141a
Capabilities:
Write file on windows

Disassembly:
jmp 0x7d24aaf0
sub esp, 0x34
mov eax, dword [0x7d29bb7c]
mov edx, 0x5c
mov ecx, dword [esp + 0x44]
xorps xmm0, xmm0
mov dword [esp + 4], eax
mov ax, word [0x7d29bb80]
mov word [esp + 8], ax
mov eax, dword [esp + 0x40]
push esi
mov dword [esp + 0x18], 0x7c
movups xmmword [esp + 0x1c], xmm0
mov word [eax + ecx*2], dx
inc ecx
mov dword [esp + 0x48], ecx
movq qword [esp + 0x2c], xmm0
mov dword [esp + 0x34], 0
lea ecx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov esi, dword [eax]
test esi, esi
je 0x7d24ac9d
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtWriteFile]
push ebp
push edi
mov edi, dword [esp + 0x48]
nop
mov eax, dword [esi + 0x1c]
lea eax, [eax*2 + 2]
push eax
lea eax, [esi + 0x20]
push eax
push ecx
call sub.ntdll.dll_memcpy
mov ebp, dword [esi + 0x1c]
add esp, 0xc
add ebp, dword [esp + 0x54]
mov eax, 0
mov ecx, dword [esi + 0x14]
test cl, 2
mov dword [esp + 0x4c], ebp
cmove eax, dword [esp + 0x58]
mov dword [esp + 0x58], eax
not eax
test ecx, eax
jne 0x7d24aba7
cmp dword [esi + 0x18], 0
je 0x7d24ac76
push 0
push 0
lea eax, [ebp*2]
push eax
push dword [esp + 0x5c]
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push edi
call ebx
push 0x10
lea eax, [esp + 0x2a]
push eax
push dword [esi + 0x14]
call sub.ntdll.dll__ultow
lea eax, [esp + 0x30]
add esp, 0xc
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7d24abe0
push 0
sub eax, edx
push 0
sar eax, 1
add eax, eax
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push edi
call ebx
cmp dword [esi + 0x18], 0
je 0x7d24ac5a
push 0
push 0
push 2
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push edi
call ebx
mov edx, dword [esi + 0x18]
mov ecx, edx
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d24ac30
push 0
sub ecx, ebp
push 0
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push edi
call ebx
mov ebp, dword [esp + 0x4c]
push 0
push 0
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push edi
call ebx
mov ecx, dword [esi + 0x14]
mov eax, dword [esp + 0x58]
or eax, ecx
push eax
push ebp
push dword [esp + 0x58]
lea eax, [esi + 8]
push eax
push edi
call fcn.7d22141a
mov esi, dword [esi]
mov ecx, dword [esp + 0x10]
test esi, esi
jne 0x7d24ab60
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x34
ret 0x14
Function at 0x7d2214d3
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x7d25fd30
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x7d25fe45
cmp edi, 0xc000
jbe 0x7d25fe30
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
mov dword [esp + 0x20], 0
lea ebx, [edi + 0x10017]
mov ecx, 0x40
and ebx, 0xffff0000
mov eax, 4
cmp byte [esi], 0xff
mov dword [esp + 0x10], ebx
cmove eax, ecx
push eax
push 0x103000
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x30]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x7d25fdb5
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret 8
mov eax, dword [esi]
lea edi, [ecx - 0x18]
add edi, ebx
lea edx, [esi + 8]
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0x10], ecx
mov ecx, ebp
mov dword [edi + 0x14], ebx
lea ebx, [esi + 4]
mov dword [edi + 0xc], esi
lock cmpxchg dword [ebx], ecx
cmp eax, ebp
je 0x7d25fdf1
push edx
mov byte [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [esp + 0x1c]
lea edx, [esi + 8]
mov dword [ebx], ebp
jmp 0x7d25fdf3
xor al, al
mov ecx, dword [esi + 0x38]
inc dword [esi + 0x40]
mov dword [esi + 0x38], edi
mov dword [edi + 4], 0
mov dword [edi], ecx
test ecx, ecx
jne 0x7d25fe0e
mov dword [esi + 0x3c], edi
jmp 0x7d25fe11
mov dword [ecx + 4], edi
test al, al
je 0x7d25fe22
push edx
mov dword [ebx], ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
xchg dword [ebx], eax
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret 8
lea eax, [edi + 0x7f]
shr eax, 7
push eax
push esi
call fcn.7d2606d0
pop edi
pop esi
add esp, 8
ret 8
pop edi
xor eax, eax
pop esi
add esp, 8
ret 8

Function at 0x7d221505
Capabilities:
Terminate process

Disassembly:
jmp 0x7d2343b0
push esi
mov esi, dword [esp + 8]
add esi, 4
push esi
push dword [0x7d2b7390]
call fcn.7d2214d3
test eax, eax
jne 0x7d2343eb
cmp dword [0x7d2b730c], eax
jne 0x7d2343d4
pop esi
ret 4
push 0
push 0x901
call sym.SbieDll.dll_SbieApi_Log
add esp, 8
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [eax], esi
add eax, 4
pop esi
ret 4
Function at 0x7d22150a
Capabilities:
Delete registry value

Disassembly:
jmp 0x7d26b710
sub esp, 0x24
mov eax, 0x102
cmp byte [0x7d2b7350], 0
push ebx
push ebp
push esi
push edi
mov ebp, 2
push 0x100
cmovne ebp, eax
call fcn.7d221505
movups xmm0, xmmword [str._registrymachine_softwareclasses_]
mov edx, dword [esp + 0x38]
mov ebx, eax
mov esi, edx
movups xmmword [ebx], xmm0
movups xmm0, xmmword [0x7d2a0100]
movups xmmword [ebx + 0x10], xmm0
movups xmm0, xmmword [0x7d2a0110]
movups xmmword [ebx + 0x20], xmm0
movups xmm0, xmmword [0x7d2a0120]
movups xmmword [ebx + 0x30], xmm0
movq xmm0, qword [0x7d2a0130]
movq qword [ebx + 0x40], xmm0
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x7d26b775
sub edx, esi
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x7d26b785
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx - 2]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x7d26b7a2
mov eax, dword [0x7d2a0148]
mov edx, dword [esp + 0x3c]
mov esi, edx
mov dword [ecx], eax
mov ax, word [0x7d2a014c]
mov word [ecx + 4], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x7d26b7c5
sub edx, esi
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x7d26b7d5
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x7d26b7f2
mov eax, dword [0x7d2a0150]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [edi], eax
lea eax, [esp + 0x14]
push ebx
push eax
call esi
push dword [esp + 0x18]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 0x18
push 0x6b
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.7d221631
test eax, eax
jne 0x7d26b88b
lea eax, [esp + 0x1c]
push eax
push ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x7d26b88b
push dword [esp + 0x40]
lea eax, [esp + 0x18]
push eax
call esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc

Function at 0x7d221523
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x7d275110
mov eax, dword [0x7d2de7f4]
lea ecx, [esp + 8]
push esi
mov esi, dword [esp + 0xc]
add eax, esi
push ecx
push 0xf0
push dword [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x7d27516d
cmp dword [esp + 0xc], 0xf0
jne 0x7d27516d
lea eax, [esp + 0x10]
push eax
push 0x40
push dword [0x7d2de7f8]
push esi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x7d27516d
mov al, 1
pop esi
ret 0xc
xor al, al
pop esi
ret 0xc
Function at 0x7d22155f
Capabilities:
Get system information on windows

Disassembly:
jmp 0x7d252cf0
sub esp, 0x28
cmp byte [0x7d2b6304], 0
je 0x7d252d59
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
mov dword [0x7d2de478], eax
mov eax, dword fs:[0x30]
mov esi, dword [eax + 0x2c]
test esi, esi
je 0x7d252d58
add esi, 0x28
cmp dword [esi], 0
je 0x7d252d58
lea eax, [esp + 4]
push eax
push 4
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x7d252d58
mov eax, 0x7d252260
xchg dword [esi], eax
mov dword [0x7d2de474], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
add esp, 0x28
ret

Function at 0x7d2215aa
Capabilities:
Query environment variable

Disassembly:
jmp 0x7d237c70
mov cl, byte [esp + 0xc]
mov al, byte [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov dword [esp + 0x10], ecx
push ebp
push esi
push edi
test ebx, ebx
jne 0x7d237c92
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
jmp 0x7d237c9c
xor edx, edx
test al, al
je 0x7d237d30
xor esi, esi
mov edx, ebx
cmp word [ebx], si
je 0x7d237ccd
mov ecx, edx
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d237cb0
sub ecx, edi
sar ecx, 1
lea eax, [ecx + 1]
lea edx, [edx + eax*2]
add esi, eax
cmp word [edx], 0
jne 0x7d237ca5
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
lea eax, [esi*2 + 0x10]
push eax
call fcn.7d237e30
cmp word [ebx], 0
mov ebp, eax
je 0x7d237db6
mov edi, dword [esp + 0x18]
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x7d237d00
sub esi, ecx
sar esi, 1
lea esi, [esi*2 + 2]
push esi
push ebx
push edi
call sub.ntdll.dll_memcpy
add ebx, esi
add esp, 0xc
add edi, esi
cmp word [ebx], 0
jne 0x7d237cf4
jmp 0x7d237dba
mov esi, ebx
cmp byte [ebx], dl
je 0x7d237d5e
mov ecx, ebx
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x7d237d40
sub ecx, edi
lea eax, [ecx + 1]
add ebx, eax
add edx, eax
cmp byte [ebx], 0
jne 0x7d237d36
lea eax, [edx*2 + 0x10]
jmp 0x7d237d63
mov eax, 0x10
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], dl
push dword [esp + 0x18]
push ecx
push eax
call fcn.7d237e30
cmp byte [esi], 0
mov ebp, eax
je 0x7d237db6
mov edi, dword [esp + 0x18]
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x7d237d90
sub ecx, edx
add ecx, 1
je 0x7d237daf
nop
movzx eax, byte [esi]
inc esi
mov word [edi], ax
add edi, 2
sub ecx, 1
jne 0x7d237da0
cmp byte [esi], 0
jne 0x7d237d85
jmp 0x7d237dba
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
xor eax, eax
mov word [edi], ax
mov eax, ebp
test ecx, ecx
je 0x7d237dcd
sub edi, ebp
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x7d2215eb
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x7d274000
mov eax, dword [esp + 4]
push edi
mov edi, dword [eax]
sub edi, 5
mov dword [eax], edi
mov eax, dword [0x7d2de764]
cmp eax, edi
je 0x7d27401d
sub eax, edi
add dword [0x7d2de7c1], eax
lea eax, [esp + 8]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x7d2de7c0]
mov dword [edi], eax
movzx eax, byte [0x7d2de7c4]
mov byte [edi + 4], al
lea eax, [esp + 8]
push eax
push dword [0x7d2de7c8]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [0x7d2de759]
pop edi
test al, al
jne 0x7d27408e
cmp dword [0x7d2b735c], 0x20d0
jae 0x7d27407d
mov eax, dword fs:[0x30]
cmp byte [eax + 1], 0x2a
jne 0x7d274078
mov byte [eax + 1], 0
mov al, byte [0x7d2de759]
movzx eax, al
push eax
call fcn.7d2210be
call fcn.7d221933
ret 4
movzx eax, al
push eax
call fcn.7d2210be
ret 4
Function at 0x7d22166d
Capabilities:
Terminate process

Disassembly:
jmp 0x7d2602d0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov ecx, dword [ebp + 0x38]
test ecx, ecx
je 0x7d260309
movzx eax, word [ecx + 0x16]
mov edi, dword [ecx]
add esi, eax
push 0x8000
push 0
push dword [ecx + 0x10]
call ebx
test eax, eax
je 0x7d26038f
mov ecx, edi
test edi, edi
jne 0x7d2602e7
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x7d26033f
mov ecx, ebp
and ecx, 0xffff0000
mov dword [esp + 0x14], ecx
nop dword [eax]
mov edi, dword [eax]
cmp ecx, eax
je 0x7d260338
push 0x8000
push 0
push eax
call ebx
test eax, eax
je 0x7d26038f
mov ecx, dword [esp + 0x14]
inc esi
mov eax, edi
test edi, edi
jne 0x7d260320
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x7d260371
mov ecx, ebp
and ecx, 0xffff0000
mov dword [esp + 0x14], ecx
mov edi, dword [eax]
cmp ecx, eax
je 0x7d26036a
push 0x8000
push 0
push eax
call ebx
test eax, eax
je 0x7d26038f
mov ecx, dword [esp + 0x14]
inc esi
mov eax, edi
test edi, edi
jne 0x7d260352
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x8000
push 0
and ebp, 0xffff0000
push ebp
call ebx
test eax, eax
jne 0x7d2603ab
push 0
push 0
push 0xc0000025
push 0xc0000005
call dword [sym.imp.KERNEL32.dll_RaiseException]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x7d221686
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x7d28d290
sub esp, 0x28
push esi
push dword [str.hQc]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x1c], 0x18
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call esi
lea eax, [esp + 0x14]
push eax
push 0x20019
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x7d28d32e
push dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
call esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x3c]
lea eax, [esp + 0x14]
push dword [esp + 0x3c]
push 2
push eax
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [esp + 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x7d28d32e
mov al, 1
pop esi
add esp, 0x28
ret 0xc
xor al, al
pop esi
add esp, 0x28
ret 0xc
Function at 0x7d22168b
Capabilities:
Read file on windows

Disassembly:
jmp 0x7d261260
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
push edi
test ebp, ebp
je 0x7d2612ca
mov eax, dword [esi + 8]
mov ebx, dword [esp + 0x24]
nop word [eax + eax]
test eax, eax
jne 0x7d2612b4
push eax
push eax
push 0xfe8
lea edi, [esi + 0x10]
push edi
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov dword [esi + 4], edi
test eax, eax
js 0x7d2612e5
mov eax, dword [esp + 0x14]
mov dword [esi + 8], eax
test eax, eax
je 0x7d2612d6
mov eax, dword [esi + 4]
mov al, byte [eax]
mov byte [ebx], al
inc ebx
dec dword [esi + 8]
inc dword [esi + 4]
mov eax, dword [esi + 8]
sub ebp, 1
jne 0x7d261280
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 0xc0000011
pop ebx
add esp, 8
ret 0xc
pop edi
mov dword [esi + 8], 0
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x7d2216db
Capabilities:
Terminate process

Disassembly:
jmp 0x7d287200
mov eax, dword [0x7d2dea2c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
test eax, eax
je 0x7d28721e
push eax
call esi
mov dword [0x7d2dea2c], 0
push dword [0x7d2b69a4]
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0
push 2
call edi
test eax, eax
je 0x7d28725b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
push eax
call esi
push 0x7d0
call ebx
push dword [0x7d2b69a4]
push 0
push 2
call edi
test eax, eax
jne 0x7d287240
pop ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x7d2216ef
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x7d2344f0
cmp dword [0x7d2b624c], 0xffffffff
jne 0x7d2344fe
xor eax, eax
ret 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x7d2b624c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x7d234543
push 0x49c
call fcn.7d2217b2
push 0x49c
mov esi, eax
push 0
push esi
call sub.ntdll.dll_memset
add esp, 0xc
push esi
push dword [0x7d2b624c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x7d234554
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x7d2216fe
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
jmp 0x7d291010
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov eax, 0x2000
push esi
push edi
mov dword [esp + 0x10], eax
xor edi, edi
push eax
call fcn.7d221505
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebx
push 5
call ebp
mov esi, eax
test esi, esi
jns 0x7d291075
push ebx
call fcn.7d221537
xor ebx, ebx
cmp esi, 0x80000005
je 0x7d291062
cmp esi, 0xc0000004
je 0x7d291062
cmp esi, 0xc0000023
jne 0x7d291075
mov eax, dword [esp + 0x10]
inc edi
add eax, 0x40
mov dword [esp + 0x10], eax
cmp edi, 5
jb 0x7d291026
jmp 0x7d291079
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x7d291083
mov dword [ecx], eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 4