joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7e1428
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x7e1430
push ebx
push esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7e15f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0042e218
lea ecx, [ebp - 0xc]
mov edx, dword [0x8c18bc]
mov edx, dword [edx]
mov eax, dword [ebp - 0x14]
call fcn.0042e118
mov ecx, 1
mov edx, dword [ebp - 0xc]
mov eax, 0x7e1610
call fcn.0040be44
test eax, eax
jle 0x7e14ce
call fcn.007e9850
test al, al
je 0x7e14ce
movzx eax, byte [0x7e1630]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
call fcn.007e75ac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.005fb5d0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, 0x7e1610
call fcn.0042c58c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0040ab70
lea ecx, [ebp - 0x10]
mov edx, dword [0x8c18bc]
mov edx, dword [edx]
mov eax, dword [ebp - 0x14]
call fcn.0042e118
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x7e1640
call fcn.0040be44
test eax, eax
jle 0x7e153c
call fcn.007e9850
test al, al
je 0x7e153c
movzx eax, byte [0x7e1630]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
call fcn.007e7694
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.005fb5d0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, 0x7e1640
call fcn.0042c58c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call fcn.0040ab70
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x7e1678
call fcn.0040be44
test eax, eax
je 0x7e15cd
lea eax, [ebp - 8]
mov edx, 0x208
call fcn.0040b98c
lea eax, [ebp - 8]
call fcn.0040ad48
mov edx, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x7e1577
sub eax, 4
mov eax, dword [eax]
add eax, eax
xor ecx, ecx
xchg edx, eax
call fcn.00407f88
lea eax, [ebp - 8]
call fcn.0040ad48
mov esi, eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x7e1597
sub ebx, 4
mov ebx, dword [ebx]
push ebx
push esi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jbe 0x7e15cd
lea eax, [ebp - 0x30]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040bc34
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
call fcn.00423774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e15fc
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.0040a7f0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040a7f0
ret
Function at 0x7e4110
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7e41df
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0042e218
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040abb8
cmp dword [ebp - 4], 0
je 0x7e41af
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00423774
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov ecx, 0
call fcn.0040b3c4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.007e3fa0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x7e41fc
call fcn.0040b04c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040b8d0
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040b7f8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e41e6
lea eax, [ebp - 0x1c]
call fcn.0040a790
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040a820
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a7f0
ret

Function at 0x7e4230
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7e42ff
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0042e218
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040abb8
cmp dword [ebp - 4], 0
je 0x7e42cf
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00423774
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov ecx, 0
call fcn.0040b3c4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.007e3fa0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x7e431c
call fcn.0040b04c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040b8d0
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040b7f8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e4306
lea eax, [ebp - 0x1c]
call fcn.0040a790
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040a820
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a7f0
ret
Function at 0x7e4344
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7e4413
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0042e218
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040abb8
cmp dword [ebp - 4], 0
je 0x7e43e3
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00423774
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov ecx, 0
call fcn.0040b3c4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.007e3fa0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x7e4430
call fcn.0040b04c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040b8d0
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040b7f8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e441a
lea eax, [ebp - 0x1c]
call fcn.0040a790
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040a820
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a7f0
ret

Function at 0x7e4458
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7e44f1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.006db184
mov eax, dword [ebp - 8]
test eax, eax
je 0x7e4496
sub eax, 4
mov eax, dword [eax]
cmp eax, 0xa
jle 0x7e44d6
push 1
push 0
push 0
push 0x7e450c
push dword [ebp - 8]
push 0x7e4578
mov eax, dword [0x8c0af4]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040baec
mov eax, dword [ebp - 0xc]
call fcn.0040b7f8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e44f8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a7f0
ret

Function at 0x7e4588
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7e462a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0042e218
mov eax, dword [ebp - 8]
test eax, eax
je 0x7e45c4
sub eax, 4
mov eax, dword [eax]
cmp eax, 0xa
jle 0x7e460f
push 1
push 0
push 0
push 0x7e4644
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0042e218
push dword [ebp - 0x10]
push 0x7e46b0
mov eax, dword [0x8c0af4]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040baec
mov eax, dword [ebp - 0xc]
call fcn.0040b7f8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e4631
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040a7f0
ret
Function at 0x7e59cc
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov dword [ebp - 0xc], 0xffffffff
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7e5b09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x7e5b28
call fcn.007e5948
mov ebx, eax
mov dword [ebp - 0x1d], ebx
test ebx, ebx
jne 0x7e5a14
call fcn.00409f88
jmp 0x7e5b10
push esi
push 0
push 0x1fffff
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x7e5a34
call fcn.00409f88
jmp 0x7e5b10
push 0x40
push 0x3000
push 0xf
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x7e5a5b
call fcn.00409f88
jmp 0x7e5b10
mov byte [ebp - 0x23], 0x68
mov byte [ebp - 0x1e], 0xe8
mov word [ebp - 0x19], 0xc021
mov word [ebp - 0x17], 0xf275
mov byte [ebp - 0x15], 0xc3
mov dword [ebp - 0x22], edi
mov eax, dword [ebp - 0x1d]
sub eax, dword [ebp - 8]
sub eax, 0xa
mov dword [ebp - 0x1d], eax
lea eax, [ebp - 0x10]
push eax
push 0xf
lea eax, [ebp - 0x23]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
test eax, eax
je 0x7e5ad8
cmp dword [ebp - 0x10], 0xf
jne 0x7e5ad8
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreateRemoteThread
mov ebx, eax
test ebx, ebx
je 0x7e5ad8
push 0x1388
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
push ebx
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e5b10
cmp dword [ebp - 8], 0
je 0x7e5aff
push 0x8000
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_VirtualFreeEx
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7e6c54
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 7
push 0
push 0
dec ecx
jne 0x7e6c5d
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7e6e25
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
call fcn.005fb798
mov eax, dword [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.0040bc34
lea eax, [ebp - 0x18]
mov edx, 0x7e6e40
call fcn.0040ba0c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040b3c4
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
sub al, 0x40
call fcn.00425924
mov ebx, eax
imul eax, dword [ebp - 0xc], 0x190a
cdq
idiv dword [ebp - 0xc]
imul eax, eax, 0x6b
xor ebx, eax
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0xc8
call fcn.0040b34c
mov eax, dword [ebp - 4]
test eax, eax
je 0x7e6cf5
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b230
mov eax, dword [ebp - 4]
test eax, eax
je 0x7e6d25
sub eax, 4
mov eax, dword [eax]
test eax, eax
jbe 0x7e6d3c
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
add ebx, ecx
inc edx
dec eax
jne 0x7e6d2e
lea eax, [ebp - 0x24]
movzx edx, byte [ebp - 0xc]
add dl, 0x50
call fcn.0040b810
push dword [ebp - 0x24]
lea eax, [ebp - 0x28]
push eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00424148
mov eax, dword [ebp - 0x2c]
mov ecx, 2
mov edx, 1
call fcn.0040bc34
push dword [ebp - 0x28]
mov eax, ebx
mov ecx, 0xf4240
xor edx, edx
div ecx
mov eax, edx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00424148
push dword [ebp - 0x30]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040baec
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040b3c4
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0060b6f0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 8]
mov edx, 1
call fcn.0040b230
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
call fcn.0040b8d0
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0042340c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, 0
call fcn.0040b3c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e6e2c
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.0040a820
lea eax, [ebp - 0x38]
mov edx, 9
call fcn.0040a7f0
lea eax, [ebp - 4]
call fcn.0040a7b4
ret
Function at 0x7e6e44
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
call fcn.007f77a4
test al, al
je 0x7e6f35
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x7e6e96
call sub.KERNEL32.DLL_GetLastError_2
cmp eax, 0x3f0
jne 0x7e6e96
lea eax, [ebp - 8]
push eax
push 8
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x7e6f35
mov eax, 0x2000
call fcn.004070f4
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x2000
push esi
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
test ebx, ebx
je 0x7e6f2e
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x8c00cc
call sub.advapi32.dll_AllocateAndInitializeSid
mov edi, dword [esi]
dec edi
test edi, edi
jl 0x7e6f25
inc edi
xor ebx, ebx
mov eax, dword [esi + ebx*8 + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x7e6f21
mov eax, dword [esi + ebx*8 + 8]
and eax, 0x10
cmp eax, 0x10
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x7e6f25
inc ebx
dec edi
jne 0x7e6efb
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00407110
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7e6f40
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
call fcn.007f77a4
test al, al
je 0x7e6fa1
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x8c00cc
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x7e6fa1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
je 0x7e6f98
cmp dword [ebp - 8], 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_FreeSid
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x7e951c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x7e9560
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7e954d
test al, 0x10
jne 0x7e9551
xor eax, eax
jmp 0x7e9553
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7e956a
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x7e9a7c
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7e9ccc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov byte [ebp - 9], 0
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x7e9cac
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x7e9bc2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10000
call fcn.0040fd9c
pop ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
push 0
call sub.advapi32.dll_OpenEventLogW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x7e9b1b
cmp dword [ebp - 0x10], 0xffffffff
jne 0x7e9b2d
call fcn.00409f88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7e9cb6
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetNumberOfEventLogRecords
test eax, eax
je 0x7e9b43
mov eax, dword [ebp - 0x14]
mov dword [ebx], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0
push 9
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ReadEventLogW
test eax, eax
jne 0x7e9b9b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 9
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ReadEventLogW
test eax, eax
je 0x7e9b9b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov al, 1
call fcn.004c6c54
fstp qword [esi]
wait
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e9bc9
cmp dword [ebp - 0x10], 0xffffffff
je 0x7e9bb7
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseEventLog
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040fdac
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e9cd3
lea eax, [ebp - 4]
call fcn.0040a790
ret
Function at 0x7ee85c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x7ee875
add esp, 0xfffffff0
call fcn.0040906c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7ee8f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [esi + 0x30], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005fb3c4
mov edx, dword [ebp - 8]
lea eax, [esi + 4]
call fcn.0040ab70
lea eax, [esi + 8]
mov edx, dword [0x7ea844]
call fcn.0040d3dc
lea eax, [esi + 0xc]
mov edx, dword [0x7ea87c]
call fcn.0040d3dc
lea eax, [esi + 0x10]
mov edx, dword [0x7ea8b4]
call fcn.0040d3dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7ee8f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a7f0
ret
Function at 0x7f79e0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
push esi
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x7f7a2b
mov dl, 1
mov eax, 0x7f7a3c
call fcn.007e3b08
push esi
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret

Function at 0x7f9644
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
mov byte [ebp - 5], cl
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7f96c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x4000
cmp byte [ebp - 5], 0
je 0x7f967b
or esi, 2
test bl, bl
je 0x7f9684
or esi, 0
jmp 0x7f9687
or esi, 1
push esi
push 0x2b4
lea eax, [ebp - 0x2b9]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ebx, dword [ebp - 0x2b5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7f96c7
lea eax, [ebp - 4]
call fcn.0040a790
ret

Function at 0x7f96d0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd30
push ebx
xor ecx, ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7f984a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebx + 0x300]
mov ecx, dword [ebp - 4]
xor edx, edx
call fcn.00557108
mov ebx, eax
mov dl, 1
mov eax, ebx
call fcn.005560ac
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 4]
call fcn.005fb5d0
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 4]
call fcn.0040abb8
lea eax, [ebp - 0x2c4]
mov ecx, 0x7f9868
mov edx, dword [ebp - 4]
call fcn.0040ba64
mov eax, dword [ebp - 0x2c4]
xor ecx, ecx
xor edx, edx
call fcn.007f9644
mov edx, eax
mov eax, ebx
call fcn.00555b58
lea eax, [ebp - 0x2c8]
mov ecx, 0x7f9868
mov edx, dword [ebp - 4]
call fcn.0040ba64
mov eax, dword [ebp - 0x2c8]
mov cl, 1
xor edx, edx
call fcn.007f9644
mov edx, eax
mov eax, ebx
call fcn.00555bf8
mov edx, 1
mov eax, ebx
call fcn.00555ca4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x7f8e74]
call fcn.007fa018
mov edx, eax
mov eax, ebx
call fcn.005559a8
push 0x200
push 0x2b4
lea eax, [ebp - 0x2b9]
push eax
push 0
lea eax, [ebp - 0x2cc]
mov ecx, 0x7f9868
mov edx, dword [ebp - 4]
call fcn.0040ba64
mov eax, dword [ebp - 0x2cc]
call fcn.0040b7f8
push eax
call sub.shell32.dll_SHGetFileInfoW
lea eax, [ebp - 0x2d0]
lea edx, [ebp - 0x2ad]
mov ecx, 0x104
call fcn.0040b8b4
mov edx, dword [ebp - 0x2d0]
mov eax, ebx
call fcn.00555904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7f9851
lea eax, [ebp - 0x2d0]
mov edx, 5
call fcn.0040a7f0
lea eax, [ebp - 4]
call fcn.0040a790
ret
Function at 0x81db5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x81dcb5
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x81dc9a
mov eax, ebx
test eax, eax
je 0x81db95
sub eax, 4
mov eax, dword [eax]
jmp 0x81db97
xor eax, eax
mov edi, eax
test ebx, ebx
je 0x81dba7
mov eax, ebx
sub eax, 0xa
movzx eax, word [eax]
jmp 0x81dbab
mov ax, 2
cmp ax, 1
jne 0x81dc2c
test ebx, ebx
je 0x81dbbf
mov eax, ebx
sub eax, 0xc
movzx eax, word [eax]
jmp 0x81dbc7
mov eax, dword [0x8c13a4]
movzx eax, word [eax]
push edi
push 0
push 0
movzx eax, ax
mov ecx, ebx
xor edx, edx
call fcn.004102e8
mov edi, eax
cmp edi, 0x100
jle 0x81dbef
mov eax, edi
add eax, eax
call fcn.004070f4
mov esi, eax
jmp 0x81dbf5
lea esi, [ebp - 0x200]
test ebx, ebx
je 0x81dc03
mov eax, ebx
sub eax, 0xc
movzx edx, word [eax]
jmp 0x81dc0c
mov edx, dword [0x8c13a4]
movzx edx, word [edx]
mov eax, ebx
test eax, eax
je 0x81dc19
sub eax, 4
mov eax, dword [eax]
jmp 0x81dc1b
xor eax, eax
push eax
push esi
push edi
movzx eax, dx
mov ecx, ebx
xor edx, edx
call fcn.004102e8
jmp 0x81dc65
cmp edi, 0x100
jle 0x81dc41
mov eax, edi
add eax, eax
call fcn.004070f4
mov esi, eax
jmp 0x81dc47
lea esi, [ebp - 0x200]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00423620
mov eax, dword [ebp - 0x204]
mov ecx, edi
add ecx, ecx
mov edx, esi
call fcn.00407394
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x81dc87
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x81dc71
lea eax, [ebp - 0x200]
cmp esi, eax
je 0x81dc9c
mov eax, esi
call fcn.00407110
jmp 0x81dc9c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x81dcbc
lea eax, [ebp - 0x204]
call fcn.0040a790
ret