joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7dd73fe5
Capabilities:
Read file on windows

Disassembly:
push 0xc
push 0x7dd74048
call fcn.7dd715c0
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x7dd73ffb
and dword [edi], 0
mov esi, dword [ebp + 8]
cmp esi, 0xfffffff4
je 0x7dd9f14e
cmp esi, 0xfffffff5
je 0x7dd9f13a
cmp esi, 0xfffffff6
je 0x7dd9f126
mov eax, esi
and eax, 0x10000003
cmp eax, 3
je 0x7dd9f162
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.API_MS_Win_Core_File_L1_1_0.dll_ReadFile
call fcn.7dd71605
ret 0x14
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x18]
jmp 0x7dd74019
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x1c]
jmp 0x7dd74019
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x20]
jmp 0x7dd74019
push 0
push edi
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push ebx
push esi
call sym.KERNEL32.dll_ReadConsoleA
test eax, eax
je 0x7dd9f1dc
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x14]
push eax
push esi
call sym.KERNEL32.dll_GetConsoleMode
test eax, eax
jne 0x7dd9f18b
and dword [ebp + 0x14], eax
test byte [ebp + 0x14], 1
je 0x7dd9f1c6
and dword [ebp - 4], 0
cmp byte [ebx], 0x1a
jne 0x7dd9f1bf
and dword [edi], 0
jmp 0x7dd9f1bf
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp + 0x10], 0
jl 0x7dd9f1d4
xor eax, eax
inc eax
jmp 0x7dd74039
push dword [ebp + 0x10]
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7dd74039

Function at 0x7dd7445e
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x7dd7446b
jmp dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_ResumeThread]

Function at 0x7dd748d7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x7dd748fc
push 0x7dd74910
push dword [ebp + 8]
call sub.ntdll.dll__strcmpi
pop ecx
pop ecx
test eax, eax
je 0x7dda3876
push 0
push 0
push dword [ebp + 8]
call fcn.7dd747fd
pop edi
pop esi
pop ebx
pop ebp
ret 4
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov ecx, dword fs:[0x18]
mov esi, 0x104
push esi
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x7dd748fc
lea ebx, [esi - 0xd]
push ebx
push edi
call fcn.7dd92c47
test eax, eax
je 0x7dda38ed
cmp eax, ebx
jae 0x7dda38ed
push 0xd
push 0x7dda3908
push esi
push edi
call sub.ntdll.dll_strncat_s
add esp, 0x10
push edi
call sym.KERNEL32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x7dda38ed
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
jmp 0x7dd74908
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7dd748fc
Function at 0x7dd74be4
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
je 0x7dd74c14
mov ecx, dword [ebp + 8]
and dword [eax], 0
and dword [eax + 4], 0
and dword [eax + 0xc], 0
mov dword [eax + 8], ecx
pop ebp
ret 4
Function at 0x7dd7628b
Capabilities:
Access pe header

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x7dd7cbdd
mov ecx, 0x8000
test word [eax + 0x5e], cx
je 0x7dd7cbdd
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x7dd7632b
Capabilities:
Access peb ldr_data

Disassembly:
cmp byte [0x7de40003], 0
jne 0x7dd763c0
push esi
push edi
push 0x7de40120
call dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
mov eax, dword fs:[0x18]
mov byte [0x7de40003], 1
mov edi, dword [eax + 0x30]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0xc]
mov si, word [eax + 0x2c]
shr si, 1
mov word [0x7de40008], si
movzx ecx, word [eax + 0x2c]
push ecx
push dword [eax + 0x30]
push 0x7de407c0
call sub.ntdll.dll_memcpy
movzx eax, si
xor ecx, ecx
mov word [eax*2 + 0x7de407c0], cx
mov eax, dword [edi + 0x10]
mov si, word [eax + 0x24]
shr si, 1
mov word [0x7de40006], si
mov edi, dword [edi + 0x10]
movzx eax, word [edi + 0x24]
push eax
push dword [edi + 0x28]
push 0x7de409c0
call sub.ntdll.dll_memcpy
add esp, 0x18
movzx eax, si
xor ecx, ecx
pop edi
mov word [eax*2 + 0x7de409c0], cx
pop esi
ret

Function at 0x7dd76cc3
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp byte [0x7ffe02ec], bl
jne 0x7dd76d49
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
test byte [eax + 3], 2
jne 0x7dd76d49
lea eax, [ebp - 8]
push eax
call fcn.7dd76ddf
test eax, eax
je 0x7dd76cf7
cmp dword [ebp - 8], ebx
jne 0x7dd76d49
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x7dd76d70
push 0x80000002
call sym.KERNEL32.dll_RegOpenKeyExW
test eax, eax
jne 0x7dd76d49
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10
push 0x7dd76d4c
push ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call sym.KERNEL32.dll_RegGetValueW
test eax, eax
jne 0x7dd76d41
cmp dword [ebp - 0x10], ebx
jne 0x7dd9de8f
push dword [ebp - 4]
call sym.KERNEL32.dll_RegCloseKey
pop ebx
leave
ret
push dword [ebp - 4]
call fcn.7dde3af1
jmp 0x7dd76d41

Function at 0x7dd776bd
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x7ddac8db
push edi
push esi
push esi
push esi
push 2
push esi
push ebx
call fcn.7dd718ce
mov edi, eax
cmp edi, esi
je 0x7ddac8e2
push esi
push esi
push esi
push 4
push edi
call fcn.7dd718b6
cmp eax, esi
je 0x7dd77717
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dword [ecx], eax
inc esi
push edi
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push ebx
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
xor eax, eax
jmp 0x7dd77726
push ebx
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
xor eax, eax
jmp 0x7dd77725
Function at 0x7dd77a47
Capabilities:
Terminate thread

Disassembly:
jmp dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_TerminateThread]
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x7dd779de
Function at 0x7dd781a4
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.ntdll.dll_NtQueryKey]
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp eax, 0x80000005
je 0x7ddb175c
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
cmp dword [ebp + 0x18], 0
je 0x7ddb1775
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x10]
movzx edx, word [ebp + 0x1c]
inc ecx
inc ecx
cmp edx, ecx
jb 0x7dd781d1
mov eax, dword fs:[0x18]
push dword [ebp + 0x14]
mov eax, dword [eax + 0x30]
mov ebx, dword [ebp + 0x14]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi], eax
test eax, eax
jne 0x7ddb179f
mov eax, 0xc0000017
jmp 0x7dd781d1
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
push 2
push dword [ebp + 8]
call edi
jmp 0x7dd781d1
Function at 0x7dd78f1d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [edi], ebx
mov esi, dword [0x7de40c7c]
mov dword [ebp - 0x1c], ebx
cmp esi, 0xffffffff
jne 0x7dd78fc3
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x7dd78fc8
lea eax, [ebp - 0x24]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
push 0x20019
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x30], 0x40
mov dword [ebp - 0x34], ecx
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test ebx, ebx
jge 0x7dda5c72
cmp ebx, 0xc0000034
jne 0x7dda5c67
xor ebx, ebx
cmp dword [ebp - 0x1c], 0
jne 0x7dda5cdb
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret 4
je 0x7dd78fa0
jmp 0x7dd78fa2
mov dword [edi], esi
jmp 0x7dd78fa2
cmp ebx, 0xc000003a
jmp 0x7dd78fbf
push 0x7dda5cec
lea eax, [ebp - 0x24]
push eax
call esi
lea eax, [ebp - 0x40]
push eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test ebx, ebx
jge 0x7dda5ca7
cmp ebx, 0xc0000034
jmp 0x7dd78fbf
cmp dword [ebp - 0x14], 4
jne 0x7dda5cbb
cmp dword [ebp - 0x10], 4
jne 0x7dda5cbb
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x7dda5cbe
xor esi, esi
inc esi
push 0xffffffffffffffff
push esi
push 0x7de40c7c
call fcn.7dd7138c
cmp eax, 0xffffffff
je 0x7dd78fc3
mov esi, eax
jmp 0x7dd78fc3
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x7dd78fac
Function at 0x7dd7cc96
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x7dd7cdf0
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov esi, 0x224
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x7dd7cd7f
cmp ebx, eax
je 0x7dd7cda4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20019
lea eax, [ebp - 4]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x24], ecx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x7dd7cd7f
push 0x7dd7cdd4
lea eax, [ebp - 0x14]
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jge 0x7dda51c8
push 0x7dd7cdb8
lea eax, [ebp - 0x14]
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x7dd7cdae
cmp dword [ebx + 4], 4
jne 0x7dd7cdae
mov al, byte [ebx + 0xc]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
je 0x7dd7cda4
push esi
push 0
push ebx
call sub.ntdll.dll_memset
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add esp, 0xc
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp + 8]
mov byte [eax], 0
jmp 0x7dd7cd76
cmp dword [ebx + 4], 4
jne 0x7dd7cd44
cmp dword [ebx + 0xc], 0
je 0x7dd7cd44
mov dword [ebp - 8], 1
jmp 0x7dd7cd44
Function at 0x7dd7d2f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.7dd7ce7b

Function at 0x7dd7d41e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x2c], 0
jne 0x7ddb2c58
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.7dd71442
leave
ret
push esi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov esi, 0x400
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.7de1ad4b
test eax, eax
jge 0x7ddb2c7d
cmp eax, 0x8007007a
jne 0x7ddb2cb9
lea eax, [ebp - 0x408]
push eax
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.7de1da5b
test eax, eax
jl 0x7ddb2cb9
mov eax, dword [ebp - 0x408]
test eax, eax
jbe 0x7ddb2cb9
push 0
lea ecx, [ebp - 0x408]
push ecx
inc eax
push eax
lea eax, [ebp - 0x404]
push eax
push dword [edi + 0x2c]
call sub.API_MS_Win_Core_File_L1_1_0.dll_WriteFile
pop esi
jmp 0x7dd7d441

Function at 0x7dd7d5de
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x41c]
call fcn.7dd7d5cf
mov eax, dword [esi + 0x1c]
cmp eax, 1
je 0x7ddb2cbf
lea ecx, [ebp - 0x41c]
call fcn.7dd7d675
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
cmp eax, 1
jne 0x7ddb2cc6
mov ebx, 0x80081d4c
lea ecx, [ebp - 0x41c]
call fcn.7dd7d64d
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret
xor ebx, ebx
jmp 0x7dd7d62d
lea ecx, [ebp - 0x41c]
call fcn.7de1f185
push eax
xor ebx, ebx
push ebx
push 1
call fcn.7dd7493a
mov dword [esi + 0x18], eax
cmp eax, ebx
jne 0x7ddb2ced
mov ebx, 0x8007000e
jmp 0x7dd7d62d
push 0xc54
push ebx
push eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 0x28], eax
cmp eax, ebx
jne 0x7ddb2d0a
mov ecx, esi
call fcn.7de1d77f
jmp 0x7ddb2ce3
push dword [esi + 0x18]
mov ecx, eax
call fcn.7de1de99
lea ecx, [ebp - 0x41c]
call fcn.7de1f305
test eax, eax
je 0x7ddb2ddc
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x7ddb2e1c
call sub.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_GetEnvironmentVariableW
cmp eax, ebx
je 0x7ddb2d47
cmp eax, edi
jb 0x7ddb2d54
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.KERNEL32.dll_GetTempPathW
dec eax
cmp eax, 0x102
ja 0x7ddb2ddb
push 0x7ddb2de8
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.7de1d9e5
test eax, eax
jl 0x7ddb2ddb
push ebx
push 0x80
push 4
push ebx
push 7
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov dword [esi + 0x2c], eax
cmp eax, ebx
je 0x7ddb2ddb
push 2
push ebx
push ebx
push eax
call fcn.7dd7168a
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x41c]
call fcn.7de1f1c5
xor eax, eax
mov word [ebp - 0x20e], ax
lea eax, [ebp - 0x414]
push eax
call fcn.7dd717e0
push eax
call fcn.7dd7502e
push eax
push 0x7ddb2e04
push esi
call fcn.7dd7d41e
add esp, 0x10
pop edi
mov dword [esi + 0x1c], 1
jmp 0x7dd7d62d
Function at 0x7dd7d72d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
and dword [esi], 0
push edi
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0x13
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x7dd7d784
cmp dword [ebp - 0x14], 4
jne 0x7dd7d784
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.7dd71442
leave
ret 0xc

Function at 0x7dd7d894
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x7dd7dc33
push 5
push 0x18
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi]
call sub.ntdll.dll_NtQueryInformationFile
mov edi, eax
cmp edi, ebx
jl 0x7ddb2b98
cmp dword [ebp - 0x2c], ebx
jl 0x7dd7d8e1
jg 0x7dd7dc83
cmp dword [ebp - 0x30], 0x800000
ja 0x7dd7dc83
lea edx, [esi + 8]
mov dword [ebp + 0x10], edx
cmp dword [edx], ebx
je 0x7ddb2bb3
mov ecx, dword [esi]
mov eax, dword [ebp + 0x14]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov byte [eax + 1], 1
mov byte [eax], 1
mov ecx, dword [ecx]
mov esi, dword [ecx]
mov dword [eax + 4], esi
mov ecx, dword [ecx + 4]
mov dword [eax + 8], ecx
mov byte [eax + 2], 3
mov ecx, dword [edx]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ecx
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push 0x60
push 5
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0x18
push esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 0x40
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call sub.ntdll.dll_NtOpenFile
mov edi, eax
cmp edi, ebx
jge 0x7dd7d8ac
cmp edi, 0xc0000034
je 0x7dd7d925
jmp 0x7ddb2b32
mov edi, 0xc0150022
jmp 0x7dd7d925
cmp edi, 0xc0000089
je 0x7dd7d925
cmp edi, 0xc000008a
je 0x7dd7d925
cmp edi, 0xc000008b
je 0x7dd7d925
cmp edi, 0xc0000204
je 0x7dd7d925
cmp edi, 0xc0150002
je 0x7dd7d925
cmp edi, 0xc000000f
je 0x7dd7d925
push edi
push dword [ebp - 0x18]
push 0x7ddb2c1c
push 0x7dde3744
push ebx
push 0x33
call sub.ntdll.dll_DbgPrintEx
add esp, 0x18
jmp 0x7dd7d925
push edi
push 0x7ddb2c1c
push 0x7ddb2be4
push ebx
push 0x33
call sub.ntdll.dll_DbgPrintEx
add esp, 0x14
jmp 0x7dd7d925
push dword [esi]
push 0x8000000
push 2
push ebx
push ebx
push 4
push edx
call sub.ntdll.dll_NtCreateSection
mov edi, eax
cmp edi, ebx
jge 0x7ddb2bd9
push edi
push 0x7ddb2c1c
push 0x7ddb3700
jmp 0x7ddb2ba3
mov edx, dword [ebp + 0x10]
jmp 0x7dd7d8ef
Function at 0x7dd7f36f
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x7dd7f410
cmp dword [esi + 0x20], ebx
je 0x7dd7f3ba
cmp dword [esi + 0x2c], 0xffffffff
push edi
jne 0x7dd9643f
push 0x8000
lea edi, [esi + 0x28]
push edi
lea eax, [esi + 0x20]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov dword [edi], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
pop edi
cmp byte [esi + 0x1a], bl
je 0x7dd7f3e8
push dword [0x7de402e8]
or dword [ebp - 0xc], 0xffffffff
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push dword [esi + 0x14]
call dword [sym.imp.ntdll.dll_NtUnlockFile]
push dword [esi + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 4], ebx
jl 0x7dd7f3f9
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
push esi
mov dword [esi + 0x14], ebx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
cmp byte [esi + 0x18], bl
je 0x7dd7f39c
mov dword [ebp - 0x10], ebx
mov eax, dword [esi + 0x2c]
push 0x7de402e8
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x30]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [esi + 0x20]
sub edi, eax
push edi
add ecx, eax
push ecx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push dword [esi + 0x14]
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x7dd7f39c
cmp dword [ebp - 0x18], edi
jne 0x7dd9e2e5
mov eax, dword [esi + 0x1c]
push 0x14
mov dword [ebp - 0xc], eax
push 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 8], ebx
push dword [esi + 0x14]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 4], eax
jmp 0x7dd7f39c
mov dword [ebp - 4], 0xc000007f
jmp 0x7dd7f39c

Function at 0x7dd7fa9b
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtEnumerateKey]
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [esi + 4]
push edi
push 0x120
lea eax, [esi + 0x10]
push eax
push 1
push dword [esi + 8]
mov dword [ebp + 0xc], eax
push dword [ebp + 8]
call ebx
cmp eax, 0x80000005
je 0x7ddb12fc
test eax, eax
jl 0x7dd7fadc
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword fs:[0x18]
push dword [edi]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x7ddb1323
mov eax, 0xc0000017
jmp 0x7dd7fadc
push edi
push dword [edi]
push eax
push 1
push dword [esi + 8]
push dword [ebp + 8]
call ebx
jmp 0x7dd7fad1
Function at 0x7dd80575
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
je 0x7dd80aa0
cmp dword [ebp + 0x10], esi
je 0x7dd80aa0
mov eax, dword [ebp + 0x14]
cmp eax, esi
jne 0x7ddaea49
mov edi, dword [ebp + 8]
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, esi
jl 0x7ddaea54
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 4]
shr eax, 1
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x7ddaea5f
push edi
call fcn.7dd74298
mov esi, dword [sym.imp.ntdll.dll__wcsicmp]
push 0x7dd80028
push edi
mov ebx, eax
call esi
push 0x7dd80014
push edi
mov dword [ebp + 8], eax
call esi
add esp, 0x10
cmp ebx, 4
je 0x7ddaea66
cmp word [ebp - 8], 6
je 0x7dd80a77
cmp word [ebp - 8], 0xe
je 0x7ddaeac1
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push ebx
push edi
call fcn.7dd80210
mov esi, eax
test esi, esi
je 0x7ddaea9b
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0x3a
jne 0x7dd8060c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.7dd80210
mov esi, eax
test esi, esi
jne 0x7dd80623
jmp 0x7ddaeb0b
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd80623
mov dword [eax], 1
jmp 0x7dd8059e
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd80623
push 0xc0000033
jmp 0x7ddaea55
cmp dword [ebp + 8], 0
je 0x7dd805f6
test eax, eax
je 0x7dd805f6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.7dd80631
mov esi, eax
test esi, esi
jne 0x7dd80623
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddaeb14
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
call fcn.7dd80631
mov esi, eax
test esi, esi
je 0x7dd80623
push dword [ebp + 0x10]
push ebx
push ebx
call fcn.7dd80210
jmp 0x7dd80623
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x7dd8060c
cmp word [eax + 2], 0x5c
jne 0x7dd8060c
movzx ecx, word [eax + 4]
cmp cx, 0x2e
je 0x7ddaeaed
cmp cx, 0x3f
jne 0x7dd8060c
cmp word [eax + 6], 0x5c
jne 0x7dd8060c
cmp word [eax + 0xa], 0x3a
jne 0x7dd8060c
add edi, 8
jmp 0x7dd80a85
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x7ddaeb14
and dword [eax], esi
cmp dword [ebp + 0x10], 1
jb 0x7dd80623
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov word [ecx], ax
jmp 0x7dd80623