joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d22d6e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
call fcn.7d2217b2
mov qword [rsp + 0x30], rax
mov r12, rax
test rax, rax
je 0x7d22d989
xor ebp, ebp
test rsi, rsi
je 0x7d22d72b
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x7d22d720
jmp 0x7d22d72d
mov edi, ebp
lea edx, [rdi*2 + 2]
mov rcx, r12
call fcn.7d221505
mov qword [rsp + 0x98], rax
mov r13, rax
test rax, rax
je 0x7d22d989
mov ecx, edi
mov rdx, rsi
lea rbx, [rcx + rcx]
mov rcx, rax
mov r8, rbx
call sub.ntdll.dll_memcpy
mov word [rbx + r13], bp
or rcx, 0xffffffffffffffff
mov rdx, qword [0x7d2abf60]
cmp word [rdx + rcx*2 + 2], bp
lea rcx, [rcx + 1]
jne 0x7d22d774
lea ebx, [rcx*2 + 2]
mov rcx, r12
mov edx, ebx
call fcn.7d221505
mov qword [rsp + 0x38], rax
mov r15, rax
test rax, rax
je 0x7d22d989
mov rdx, qword [0x7d2abf60]
mov rcx, rax
mov r8d, ebx
call sub.ntdll.dll_memcpy
mov rcx, r15
call sub.ntdll.dll__wcslwr
or r14, 0xffffffffffffffff
nop
inc r14
cmp word [r15 + r14*2], bp
jne 0x7d22d7c0
mov edx, 0x800
mov rcx, r12
call fcn.7d221505
mov rbp, rax
test rax, rax
je 0x7d22d989
mov rdx, qword [rsp + 0x80]
mov r9, rax
mov r8d, 0x20000000
mov dword [rsp + 0x20], 0x7f8
xor ecx, ecx
xor ebx, ebx
call sym.imfsbDll.dll_SbieApi_QueryConf
test eax, eax
js 0x7d22d945
mov eax, 0x2c
inc ebx
mov edx, eax
mov rcx, rbp
mov dword [rsp + 0x90], ebx
call sub.ntdll.dll_wcschr
mov rsi, rax
test rax, rax
je 0x7d22d90e
xor eax, eax
mov word [rsi], ax
cmp word [rbp], 0x2f
jne 0x7d22d851
cmp word [rbp + 2], 0x2f
jne 0x7d22d851
test byte [0x7d2abfa0], 0x20
lea rdx, [rbp + 4]
jne 0x7d22d854
mov rdx, rbp
mov r8b, 1
mov rcx, r12
call fcn.7d22159b
mov r8d, r14d
mov rdx, r15
mov rcx, rax
mov r13, rax
call fcn.7d221037
test al, al
je 0x7d22d906
test edi, edi
je 0x7d22d886
mov eax, 0x2c
mov word [rsi], ax
jmp 0x7d22d88a
add rsi, 2
or rbx, 0xffffffffffffffff
nop
cmp word [rsi + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x7d22d890
mov rcx, qword [rsp + 0x30]
lea r12d, [rbx + rdi]
lea edx, [r12*2 + 2]
call fcn.7d221505
mov r15, rax
test rax, rax
je 0x7d22d989
mov rdx, qword [rsp + 0x98]
mov ecx, edi
lea rdi, [rcx + rcx]
mov rcx, rax
mov r8, rdi
call sub.ntdll.dll_memcpy
lea r8d, [rbx + 1]
mov rdx, rsi
add r8, r8
lea rcx, [rdi + r15]
call sub.ntdll.dll_memcpy
mov ebx, dword [rsp + 0x90]
mov edi, r12d
mov r12, qword [rsp + 0x30]
mov qword [rsp + 0x98], r15
mov r15, qword [rsp + 0x38]
mov rcx, r13
call fcn.7d221974
mov rdx, qword [rsp + 0x80]
mov r8d, ebx
bts r8d, 0x1d
mov dword [rsp + 0x20], 0x7f8
mov r9, rbp
xor ecx, ecx
call sym.imfsbDll.dll_SbieApi_QueryConf
test eax, eax
mov eax, 0x2c
jns 0x7d22d812
mov r13, qword [rsp + 0x98]
lea ecx, [rdi*2 + 2]
call fcn.7d221988
lea r8d, [rdi + 1]
mov rdx, r13
add r8, r8
mov rcx, rax
mov rbx, rax
call sub.ntdll.dll_memcpy
mov rcx, r12
call fcn.7d2217b7
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x7d22e3e0
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22e3e0
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 2
jne 0x7d22e40e
cmp qword [0x7d2abf58], 0
je 0x7d22e504
xor ecx, ecx
call fcn.7d221910
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp edx, 3
jne 0x7d22e423
call fcn.7d22113b
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp edx, 1
jne 0x7d22e4e2
lea rcx, [0x7d2ad920]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, str.DgApi64.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [0x7d2906e0]
mov qword [0x7d2abf50], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LdrFastFailInLoaderCallout
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 8
mov qword [0x7d2abf30], rbx
test rax, rax
mov edx, 0xa
cmovne ecx, edx
mov dword [0x7d2abfb8], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [str.kernel32.dll]
mov qword [0x7d2abf38], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [str.kernelbase.dll]
mov qword [0x7d2abf40], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x7d2abf48], rax
call fcn.7d2215b9
test al, al
jne 0x7d22e504
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test edx, edx
jne 0x7d22e504
cmp byte [0x7d2abfaa], dl
je 0x7d22e504
cmp qword [0x7d2abf58], 0
je 0x7d22e504
mov cl, 1
call fcn.7d221690
call fcn.7d2217a8
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x7d22e560
Capabilities:
Get system information on windows

Disassembly:
jmp 0x7d22e560
sub rsp, 0x28
call fcn.7d2218ca
call fcn.7d22141a
call fcn.7d22136b
mov cl, 1
call fcn.7d221451
call fcn.7d221410
call fcn.7d2215d2
cmp dword [0x7d2abfb4], 0x2580
jb 0x7d22e59c
mov rcx, qword [0x7d2abf48]
call fcn.7d221537
mov cl, 1
add rsp, 0x28
jmp sym.imfsbDll.dll_SbieDll_StartCOM
Function at 0x7d22eb30
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rdi
xor edi, edi
cmp qword [str.imfsbRpcSs.exe], rdi
je 0x7d22eba0
mov qword [rsp + 0x30], rbx
mov ebx, edi
mov qword [rsp + 0x38], rsi
lea rsi, str.imfsbRpcSs.exe
mov rax, rsi
nop word [rax + rax]
mov rdx, qword [rax]
mov rcx, qword [0x7d2abf60]
call sub.ntdll.dll__wcsicmp
test eax, eax
je 0x7d22eb87
add rbx, 2
add edi, 2
cmp qword [rsi + rbx*8], 0
lea rax, [rsi + rbx*8]
jne 0x7d22eb60
jmp 0x7d22eb96
lea eax, [rdi + 1]
movsxd rcx, eax
mov eax, dword [rsi + rcx*8]
mov dword [0x7d2abfb0], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
cmp dword [0x7d2abfb0], 0
mov rdi, qword [rsp + 0x20]
jne 0x7d22ebd7
mov rcx, qword [0x7d2abf60]
lea rdx, str.FlashPlayerPlugin_
mov r8d, 0x12
call sub.ntdll.dll__wcsnicmp
test eax, eax
jne 0x7d22ebd7
mov dword [0x7d2abfb0], 0x1a
jmp 0x7d22ec53
cmp dword [0x7d2abfb0], 0x12
jne 0x7d22ec0b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
je 0x7d22ec0b
lea rdx, str.3EB3C877_1F16_487C_9050_104DBCD66683
mov rcx, rax
call sub.ntdll.dll_wcsstr
test rax, rax
je 0x7d22ec0b
mov dword [0x7d2abfb0], 0x13
jmp 0x7d22ec53
cmp dword [0x7d2abfb0], 0
jne 0x7d22ec53
mov rcx, qword [0x7d2abf60]
lea rdx, str.SchTasks.exe
call sub.ntdll.dll__wcsicmp
test eax, eax
je 0x7d22ec42
mov rcx, qword [0x7d2abf60]
lea rdx, str.cvh.exe
call sub.ntdll.dll__wcsicmp
test eax, eax
jne 0x7d22ec53
mov rdx, qword [0x7d2abf60]
mov ecx, 0x89d
call sym.imfsbDll.dll_SbieApi_Log
xor ecx, ecx
call fcn.7d22127b
mov byte [0x7d2abfab], al
test al, al
je 0x7d22ec80
mov eax, dword [0x7d2abfb0]
cmp eax, 0x1a
ja 0x7d22ec80
mov ecx, 0x4a00000
bt ecx, eax
jae 0x7d22ec80
mov byte [0x7d2abfac], 1
xor ecx, ecx
add rsp, 0x28
jmp fcn.7d2215e6

Function at 0x7d22ecf0
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22ecf0
push rbx
sub rsp, 0x20
lea ebx, [rcx + 8]
mov rcx, qword [0x7d2ac000]
mov edx, ebx
call fcn.7d221505
mov rcx, rax
test rax, rax
jne 0x7d22ed34
cmp qword [0x7d2abf58], rax
jne 0x7d22ed1e
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, ebx
mov qword [rcx], rax
lea rax, [rcx + 8]
add rsp, 0x20
pop rbx
ret

Function at 0x7d22ed60
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22ed60
sub rsp, 0x28
mov rcx, qword [0x7d2ac010]
mov edx, 0x80
call fcn.7d221505
test rax, rax
jne 0x7d22ed90
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x28
ret

Function at 0x7d22edb0
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22edb0
push rbx
sub rsp, 0x20
lea ebx, [rcx + 8]
mov rcx, qword [0x7d2ac008]
mov edx, ebx
call fcn.7d221505
mov rcx, rax
test rax, rax
jne 0x7d22edf4
cmp qword [0x7d2abf58], rax
jne 0x7d22edde
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, ebx
mov qword [rcx], rax
lea rax, [rcx + 8]
add rsp, 0x20
pop rbx
ret
Function at 0x7d22ee40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x7d22ee40
sub rsp, 0x28
mov ecx, dword [0x7d2aa49c]
cmp ecx, 0xffffffff
je 0x7d22eeeb
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x7d22eee6
mov ecx, dword [0x7d2aa49c]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ebp, ebp
mov rbx, rsi
mov edi, 0xc
mov rcx, qword [rbx]
test rcx, rcx
je 0x7d22eea5
mov edx, dword [rcx - 8]
add rcx, 0xfffffffffffffff8
call fcn.7d2218de
mov rcx, qword [rbx + 0x60]
mov qword [rbx], rbp
test rcx, rcx
je 0x7d22eebd
mov edx, dword [rcx - 8]
add rcx, 0xfffffffffffffff8
call fcn.7d2218de
mov qword [rbx + 0x60], rbp
add rbx, 8
sub rdi, 1
jne 0x7d22ee91
mov edx, dword [rsi - 8]
lea rcx, [rsi - 8]
call fcn.7d2218de
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x7d22ef20
Capabilities:
Get thread local storage value
Set thread local storage value
Terminate process

Disassembly:
jmp 0x7d22ef20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x7d2aa49c], 0xffffffff
mov rdi, rcx
jne 0x7d22ef4f
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x7d2aa49c]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x7d22efca
mov rcx, qword [0x7d2ac000]
mov edx, 0x1a0
call fcn.7d221505
test rax, rax
jne 0x7d22efa0
cmp qword [0x7d2abf58], rax
je 0x7d22efab
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rax], 0x1a0
lea rbx, [rax + 8]
xor edx, edx
mov r8d, 0x198
mov rcx, rbx
call sub.ntdll.dll_memset
mov ecx, dword [0x7d2aa49c]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x7d22efd9
mov dword [rdi], esi
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7d22f020
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22f020
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r10, dword [rcx + 0x120]
add r8d, 0x103f
mov r9d, edx
and r8d, 0xfffff000
lea rax, [r9 + r9*2]
lea rdx, [r10 + rax*4]
lea rax, [r9 + 4]
lea rax, [rax + rax*2]
lea rdi, [rcx + rdx*8]
lea rdx, [r10 + rax*4]
mov ebp, dword [rcx + rdx*4]
cmp r8d, ebp
jbe 0x7d22f0d4
mov rbx, qword [rdi]
lea esi, [r8 + 8]
mov dword [rcx + rdx*4], r8d
mov edx, esi
mov rcx, qword [0x7d2ac000]
call fcn.7d221505
mov rcx, rax
test rax, rax
jne 0x7d22f0ac
cmp qword [0x7d2abf58], rax
je 0x7d22f0b5
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, esi
mov qword [rcx], rax
add rcx, 8
mov qword [rdi], rcx
test rbx, rbx
je 0x7d22f0d4
mov r8, rbp
mov rdx, rbx
call sub.ntdll.dll_memcpy
mov edx, dword [rbx - 8]
lea rcx, [rbx - 8]
call fcn.7d2218de
mov rax, qword [rdi]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x7d22f200
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22f200
push rbx
sub rsp, 0x20
inc dword [rcx + 0x120]
mov rbx, rcx
mov r8d, dword [rcx + 0x120]
cmp r8d, 8
jle 0x7d22f22d
lea rdx, [0x7d290c74]
mov ecx, 0x906
call sym.imfsbDll.dll_SbieApi_Log
cmp dword [rbx + 0x120], 0xc
jl 0x7d22f240
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x20
pop rbx
ret
Function at 0x7d231bd0
Capabilities:
Query environment variable

Disassembly:
jmp 0x7d231bd0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r9
movzx esi, r8b
movzx edi, dl
mov rbx, rcx
test rcx, rcx
jne 0x7d231c06
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
mov dil, 1
xor r15d, r15d
mov rdx, rbx
mov r10d, r15d
test dil, dil
je 0x7d231c40
cmp word [rbx], r10w
je 0x7d231c6c
nop word [rax + rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], r15w
jne 0x7d231c24
inc ecx
add r10d, ecx
cmp word [rdx + rcx*2], r15w
lea rdx, [rdx + rcx*2]
jne 0x7d231c20
jmp 0x7d231c6c
cmp byte [rbx], r10b
je 0x7d231c6c
nop word [rax + rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], r15b
jne 0x7d231c54
inc ecx
mov eax, ecx
add r10d, ecx
add rdx, rax
cmp byte [rdx], r15b
jne 0x7d231c50
lea ecx, [r10*2 + 0x10]
movzx r8d, sil
lea rdx, [rsp + 0x40]
call fcn.7d231db0
mov rbp, rax
test dil, dil
je 0x7d231cd2
cmp word [rbx], r15w
je 0x7d231d1a
mov rsi, qword [rsp + 0x40]
nop dword [rax]
or rcx, 0xffffffffffffffff
cmp word [rbx + rcx*2 + 2], r15w
lea rcx, [rcx + 1]
jne 0x7d231ca4
lea edi, [rcx + 1]
mov rdx, rbx
add rdi, rdi
mov rcx, rsi
mov r8, rdi
call sub.ntdll.dll_memcpy
add rbx, rdi
add rsi, rdi
cmp word [rbx], r15w
jne 0x7d231ca0
jmp 0x7d231d1f
cmp byte [rbx], r15b
je 0x7d231d1a
mov rsi, qword [rsp + 0x40]
nop dword [rax]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r15b
jne 0x7d231ce4
add eax, 1
je 0x7d231d13
mov ecx, eax
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov word [rsi], ax
add rsi, 2
sub rcx, 1
jne 0x7d231d00
cmp byte [rbx], r15b
jne 0x7d231ce0
jmp 0x7d231d1f
mov rsi, qword [rsp + 0x40]
mov word [rsi], r15w
mov rax, rbp
test r14, r14
je 0x7d231d30
sub esi, ebp
mov dword [r14], esi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x7d233990
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor r14d, r14d
mov r13d, edx
mov byte [rsp + 0x90], r14b
xor edi, edi
movzx r12d, cl
mov esi, 0x40
mov ecx, esi
call fcn.7d2212da
lea r9, [rsp + 0x98]
mov r8d, esi
mov rdx, rax
mov ecx, 0x10
mov rbp, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x7d233a12
mov rcx, rbp
call fcn.7d221938
mov esi, dword [rsp + 0x98]
add esi, 0x40
cmp ebx, 0x80000005
je 0x7d233a0b
cmp ebx, 0xc0000004
je 0x7d233a0b
cmp ebx, 0xc0000023
jne 0x7d233a12
inc edi
cmp edi, 5
jb 0x7d2339b8
cmp ebx, 0xc0000022
jne 0x7d233a44
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], 0x1704
call sym.imfsbDll.dll_SbieDll_CallServer
mov r14, rax
test rax, rax
je 0x7d233b05
xor ebp, ebp
jmp 0x7d233a4c
test ebx, ebx
js 0x7d233b05
mov ecx, 0x400
mov qword [rsp + 0x80], r15
call fcn.7d2212da
mov rbx, qword [0x7d2ac1e8]
mov r15, rax
test rbx, rbx
je 0x7d233adb
nop dword [rax]
mov rdi, qword [rbx]
test r12b, r12b
jne 0x7d233aa8
mov eax, r13d
sub eax, dword [rbx + 0x10]
cmp eax, 0x3e8
jb 0x7d233ad3
lea rax, [rsp + 0x90]
mov r9, r14
lea rcx, [rbx + 0x18]
mov qword [rsp + 0x20], rax
mov r8, rbp
mov rdx, r15
call fcn.7d233b80
test eax, eax
jne 0x7d233ad3
mov edx, 0x3a
lea rcx, [rbx + 0x18]
call sub.ntdll.dll_wcschr
test rax, rax
jne 0x7d233ac4
lea rcx, [rbx + 0x18]
call fcn.7d22168b
mov rdx, rbx
lea rcx, [0x7d2ac1e8]
call fcn.7d2219c4
mov rbx, rdi
test rdi, rdi
jne 0x7d233a70
mov rcx, r15
call fcn.7d221938
mov r15, qword [rsp + 0x80]
test rbp, rbp
je 0x7d233af8
mov rcx, rbp
call fcn.7d221938
test r14, r14
je 0x7d233b05
mov rcx, r14
call fcn.7d221938
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7d239d50
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
xor eax, eax
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 8], rax
mov rdx, rcx
mov rcx, qword [str.00000000_SBIE_ALL_USERS]
shr esi, 1
sub esi, 8
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
or rdi, 0xffffffffffffffff
cmp word [rbx], 0
je 0x7d239dd0
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x7d239d92
lea ecx, [rax*2 + 2]
mov dword [0x7d2ac148], eax
call fcn.7d221988
mov qword [0x7d2ac140], rax
mov rdx, rbx
sub rax, rbx
nop dword [rax + rax]
movzx ecx, word [rdx]
mov word [rax + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x7d239dc0
mov rcx, qword [str.00000000_SBIE_CURRENT_USER]
xor eax, eax
mov qword [rbx], rax
mov r8d, esi
mov rdx, rbx
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [rbx], 0
je 0x7d239e30
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x7d239df5
lea ecx, [rax*2 + 2]
mov dword [0x7d2ac14c], eax
call fcn.7d221988
mov qword [0x7d2ac150], rax
mov rdx, rbx
sub rax, rbx
nop
movzx ecx, word [rdx]
mov word [rax + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x7d239e20
mov rcx, qword [str.00000000_SBIE_PUBLIC_USER]
xor eax, eax
mov qword [rbx], rax
mov r8d, esi
mov rdx, rbx
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [rbx], 0
je 0x7d239e90
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x7d239e52
lea ecx, [rdi*2 + 2]
mov dword [0x7d2ac160], edi
call fcn.7d221988
mov qword [0x7d2ac158], rax
mov rdx, rbx
sub rax, rbx
nop dword [rax + rax]
movzx ecx, word [rdx]
mov word [rax + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x7d239e80
mov rcx, qword [str.00000000_SBIE_DEVICE_MAP]
xor eax, eax
mov qword [rbx], rax
mov r8d, esi
mov rdx, rbx
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [rbx], 0
je 0x7d239ec3
xor eax, eax
mov rcx, rbx
mov word [rbx + 0xbe], ax
call fcn.7d22133e
mov rcx, qword [str.00000000_SBIE_ALL_USERS]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [str.00000000_SBIE_CURRENT_USER]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [str.00000000_SBIE_PUBLIC_USER]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [str.00000000_SBIE_DEVICE_MAP]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [0x7d2ac148], 0
je 0x7d239f23
cmp dword [0x7d2ac14c], 0
je 0x7d239f23
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x7d23a6b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, r8
lea eax, [r9 - 0x10]
lea r8, [rsp + 0x58]
mov esi, r9d
mov qword [rsp + 0x28], r8
mov r9, rbp
shr esi, 1
mov r8d, 2
sub esi, 8
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edi, eax
test eax, eax
js 0x7d23a75f
mov ecx, dword [rbp + 8]
shr ecx, 1
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0x40], rbx
lea ecx, [rcx*2 + 2]
call fcn.7d2212da
mov r8d, dword [rsp + 0x58]
lea rdx, [rbp + 0xc]
add r8, r8
mov rcx, rax
mov rbx, rax
call sub.ntdll.dll_memcpy
mov ecx, dword [rsp + 0x58]
xor eax, eax
mov r8d, esi
mov rdx, rbp
mov word [rbx + rcx*2], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
mov dword [rsp + 0x58], eax
call fcn.7d221938
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
test eax, eax
je 0x7d23a75a
cmp eax, esi
mov eax, edi
jb 0x7d23a75f
mov eax, 0xc0000106
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x7d23bcd0
Capabilities:
Print debug messages
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x7d23bce8
call qword [0x7d2ac0e0]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x7d23bcf6
call fcn.7d221938
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x7d23bd04
call fcn.7d221938
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x7d23bd12
call fcn.7d2217b7
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x7d23bd24
call qword [0x7d2ac0e0]
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x7d23bd35
call fcn.7d221938
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x7d23bd46
call fcn.7d221938
mov rcx, qword [rbx + 0xd0]
test rcx, rcx
je 0x7d23bd57
call fcn.7d2217b7
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x7d23bd65
call fcn.7d221938
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.7d221938
Function at 0x7d23c3b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push rdi
sub rsp, 0xa8
mov rdi, rcx
xor ecx, ecx
call fcn.7d221744
cmp qword [0x7d2ac1e0], 0
mov rbp, rax
je 0x7d23c646
mov qword [rsp + 0xc0], rbx
lea rcx, [0x7d2ac200]
xor bl, bl
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8, qword [0x7d2ac1e0]
xor edx, edx
cmp qword [r8], 0xffffffffffffffff
je 0x7d23c41e
mov rcx, r8
nop
cmp qword [rcx], rdi
je 0x7d23c414
inc edx
cmp qword [r8 + rdx*8], 0xffffffffffffffff
lea rcx, [r8 + rdx*8]
jne 0x7d23c400
jmp 0x7d23c41e
mov qword [r8 + rdx*8], 0
mov bl, 1
lea rcx, [0x7d2ac200]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x7d23c475
cmp byte [0x7d2abfac], bl
je 0x7d23c63e
mov r9d, 4
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0xd0]
mov rcx, rdi
lea rdx, [rsp + 0x48]
call qword [0x7d2ac0b0]
test eax, eax
js 0x7d23c63e
test byte [rsp + 0xd0], 2
je 0x7d23c63e
mov rcx, rbp
call fcn.7d2214dd
lea rdx, [0x7d28ed18]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0xd0]
mov rcx, rdi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x38]
call fcn.7d2214d3
test eax, eax
js 0x7d23c636
test byte [rsp + 0xd0], 1
je 0x7d23c636
mov rbx, qword [rsp + 0xd8]
mov rcx, rbx
call fcn.7d23a9f0
test al, al
je 0x7d23c636
mov r9d, 0x38
mov dword [rsp + 0x20], 0x22
lea r8, [rsp + 0x60]
mov rcx, rdi
lea rdx, [rsp + 0x48]
call qword [0x7d2ac0b0]
test eax, eax
js 0x7d23c636
cmp qword [rsp + 0x88], 0
je 0x7d23c636
lea rcx, [0x7d2ac200]
mov qword [rsp + 0xa0], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x7d23c535
mov rdi, qword [0x7d2ac1e8]
test rdi, rdi
je 0x7d23c56d
nop dword [rax + rax]
cmp dword [rdi + 0x14], esi
jne 0x7d23c565
lea rcx, [rdi + 0x18]
mov rdx, rbx
call sub.ntdll.dll__wcsicmp
test eax, eax
je 0x7d23c5b5
mov rdi, qword [rdi]
test rdi, rdi
jne 0x7d23c550
lea ecx, [rsi*2 + 0x22]
call fcn.7d221988
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, rdi
mov dword [rdi + 0x10], eax
sub rdx, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
mov word [rdx + rbx + 0x18], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x7d23c590
mov r8, rdi
mov dword [rdi + 0x14], esi
xor edx, edx
lea rcx, [0x7d2ac1e8]
call fcn.7d2214e7
lea rcx, [0x7d2ac200]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0xd0]
call fcn.7d221744
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x7d2ac200]
mov dword [0x7d2ac1a4], eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov rsi, qword [rsp + 0xa0]
test eax, eax
je 0x7d23c629
cmp qword [0x7d2ac1e8], 0
je 0x7d23c61c
mov rcx, rbx
call fcn.7d2214dd
mov edx, edi
mov cl, 1
call fcn.7d233990
mov rcx, rbx
call fcn.7d221884
lea rcx, [0x7d2ac200]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call fcn.7d221884
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa8
pop rdi
pop rbp
ret