joyce8/EMBER2024-capa huggingface dataset:
Function at 0xde5310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.00df1145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0xde53ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0xde538d
lea eax, [esp + 0x18]
push eax
jmp 0xde5392
push 0xe0a720
call fcn.00df0fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0xde5360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0xde4f40
push 4
push ecx
push eax
call fcn.00df143f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0xde6f20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0xde6fd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0xde6fcf
push ebx
push edi
push 0xe0a770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0xde6fae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0xe0a770
push esi
call ebx
test eax, eax
je 0xde6fae
mov ebp, 3
cmp dword [0xe0a774], ebp
jne 0xde6faa
push 0x3e8
call edi
push 0xe0a770
push esi
call ebx
test eax, eax
jne 0xde6f8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0xde6fc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0xde6fbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret
Function at 0xdeae00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0xe008f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0xdeaed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.00de77a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0xdeae61
mov edx, dword [eax]
jmp 0xdeae63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00de9050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0xdeaebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xdeaebf
cmp esi, edi
je 0xdeaebf
mov ecx, esi
call fcn.00de2a00
push esi
call fcn.00df01c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00de7990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0xdeaef5
mov eax, dword [eax]
jmp 0xdeaef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00de6640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0xdeaf25
mov eax, dword [eax]
jmp 0xdeaf27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0xdeaf76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0xdeaf76
cmp esi, edi
je 0xdeaf76
mov eax, dword [esi]
cmp eax, edi
je 0xdeaf5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0xdeaf6d
push eax
call fcn.00df01c8
add esp, 4
push esi
call fcn.00df01c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xdeaf90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xdeaffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xdeb035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00deae00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xdeafc5
mov edi, 0xe058b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xdeb035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00deae00
add edi, 4
add esp, 0xc
cmp edi, 0xe058c0
jb 0xdeb000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xdeb070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00df1082
mov esi, eax
add esp, 8
test esi, esi
je 0xdeb107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xdeb102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00df0946
add esp, 8
test eax, eax
je 0xdeb0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xdeb0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00df0946
add esp, 8
test eax, eax
jne 0xdeb0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xdeb102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xdebf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xe009fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xdec002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00defdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xdec002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00de76e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00df020b
push 0x10
call fcn.00df01d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xdebfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00ddc1c0
jmp 0xdebfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00debb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xdebff0
mov ecx, edi
call fcn.00ddc2c0
push edi
call fcn.00df01c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xdec021
inc ebx
cmp ebx, 0x20
jb 0xdebf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xded250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe01808
push 0xdf1288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xded329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xded329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00df01d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xded329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xded329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xded32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00ded351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xdedd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xdedd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xdedd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xdedd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xdedd94
push eax
push esi
call fcn.00df020b
add esp, 8
pop esi
ret 0x10

Function at 0xdedda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xdede22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xdede15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xe06320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00defdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xdeddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xdede30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xdedec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xdedeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xe06320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00defdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xdedeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xdede6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xdee000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xdee131
push esi
call fcn.00df1145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00de0080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xdee131
push 0
push ebp
call fcn.00de03a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00de0260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xdee08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00de02f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xdee121
push 0xe06918
push edi
call fcn.00def3f0
push eax
push ebx
push esi
call fcn.00dedf60
push 0xe068f8
push edi
call fcn.00def3f0
push eax
push ebx
push esi
call fcn.00dedf60
push 0xe068d8
push edi
call fcn.00def3f0
push eax
push ebx
push esi
call fcn.00dedf60
push 0xe068c0
push edi
call fcn.00def3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00dedf60
push 0xe068a0
push edi
call fcn.00def3f0
push eax
push ebx
push esi
call fcn.00dedf60
push 0xe06888
push edi
call fcn.00def3f0
push eax
push ebx
push esi
call fcn.00dedf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xdef1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00def140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00def140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00def140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00def140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xdefbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xdefc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe0187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xdefc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xdefc52
xor eax, eax
pop esi
leave
ret 4
Function at 0xf005095
Capabilities:
Accept command line arguments

Disassembly:
call fcn.0f00561c
jmp 0xf00560d
push 0xac
push 0xf06dc48
call fcn.0f007648
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0xf0054a4
mov eax, 0xff
jmp 0xf005602
mov ecx, dword [ebp - 0xa4]
and ecx, 0x7fff
mov edi, dword [ebp - 0xa0]
cmp edi, 2
je 0xf0054c1
or ecx, 0x8000
mov edx, dword [ebp - 0xac]
mov eax, edx
shl eax, 8
mov esi, dword [ebp - 0xa8]
add eax, esi
mov dword [0xf0777c0], edi
mov dword [0xf0777c8], eax
mov dword [0xf0777cc], edx
mov dword [0xf0777d0], esi
mov dword [0xf0777c4], ecx
call fcn.0f005424
mov dword [ebp - 0xb8], eax
push 1
call fcn.0f0075e0
pop ecx
test eax, eax
jne 0xf005510
push 0x1c
call fcn.0f0053f6
pop ecx
call fcn.0f0073ff
test eax, eax
jne 0xf005521
push 0x10
call fcn.0f0053f6
pop ecx
and dword [ebp - 4], 0
call fcn.0f006d86
test eax, eax
jge 0xf005536
push 0x1b
call fcn.0f0061e2
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0xf08bfe8], eax
call fcn.0f006c4a
mov dword [0xf0777ac], eax
call fcn.0f006b56
test eax, eax
jge 0xf00555c
push 8
call fcn.0f0061e2
pop ecx
call fcn.0f006838
test eax, eax
jge 0xf00556d
push 9
call fcn.0f0061e2
pop ecx
push 1
call fcn.0f006306
pop ecx
test eax, eax
je 0xf005580
push eax
call fcn.0f0061e2
pop ecx
mov eax, dword [0xf0777e0]
mov dword [0xf0777e4], eax
push eax
push dword [0xf0777d8]
push dword [0xf0777d4]
call fcn.0f005325
add esp, 0xc
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb8], 0
jne 0xf0055b4
push eax
call fcn.0f006466
call fcn.0f00649c
jmp 0xf0055f5
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0xb4]
call fcn.0f007690
ret
call fcn.0f00561c
jmp 0xf005470

Function at 0xf0050a4
Capabilities:
Check processdebugport

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0
push 4
lea eax, [ebp - 4]
push eax
push 7
push 0xffffffffffffffff
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jl 0xf0050cb
cmp dword [ebp - 4], 0
je 0xf0050cb
call dword [sym.imp.KERNEL32.dll_DebugBreak]
leave
ret
Function at 0xf005235
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0x430], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword fs:[0x18]
shl eax, 0x10
or eax, 0x800006d8
mov dword [ecx + 0xf18], eax
push 0xf001610
lea eax, [ebp - 0x454]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
lea eax, [ebp - 0x454]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x44c]
push eax
push 0x20019
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x44c], 0x18
mov dword [ebp - 0x448], edi
mov dword [ebp - 0x440], 0x40
mov dword [ebp - 0x43c], edi
mov dword [ebp - 0x438], edi
call sub.ntdll.dll_NtOpenKey
test eax, eax
jl 0xf005313
push esi
mov esi, 0x428
jmp 0xf0052e6
lea eax, [ebp - 0x42c]
push eax
call fcn.0f0050d2
test al, al
je 0xf005307
inc edi
lea eax, [ebp - 0x434]
push eax
push esi
lea eax, [ebp - 0x42c]
push eax
push 1
push edi
push dword [ebp - 0x430]
call sub.ntdll.dll_NtEnumerateValueKey
test eax, eax
jge 0xf0052d5
push dword [ebp - 0x430]
call sub.ntdll.dll_NtClose
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0f0057d5
leave
ret
Function at 0xf00650b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0xf072298]
je 0xf006531
inc esi
mov dword [ebp - 4], esi
cmp esi, 0x17
jb 0xf00651f
cmp esi, 0x17
jae 0xf00668b
push 3
call fcn.0f00a399
pop ecx
cmp eax, 1
je 0xf006655
push 3
call fcn.0f00a399
pop ecx
test eax, eax
jne 0xf006564
cmp dword [0xf072004], 1
je 0xf006655
cmp edi, 0xfc
je 0xf00668b
push 0xf001c54
mov edi, 0x314
push edi
mov esi, 0xf077808
push esi
call fcn.0f00a32c
add esp, 0xc
test eax, eax
je 0xf00659a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0f009383
add esp, 0x14
mov byte [0xf077925], bl
push 0x104
mov ebx, 0xf077821
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0xf0065dd
push 0xf001c3c
push 0x2fb
push ebx
call fcn.0f00a32c
add esp, 0xc
test eax, eax
je 0xf0065dd
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0f009383
add esp, 0x14
push ebx
push edi
push esi
call fcn.0f00a2b3
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0xf0065fb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0f009383
add esp, 0x14
push 0xf001c38
push edi
push esi
call fcn.0f00a2b3
add esp, 0xc
test eax, eax
je 0xf00661b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0f009383
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0xf07229c]
push edi
push esi
call fcn.0f00a2b3
add esp, 0xc
test eax, eax
je 0xf006640
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0f009383
add esp, 0x14
push 0x12010
push 0xf001c10
push esi
call fcn.0f00a10c
add esp, 0xc
jmp 0xf00668b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0xf00668b
cmp edi, 0xffffffff
je 0xf00668b
mov edx, dword [esi*8 + 0xf07229c]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xf006674
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0xf0073ff
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0xf001c80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0xf007451
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xf001cec
push edi
call esi
push 0xf001ce0
push edi
mov dword [0xf077c2c], eax
call esi
push 0xf001cd4
push edi
mov dword [0xf077c30], eax
call esi
push 0xf001ccc
push edi
mov dword [0xf077c34], eax
call esi
mov dword [0xf077c38], eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0xf077c2c], ebx
je 0xf007477
cmp dword [0xf077c30], ebx
je 0xf007477
cmp dword [0xf077c34], ebx
je 0xf007477
cmp dword [0xf077c38], ebx
jne 0xf00749b
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0xf077c30], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0xf077c2c], 0xf0070c3
mov dword [0xf077c34], esi
mov dword [0xf077c38], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xf0723fc], eax
cmp eax, 0xffffffff
je 0xf00750e
push dword [0xf077c30]
push eax
call esi
test eax, eax
je 0xf00750e
call fcn.0f0064c4
push dword [0xf077c2c]
call fcn.0f006fc5
push dword [0xf077c30]
mov dword [0xf077c2c], eax
call fcn.0f006fc5
push dword [0xf077c34]
mov dword [0xf077c30], eax
call fcn.0f006fc5
push dword [0xf077c38]
mov dword [0xf077c34], eax
call fcn.0f006fc5
add esp, 0x10
mov dword [0xf077c38], eax
call fcn.0f0076a4
test eax, eax
jne 0xf007514
call fcn.0f007100
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0xf0072af
push dword [0xf077c2c]
call fcn.0f00704b
pop ecx
call eax
mov dword [0xf072400], eax
cmp eax, 0xffffffff
je 0xf007509
push 0x214
push 1
call fcn.0f00a45e
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0xf007509
push esi
push dword [0xf072400]
push dword [0xf077c34]
call fcn.0f00704b
pop ecx
call eax
test eax, eax
jne 0xf007567
push esi
call fcn.0f00996a
pop ecx
jmp 0xf007509
push ebx
push esi
call fcn.0f007142
or dword [esi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0xf007510