joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d262870
Capabilities:
Delete registry value

Disassembly:
jmp 0x7d262870
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
cmp byte [0x7d2abfa8], 0
mov eax, 0x102
mov rbx, rcx
mov esi, 2
mov rbp, r8
mov rdi, rdx
cmovne esi, eax
lea ecx, [rax - 2]
call fcn.7d2212da
movaps xmm0, xmmword [str._registrymachine_softwareclasses_]
mov r9, rax
movups xmmword [rax], xmm0
lea rcx, [rax - 2]
movaps xmm1, xmmword [0x7d295500]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x7d295510]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x7d295520]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x7d295530]
movsd qword [rax + 0x40], xmm0
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d2628f0
xor edx, edx
nop dword [rax]
movzx eax, word [rbx + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x7d262900
lea rcx, [r9 - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d262915
mov eax, dword [0x7d295548]
mov dword [rcx], eax
movzx eax, word [0x7d29554c]
mov word [rcx + 4], ax
lea rax, [r9 - 2]
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x7d262940
xor edx, edx
nop dword [rax]
movzx ecx, word [rdi + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x7d262950
lea rcx, [r9 - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d262965
mov eax, dword [0x7d295550]
mov rdx, r9
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rdx, qword [rsp + 0x28]
lea rax, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rax
mov ecx, 0x6b
mov dword [rsp + 0x30], 0x30
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x48], 0x40
call fcn.7d2211ae
test eax, eax
jne 0x7d262a0d
lea r8, [rsp + 0x30]
mov edx, esi
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x7d262a0d
mov rdx, rbp
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x88]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x7d264190
Capabilities:
Change registry key timestamp

Disassembly:
jmp 0x7d264190
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
call fcn.7d221744
mov r9d, 8
mov dword [rsp + 0x3c], 0x1b01234
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 0xdead44a0
xor edx, edx
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
mov r8b, 1
mov rdx, rsi
mov rcx, rdi
mov ebx, eax
call fcn.7d262aa0
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7d264220
Capabilities:
Change registry key timestamp

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x84]
lea r8, [rsp + 0x78]
mov dword [rsp + 0x7c], eax
mov r9d, 8
mov eax, dword [rsp + 0x80]
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x78], eax
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
cmp eax, 0xc0000022
jne 0x7d2642f1
lea rdx, [0x7d28ed18]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x20]
mov dword [rsp + 0x30], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
mov edx, 2
mov dword [rsp + 0x48], 0x40
lea rcx, [rsp + 0x88]
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x7d2642f1
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x78]
mov r9d, 8
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
mov rcx, qword [rsp + 0x88]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
add rsp, 0x60
pop rbx
ret

Function at 0x7d269040
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x7d269040
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [r8 + 8], 0
mov rbx, r8
mov esi, edx
mov rbp, rcx
je 0x7d2690da
mov ecx, 0x1000
mov dword [rsp + 0x50], 0x1000
call fcn.7d221988
mov r9d, dword [rsp + 0x50]
mov rdi, rax
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x50]
mov r8, rdi
mov qword [rsp + 0x20], rax
mov edx, 3
call qword [sym.imp.ntdll.dll_NtQueryKey]
test eax, eax
js 0x7d269105
mov ecx, dword [rdi]
lea r8, [rdi + 6]
shr rcx, 1
mov eax, 0x5c
mov word [rdi + rcx*2 + 4], ax
lea r8, [r8 + rcx*2]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rax + 8]
nop dword [rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [r8], ax
lea r8, [r8 + 2]
test ax, ax
jne 0x7d2690c0
lea rdx, [rdi + 4]
jmp 0x7d2690e2
mov rax, qword [r8 + 0x10]
mov rdx, qword [rax + 8]
mov ecx, 0x6b
call fcn.7d2211ae
test eax, eax
je 0x7d2690f7
mov eax, 0xc000000a
jmp 0x7d269105
mov r8, rbx
mov edx, esi
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x7d269490
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x60]
xor ebx, ebx
mov r8d, 0x4d5a
mov ecx, ebx
mov rdx, qword [rax + 0x10]
movzx eax, word [rdx]
cmp ax, r8w
je 0x7d2694c2
mov r8d, 0x5a4d
cmp ax, r8w
jne 0x7d2694d9
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x7d2694d9
xor eax, eax
add rsp, 0x40
pop rbx
ret
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0x18]
add rdi, rax
test r8d, r8d
je 0x7d269589
mov rax, qword [str..imrsiv]
nop
movsxd rcx, ebx
lea rdx, [rcx + rcx*4]
cmp qword [rdi + rdx*8], rax
lea rcx, [rdi + rdx*8]
je 0x7d269528
inc ebx
cmp ebx, r8d
jl 0x7d269500
mov eax, 1
mov rdi, qword [rsp + 0x38]
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x50]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov qword [rsp + 0x60], 8
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov r9d, dword [rsp + 0x50]
lea r8, [rsp + 0x60]
movsxd rax, ebx
or rcx, 0xffffffffffffffff
lea rdx, [rax + rax*4]
add byte [rdi + rdx*8 + 1], 0xe0
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov eax, 1
mov rdi, qword [rsp + 0x38]
add rsp, 0x40
pop rbx
ret
Function at 0x7d26a750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r13
sub rsp, 0x58
mov r13, rcx
mov r8, rdx
xor ecx, ecx
mov qword [rsp + 0x88], rcx
or rbp, 0xffffffffffffffff
inc rbp
cmp word [rdx + rbp*2], cx
jne 0x7d26a770
movsxd rax, dword [r13 + 0x3c]
lea rdx, [r13 + 0x18]
add rdx, rax
mov qword [rsp + 0x80], rdx
cmp dword [rdx + 0x6c], ecx
je 0x7d26a8ba
mov eax, dword [rdx + 0x70]
test eax, eax
je 0x7d26a8ba
cmp dword [rdx + 0x74], ecx
je 0x7d26a8ba
mov qword [rsp + 0x38], r12
xor r12d, r12d
mov qword [rsp + 0x28], r15
lea r15, [rax + r13]
mov eax, dword [rax + r13 + 0x20]
add rax, r13
mov qword [rsp + 0x70], rax
cmp dword [r15 + 0x18], ecx
jbe 0x7d26a8b0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], r14
nop word [rax + rax]
mov esi, dword [rax + r12*4]
xor ebx, ebx
add rsi, r13
mov edx, r12d
test ebp, ebp
je 0x7d26a830
mov r14, r8
movzx ecx, word [r14]
call sub.ntdll.dll_towlower
movzx ecx, byte [rsi]
movzx edi, ax
call sub.ntdll.dll_tolower
cmp eax, edi
jne 0x7d26a828
inc ebx
add r14, 2
inc rsi
cmp ebx, ebp
jb 0x7d26a803
mov r8, qword [rsp + 0x78]
mov edx, r12d
cmp ebx, ebp
jne 0x7d26a845
mov ecx, dword [r15 + 0x24]
add rcx, r13
movzx eax, word [rcx + rdx*2]
cmp eax, dword [r15 + 0x14]
jb 0x7d26a855
inc r12d
cmp r12d, dword [r15 + 0x18]
jae 0x7d26a894
mov rax, qword [rsp + 0x70]
jmp 0x7d26a7f0
mov ecx, dword [r15 + 0x1c]
add rcx, r13
mov ecx, dword [rcx + rax*4]
add rcx, r13
je 0x7d26a89c
cmp rcx, r15
jb 0x7d26a89c
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x74]
add rax, r15
cmp rcx, rax
jae 0x7d26a89c
mov r8, rcx
lea rdx, str.EXPORT__s
mov ecx, 0x89d
call sym.imfsbDll.dll_SbieApi_Log
xor ecx, ecx
jmp 0x7d26a89c
mov rcx, qword [rsp + 0x88]
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x38]
mov r15, qword [rsp + 0x28]
mov rax, rcx
add rsp, 0x58
pop r13
pop rbp
ret
Function at 0x7d26df40
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d26df40
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rax, [0x7d296cf8]
mov rbx, rcx
mov qword [rcx], rax
mov rsi, r8
lea rax, [0x7d296cb0]
mov rdi, rdx
mov qword [rcx + 0x20], rax
lea rcx, [0x7d2905d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebp, ebp
mov qword [rbx + 0x30], rax
test rax, rax
je 0x7d26e05e
lea rdx, str.DragQueryFileW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, [0x7d296d88]
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, str.ILGetSize
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, str.SHGetPathFromIDListW
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, str.SHILCreateFromPath
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, [0x7d296de0]
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x7d2ad070], ebp
mov qword [rbx + 0x60], rax
jne 0x7d26e026
lea rcx, str.FileName
call qword [0x7d2ac640]
mov dword [0x7d2ad070], eax
cmp dword [0x7d2ad074], ebp
jne 0x7d26e041
lea rcx, str.FileNameW
call qword [0x7d2ac640]
mov dword [0x7d2ad074], eax
cmp dword [0x7d2ad078], ebp
jne 0x7d26e06a
lea rcx, str.Shell_IDList_Array
call qword [0x7d2ac640]
mov dword [0x7d2ad078], eax
jmp 0x7d26e06a
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x50], rbp
mov qword [rbx + 0x58], rbp
mov qword [rbx + 8], rdi
test rdi, rdi
je 0x7d26e07c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov qword [rbx + 0x10], rsi
test rsi, rsi
je 0x7d26e0b0
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x7d26e0b0
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rsi
call rax
mov dword [rbx + 0x18], eax
cmp eax, 0xffffffff
mov rax, rbx
mov dword [rbx + 0x1c], 1
je 0x7d26e0ba
jmp 0x7d26e0bd
mov dword [rbx + 0x1c], 1
mov rax, rbx
mov dword [rbx + 0x18], ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x7d26fd30
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d26fd30
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x68
call fcn.7d221988
test rax, rax
je 0x7d26fd5b
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.7d221631
add rsp, 0x20
pop rbx
ret
Function at 0x7d272080
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
jmp 0x7d272080
sub rsp, 0xd8
lea r8, [rsp + 0xe0]
mov edx, 0xf01ff
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
test eax, eax
js 0x7d272274
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rbx
call fcn.7d270a60
mov rcx, qword [rsp + 0xe0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x7d27226c
mov qword [rsp + 0xf0], rbp
mov ecx, 0x4000
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0xd0], rdi
call fcn.7d2212da
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rbp
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x7d272110
mov ecx, 0x4000
call fcn.7d2212da
xor ebx, ebx
mov rdx, rax
mov ecx, 0x3ffc
mov rdi, rax
mov word [rax], bx
call qword [sym.imp.ntdll.dll_RtlGetCurrentDirectory_U]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 7]
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
mov edx, 0x120089
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov word [rdi + 0x3ffc], bx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x7d2721c9
mov ecx, 0x4000
call fcn.7d2212da
lea r8, [rsp + 0xe0]
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call sym.imfsbDll.dll_SbieDll_GetHandlePath
test eax, eax
js 0x7d2721c0
mov rcx, rbx
call sym.imfsbDll.dll_SbieDll_TranslateNtToDosPath
test al, al
je 0x7d2721c0
mov rcx, rdi
sub rcx, rbx
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x7d2721b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x68]
call sub.ntdll.dll_memset
xor eax, eax
mov dword [rsp + 0x60], 0x68
mov qword [rsp + 0x40], rax
lea rcx, str.THREAD
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rdi
lea rax, [rsp + 0x40]
mov dword [rsp + 0x9c], 0x80
mov qword [rsp + 0x28], rax
mov rdx, rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call sym.imfsbDll.dll_SbieDll_RunSandboxed
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0xf0]
test eax, eax
je 0x7d272263
cmp dword [0x7d2abfb4], 0x3ab1
mov rcx, qword [rsp + 0x40]
jae 0x7d272258
or edx, 0xffffffff
jmp 0x7d27225d
mov edx, 0xfa
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd8
ret
Function at 0x7d272810
Capabilities:
Terminate process

Disassembly:
jmp 0x7d272810
push rbx
sub rsp, 0x60
mov rbx, rcx
lea rax, [rsp + 0x70]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x7d272855
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x7d272859
or rax, 0xffffffffffffffff
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rbx, rbx
je 0x7d272873
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x7d273000
Capabilities:
Check for sandbox and av modules

Disassembly:
jmp 0x7d273000
push rbx
sub rsp, 0x20
mov rcx, qword [0x7d2ab310]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x7d273031
mov rcx, qword [0x7d2ab310]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x7d273069
mov rdx, qword [str._s_]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7d273069
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call rax
mov rcx, qword [rsp + 0x30]
test eax, eax
cmovne rcx, rbx
mov rax, rcx
add rsp, 0x20
pop rbx
ret
mov rax, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x7d277110
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
lea r8, str.SBIE_ServiceManager_Mutex
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbx, rax
test rax, rax
jne 0x7d27714b
lea r8, str.SBIE_ServiceManager_Mutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x7d277159
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.imfsbSvc
call fcn.7d278850
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x7d277190
Capabilities:
Check mutex on windows
Set registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push r12
sub rsp, 0x50
mov qword [rax + 8], rsi
lea r8, str.SBIE_ServiceManager_Mutex
mov qword [rax + 0x10], rdi
mov rsi, rcx
mov qword [rax + 0x18], r13
mov ecx, 0x1f0001
xor edx, edx
mov qword [rax - 0x28], r15
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbp, rax
test rax, rax
jne 0x7d2771e3
lea r8, str.SBIE_ServiceManager_Mutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbp, rax
test rax, rax
je 0x7d2771f1
mov edx, 0x1388
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.imfsbSvc
call fcn.7d278850
xor r13d, r13d
mov r15d, r13d
call fcn.7d279540
or rdi, 0xffffffffffffffff
mov rbx, rax
mov r12, rax
cmp word [rax], r13w
je 0x7d27726a
nop dword [rax + rax]
mov rdx, rsi
mov rcx, rbx
call sub.ntdll.dll__wcsicmp
test eax, eax
je 0x7d2772f4
mov rax, rdi
inc rax
cmp word [rbx + rax*2], r13w
jne 0x7d277236
inc eax
add r15d, eax
mov rax, rdi
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], r13w
lea rax, [rax + 1]
jne 0x7d277250
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], r13w
jne 0x7d277220
mov qword [rsp + 0x48], r14
mov rax, rdi
inc rax
cmp word [rsi + rax*2], r13w
jne 0x7d277272
add eax, r15d
lea ecx, [rax*2 + 0x10]
call fcn.7d2212da
mov ebx, r15d
mov rdx, r12
add rbx, rbx
mov rcx, rax
mov r8, rbx
mov r14, rax
call sub.ntdll.dll_memcpy
sub rbx, rsi
mov rcx, rsi
lea rdx, [rbx + r14]
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x7d2772b0
cmp word [rsi + rdi*2 + 2], r13w
lea rdi, [rdi + 1]
jne 0x7d2772c0
lea ebx, [rdi + 1]
mov dl, 1
add ebx, r15d
lea rcx, str.imfsbSvc
mov word [r14 + rbx*2], r13w
call fcn.7d2213f2
mov rdi, rax
test rax, rax
jne 0x7d2772fb
mov ebx, 0xc0000001
jmp 0x7d27733f
mov ebx, 0xc0000035
jmp 0x7d27734c
lea rdx, str.SandboxedServices
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [rbx*2 + 2]
mov r9d, 7
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, r14
call fcn.7d221938
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
test rbp, rbp
je 0x7d27737a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.imfsbSvc
call fcn.7d278850
mov rcx, r12
call fcn.7d221938
mov eax, ebx
add rsp, 0x50
pop r12
pop rbp
pop rbx
ret
Function at 0x7d278850
Capabilities:
Print debug messages
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x200
call fcn.7d2212da
mov r8, qword [str.REGISTRYMACHINESYSTEMCurrentControlSetServices_]
mov r9, rax
sub r9, r8
mov rdi, rax
nop word [rax + rax]
movzx edx, word [r8]
mov word [r9 + r8], dx
lea r8, [r8 + 2]
test dx, dx
jne 0x7d278880
add rax, 0xfffffffffffffffe
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x7d2788a0
xor edx, edx
nop dword [rax]
movzx ecx, word [rbx + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x7d2788b0
mov dl, 1
mov rcx, rdi
call fcn.7d2212cb
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.7d221938

Function at 0x7d279540
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
xor edx, edx
lea rcx, str.imfsbSvc
call fcn.7d2213f2
mov rdi, rax
test rax, rax
je 0x7d27960e
lea rdx, str.SandboxedServices
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x250]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7d27960e
cmp dword [rsp + 0x44], 7
jne 0x7d27960e
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x7d27960e
add ecx, 8
call fcn.7d2212da
mov r8d, dword [rsp + 0x48]
xor edx, edx
add r8d, 8
mov rcx, rax
mov rbx, rax
call sub.ntdll.dll_memset
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x4c]
mov rcx, rbx
call sub.ntdll.dll_memcpy
test rbx, rbx
je 0x7d27960e
mov rax, rbx
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
mov ecx, 4
call fcn.7d2212da
mov rbx, qword [rsp + 0x258]
xor ecx, ecx
mov dword [rax], ecx
add rsp, 0x240
pop rdi
ret
Function at 0x7d27de20
Capabilities:
Print debug messages
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x7d27de3d
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.imfsbSvc
add rsp, 0x20
pop rbx
jmp fcn.7d278850
Function at 0x7d27f060
Capabilities:
Bypass uac via rpc

Disassembly:
jmp 0x7d27f060
sub rsp, 0x18
xor r8b, r8b
mov byte [rsp], r8b
cmp byte [0x7d2ad62a], r8b
jne 0x7d27f18b
cmp qword [0x7d2ad630], 0
jne 0x7d27f18b
test r9, r9
je 0x7d27f18b
mov rax, qword [r9]
test rax, rax
je 0x7d27f18b
cmp dword [rax], 0x70
jne 0x7d27f18b
cmp dword [rax + 0x2c], 1
jne 0x7d27f18b
cmp qword [rax + 0x30], 0
je 0x7d27f18b
mov rcx, qword [r9 + 8]
cmp rcx, 0x1fff
jb 0x7d27f18b
mov rax, qword [rcx + 0x18]
cmp rax, qword [0x7d2ab928]
jne 0x7d27f104
mov rax, qword [rcx + 0x20]
cmp rax, qword [0x7d2ab930]
jne 0x7d27f104
mov rax, qword [r9 + 0x58]
test rax, rax
je 0x7d27f18b
mov dword [0x7d2ad62c], 1
mov qword [0x7d2ad638], rax
jmp 0x7d27f17a
mov rax, qword [rcx + 0x18]
cmp rax, qword [0x7d2ab938]
jne 0x7d27f11e
mov rax, qword [rcx + 0x20]
cmp rax, qword [0x7d2ab940]
je 0x7d27f138
mov rax, qword [rcx + 0x18]
cmp rax, qword [0x7d2ab948]
jne 0x7d27f18b
mov rax, qword [rcx + 0x20]
cmp rax, qword [0x7d2ab950]
jne 0x7d27f18b
mov ecx, 3
mov dword [rsp + 4], ecx
cmp ecx, 0x10
jae 0x7d27f170
mov eax, ecx
cmp dword [r9 + rax*8 + 0x10], 0xffffffff
jne 0x7d27f16c
mov edx, 2
mov dword [0x7d2ad62c], edx
lea eax, [rcx + 1]
mov rax, qword [r9 + rax*8 + 0x10]
mov qword [0x7d2ad638], rax
jmp 0x7d27f176
inc ecx
jmp 0x7d27f13d
mov edx, dword [0x7d2ad62c]
test edx, edx
je 0x7d27f18b
mov rax, qword [r9]
mov qword [0x7d2ad630], rax
mov r8b, 1
mov byte [rsp], r8b
jmp 0x7d27f192
movzx eax, r8b
add rsp, 0x18
ret