joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d246320
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x7d246320
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
cmp qword [0x7d2ac8c0], 0
movzx edi, r9b
mov ebp, r8d
mov ebx, edx
mov rsi, rcx
jne 0x7d246372
mov ecx, 0x40
call fcn.7d221988
mov r8d, dword [0x7d2abf9c]
lea rdx, str.GUIPROXY__08X
mov rcx, rax
mov qword [0x7d2ac8c0], rax
call sym.imfsbDll.dll_Sbie_swprintf
xor r14d, r14d
test byte [0x7d2abfa0], 2
je 0x7d246391
test dil, dil
je 0x7d2463b5
cmp byte [0x7d2acb78], r14b
jne 0x7d246391
xor dil, dil
jmp 0x7d2463b5
test dil, dil
je 0x7d2463b5
cmp qword [0x7d2ac6d0], r14
je 0x7d2463b5
xor ecx, ecx
call fcn.7d221744
movzx edi, dil
cmp byte [rax + 0x190], r14b
cmovne edi, r14d
mov rcx, qword [0x7d2ac8c0]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r8d, ebx
mov rdx, rsi
call sym.imfsbDll.dll_SbieDll_QueuePutReq
mov ebx, eax
test eax, eax
js 0x7d2464c2
test dil, dil
je 0x7d246499
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp qword [0x7d2ac878], r14
mov edi, eax
je 0x7d246492
cmp qword [0x7d2ac880], r14
je 0x7d246492
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x2710
ja 0x7d24648b
xor r8d, r8d
mov dword [rsp + 0x20], 0x40
mov r9d, 0x2710
lea rdx, [rsp + 0x38]
lea ecx, [r8 + 1]
call qword [0x7d2ac878]
mov ebx, eax
cmp eax, 1
jne 0x7d246476
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7d246471
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [0x7d2ac880]
jmp 0x7d246410
mov ebx, r14d
jmp 0x7d2464b7
cmp eax, 0xffffffff
jne 0x7d2464b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
or ebx, 0xff000000
jmp 0x7d2464b7
mov ebx, 0x102
jmp 0x7d2464b7
mov ebx, 0xc0000139
jmp 0x7d2464b7
mov rcx, qword [rsp + 0x38]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
mov ebx, 0x102
test eax, eax
cmovne ecx, ebx
mov ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x7d246510
mov edx, dword [rsp + 0xb8]
lea r9, [rsp + 0x30]
mov rcx, qword [0x7d2ac8c0]
lea r8, [rsp + 0x40]
call sym.imfsbDll.dll_SbieDll_QueueGetRpl
mov ebx, eax
test eax, eax
js 0x7d246510
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp eax, 4
jb 0x7d2464fd
mov ebx, dword [rcx]
test ebx, ebx
jne 0x7d24650b
cmp eax, ebp
jb 0x7d246506
mov rax, rcx
jmp 0x7d246540
mov ebx, 0xc0000004
call fcn.7d221938
mov r9, qword [0x7d2abf60]
lea rdx, str._S____S___08X_
mov r8, qword [0x7d2ac8c0]
mov ecx, 0x89b
mov dword [rsp + 0x20], ebx
call sym.imfsbDll.dll_SbieApi_Log
mov ecx, 0x53d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x7d24b6a0
Capabilities:
Get system information on windows

Disassembly:
jmp 0x7d24b6a0
sub rsp, 0x58
cmp byte [0x7d2aa660], 0
je 0x7d24b73f
cmp byte [0x7d2ac9c1], 0
jne 0x7d24b73f
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x30]
mov qword [0x7d2aca18], rax
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x58]
test rbx, rbx
je 0x7d24b73a
cmp qword [rbx + 0x50], 0
je 0x7d24b73a
mov edx, 8
lea r9, [rsp + 0x60]
lea rcx, [rbx + 0x50]
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x7d24b73a
lea rax, [0x7d24aa90]
mov edx, 8
xchg qword [rbx + 0x50], rax
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
lea rcx, [rbx + 0x50]
mov qword [0x7d2aca10], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x7d24cfe0
Capabilities:
Create thread

Disassembly:
jmp 0x7d24cfe0
push rsi
sub rsp, 0x30
mov rcx, qword [0x7d2abf60]
lea rdx, str.klwtblfs.exe
call sub.ntdll.dll__wcsicmp
xor esi, esi
test eax, eax
jne 0x7d24d01d
mov qword [rsp + 0x28], rsi
lea r9d, [rsi + 1]
lea r8, [fcn.7d22132a]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [0x7d2aca58], rsi
je 0x7d24d103
mov rcx, qword [0x7d2aa190]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x18
mov rdi, rax
call fcn.7d221988
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x100000
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbx], rax
test rax, rax
je 0x7d24d0d6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 8], rax
test rax, rax
je 0x7d24d0d6
mov qword [rsp + 0x28], rsi
lea r8, [0x7d24cad0]
mov r9, rbx
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x7d24d0cc
xor r8d, r8d
or r9d, 0xffffffff
mov rdx, rbx
lea ecx, [r8 + 3]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
test rdi, rdi
mov rdi, qword [rsp + 0x48]
jne 0x7d24d103
mov rcx, qword [0x7d2aa190]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x7d24d103
xor ecx, ecx
add rsp, 0x30
pop rsi
jmp fcn.7d221910
add rsp, 0x30
pop rsi
ret

Function at 0x7d257c80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dl, 0xff
mov eax, 0x40
mov r9d, 4
mov edi, edx
cmove r9d, eax
mov rbx, rcx
xor ecx, ecx
mov edx, 0x10000
mov r8d, 0x103000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x7d257d73
xor edx, edx
mov dword [rax + 0x20], edi
mov qword [rax + 0x10], rdx
mov ecx, 0x1fe
mov word [rax + 0x24], cx
test rbx, rbx
je 0x7d257d73
movups xmm0, xmmword [rbx + 0x78]
movups xmmword [rax + 0x80], xmm0
movups xmm1, xmmword [rbx + 0x88]
movups xmmword [rax + 0x90], xmm1
movups xmm0, xmmword [rbx + 0x98]
movups xmmword [rax + 0xa0], xmm0
movups xmm1, xmmword [rbx + 0xa8]
movups xmmword [rax + 0xb0], xmm1
movups xmm0, xmmword [rbx + 0xb8]
movups xmmword [rax + 0xc0], xmm0
movups xmm1, xmmword [rbx + 0xc8]
movups xmmword [rax + 0xd0], xmm1
movups xmm0, xmmword [rbx + 0xd8]
movups xmmword [rax + 0xe0], xmm0
movups xmm1, xmmword [rbx + 0xe8]
movups xmmword [rax + 0xf0], xmm1
mov qword [rax + 0x18], rbx
mov rcx, qword [rbx + 0x30]
inc dword [rbx + 0x40]
mov qword [rbx + 0x30], rax
mov qword [rax + 8], rdx
mov qword [rax], rcx
test rcx, rcx
jne 0x7d257d6f
mov qword [rbx + 0x38], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rcx + 8], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7d257dd0
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x7d257dd0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
cmp cl, 0xff
mov r9d, 4
mov ebp, ecx
mov ebx, 0x40
cmove r9d, ebx
mov edx, 0x10000
xor ecx, ecx
mov r8d, 0x103000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x7d257f72
mov qword [rsp + 0x30], rsi
lea r8d, [rbx + 0x40]
mov qword [rsp + 0x38], rdi
mov esi, 0x1fe
lea rdi, [rax + 0x80]
mov dword [rax + 0x20], ebp
mov rcx, rdi
mov qword [rax + 0x10], 0
xor edx, edx
mov word [rax + 0x24], si
call sub.ntdll.dll_memset
mov eax, 0x3f
nop dword [rax + rax]
mov ecx, eax
cmp ebx, 1
jne 0x7d257e60
mov byte [rcx + rdi], 0xff
lea eax, [rbx + 7]
jmp 0x7d257e68
or byte [rcx + rdi], bl
mov eax, 1
add esi, eax
mov ebx, 1
mov ecx, esi
mov eax, esi
and ecx, 7
shr eax, 3
shl ebx, cl
cmp eax, 0x80
jb 0x7d257e50
lea rbx, [r14 + 0x100]
xor eax, eax
mov qword [r14 + 0x18], rbx
lea rcx, [rbx + 8]
mov dword [rbx], ebp
mov edx, 0x3e8
xchg dword [rbx + 4], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
movups xmm0, xmmword [rdi]
mov rsi, qword [rsp + 0x30]
xor eax, eax
movups xmmword [rbx + 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x88], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x98], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [rbx + 0xa8], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rbx + 0xb8], xmm0
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [rbx + 0xc8], xmm1
movups xmm0, xmmword [rdi + 0x60]
movups xmmword [rbx + 0xd8], xmm0
movups xmm1, xmmword [rdi + 0x70]
movups xmmword [rbx + 0xe8], xmm1
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
mov rax, qword [rbx + 0x30]
inc dword [rbx + 0x40]
mov qword [rbx + 0x30], r14
mov qword [r14 + 8], 0
mov qword [r14], rax
test rax, rax
jne 0x7d257f2b
mov qword [rbx + 0x38], r14
jmp 0x7d257f2f
mov qword [rax + 8], r14
xor eax, eax
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x70], rax
mov rax, rbx
movzx ecx, byte [rdi]
bts ecx, 0
movzx edx, cl
bts edx, 1
mov byte [rdi], dl
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x7d257ff0
Capabilities:
Terminate process

Disassembly:
jmp 0x7d257ff0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rbp, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x60]
test rcx, rcx
je 0x7d25803b
nop dword [rax]
movzx eax, word [rcx + 0x26]
xor edx, edx
mov rdi, qword [rcx]
mov r8d, 0x8000
mov rcx, qword [rcx + 0x1c]
add ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x7d258102
mov rcx, rdi
test rdi, rdi
jne 0x7d258010
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x30], rsi
test rcx, rcx
je 0x7d25807b
mov rsi, rbp
and rsi, 0xffffffffffff0000
mov rdi, qword [rcx]
cmp rsi, rcx
je 0x7d258071
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x7d258122
inc ebx
mov rcx, rdi
test rdi, rdi
jne 0x7d258053
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x7d2580b8
mov rsi, rbp
and rsi, 0xffffffffffff0000
nop
mov rdi, qword [rcx]
cmp rsi, rcx
je 0x7d2580ae
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x7d258142
inc ebx
mov rcx, rdi
test rdi, rdi
jne 0x7d258090
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and rbp, 0xffffffffffff0000
xor edx, edx
mov rcx, rbp
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x7d258162
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000025
mov ecx, 0xc0000005
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000025
mov ecx, 0xc0000005
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000025
mov ecx, 0xc0000005
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000025
mov ecx, 0xc0000005
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7d258af0
Capabilities:
Write file on windows

Disassembly:
jmp 0x7d258af0
push rbx
sub rsp, 0x60
mov eax, dword [rcx + 0x10]
mov rbx, rcx
test eax, eax
je 0x7d258b6d
mov qword [rsp + 0x40], 0
xor r9d, r9d
mov qword [rsp + 0x38], 0
xor r8d, r8d
mov dword [rsp + 0x30], eax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rsi
lea rsi, [rcx + 0x18]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ecx, eax
test eax, eax
js 0x7d258b55
mov eax, dword [rbx + 0x10]
mov edx, 0xc000007f
cmp qword [rsp + 0x58], rax
cmovne ecx, edx
mov qword [rbx + 8], rsi
mov eax, ecx
mov rsi, qword [rsp + 0x70]
mov dword [rbx + 0x10], 0
add rsp, 0x60
pop rbx
ret
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x7d258c30
Capabilities:
Read file on windows

Disassembly:
jmp 0x7d258c30
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rsi, r8
mov ebp, edx
mov rbx, rcx
test edx, edx
je 0x7d258ccb
xor r14d, r14d
nop dword [rax]
cmp dword [rbx + 0x10], r14d
jne 0x7d258cb3
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
lea rdi, [rbx + 0x18]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x30], 0xfe0
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov ecx, r14d
mov qword [rbx + 8], rdi
test eax, eax
cmovns ecx, dword [rsp + 0x58]
mov dword [rbx + 0x10], ecx
js 0x7d258ccd
test ecx, ecx
je 0x7d258ce8
mov rax, qword [rbx + 8]
movzx ecx, byte [rax]
mov byte [rsi], cl
inc rsi
inc qword [rbx + 8]
dec dword [rbx + 0x10]
add ebp, 0xffffffff
jne 0x7d258c60
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov eax, 0xc0000011
jmp 0x7d258ccd

Function at 0x7d258df0
Capabilities:
Read file on windows

Disassembly:
jmp 0x7d258df0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0
lea rdi, [rcx + 0x18]
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0xfe0
mov rbx, rcx
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov ecx, eax
test eax, eax
js 0x7d258e4a
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], eax
jmp 0x7d258e51
mov dword [rbx + 0x10], 0
mov qword [rbx + 8], rdi
test ecx, ecx
js 0x7d258e65
cmp dword [rbx + 0x10], 0
mov eax, 0xc0000011
cmove ecx, eax
mov eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x7d258f20
Capabilities:
Write file on windows

Disassembly:
jmp 0x7d258f20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rdi, r8
mov esi, edx
mov rbx, rcx
test edx, edx
je 0x7d258fc3
xor r14d, r14d
mov r15d, 0xc000007f
nop dword [rax]
cmp dword [rbx + 0x10], 0xfe0
jne 0x7d258fab
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
lea rbp, [rbx + 0x18]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x30], 0xfe0
xor r8d, r8d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x7d258f9f
mov ecx, dword [rbx + 0x10]
cmp qword [rsp + 0x58], rcx
cmovne eax, r15d
mov dword [rbx + 0x10], r14d
mov qword [rbx + 8], rbp
test eax, eax
js 0x7d258fc5
movzx eax, byte [rdi]
inc rdi
mov rcx, qword [rbx + 8]
mov byte [rcx], al
inc qword [rbx + 8]
inc dword [rbx + 0x10]
add esi, 0xffffffff
jne 0x7d258f50
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x7d25e440
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
jmp 0x7d25e440
push rbx
sub rsp, 0x50
mov eax, dword [0x7d2abfb0]
movzx ebx, cl
dec eax
cmp eax, 1
jbe 0x7d25e48f
cmp byte [0x7d2abfab], 0
jne 0x7d25e48f
test cl, cl
je 0x7d25e47b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
movzx ebx, bl
cmp dword [rsp + 0x40], 2
cmovb ebx, eax
mov rcx, qword [str.hF_]
movzx edx, bl
add rsp, 0x50
pop rbx
jmp fcn.7d25dce0
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x7d25fae0
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x7d25fae0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x130
movzx r8d, byte [rdx + 0xe]
mov r15, rdx
movzx eax, byte [rdx + 0xf]
mov r13, rcx
movzx r10d, byte [rdx + 0xd]
lea rcx, [rsp + 0xd0]
movzx r11d, byte [rdx + 0xc]
movzx ebx, byte [rdx + 0xb]
movzx edi, byte [rdx + 0xa]
movzx esi, byte [rdx + 9]
movzx ebp, byte [rdx + 8]
movzx r14d, word [rdx + 6]
movzx r9d, word [rdx + 4]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], r8d
mov r8d, dword [rdx]
lea rdx, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call sym.imfsbDll.dll_Sbie_swprintf
mov rax, qword [r13 + 8]
mov r14, qword [rax]
test r14, r14
je 0x7d25fc3d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r14 + 0x1e]
movzx edx, byte [r14 + 0x1d]
movzx r8d, byte [r14 + 0x1c]
movzx eax, byte [r14 + 0x1f]
movzx r10d, byte [r14 + 0x1b]
movzx r11d, byte [r14 + 0x1a]
movzx ebx, byte [r14 + 0x19]
movzx edi, byte [r14 + 0x18]
movzx esi, word [r14 + 0x16]
movzx r9d, word [r14 + 0x14]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x50], edx
lea rdx, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x48], r8d
mov r8d, dword [r14 + 0x10]
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call sym.imfsbDll.dll_Sbie_swprintf
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0xd0]
sub rdx, rax
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x7d25fc26
add rax, 2
test cx, cx
jne 0x7d25fc10
xor eax, eax
jmp 0x7d25fc2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x7d25fc6c
jg 0x7d25fc3d
mov r14, qword [r14]
test r14, r14
jne 0x7d25fb90
mov ecx, 0x20
call fcn.7d221988
mov r8, rax
movups xmm0, xmmword [r15]
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [r13 + 8]
test r14, r14
je 0x7d25fc65
mov rdx, r14
call fcn.7d221438
jmp 0x7d25fc6c
xor edx, edx
call fcn.7d2214e7
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x7d260110
Capabilities:
Check mutex on windows

Disassembly:
jmp 0x7d260110
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov r8, qword [str.pP_]
lea rax, [0x7d294f98]
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 0x10], rdx
xor eax, eax
mov esi, 1
xor edx, edx
mov dword [rcx + 8], esi
xor ecx, ecx
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], rcx
mov qword [rbx + 0x50], rcx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x7d26021e
or edx, 0xffffffff
mov qword [rsp + 0x40], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8, qword [str.SBIE_ProtectedStorage_Section]
xor edx, edx
mov ecx, 0xf001f
xor dil, dil
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x7d2601d9
mov rax, qword [str.SBIE_ProtectedStorage_Section]
lea r8d, [rsi + 3]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 8
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
movzx edi, dil
mov qword [rbx + 0x20], rax
cmovne edi, esi
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x7d26020f
xor r9d, r9d
mov qword [rsp + 0x20], 8
xor r8d, r8d
mov edx, 0xf001f
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x50], rax
test dil, dil
je 0x7d26020f
mov rcx, qword [rbx + 0x48]
inc rcx
mov qword [rax], rcx
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
Function at 0x7d2614c0
Capabilities:
Get common file path

Disassembly:
jmp 0x7d2614c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2d0
movzx ebp, dl
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x288
call sub.ntdll.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x40]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d261505
movsd xmm1, qword [0x7d295110]
movzx eax, word [0x7d295118]
movups xmm0, xmmword [str.SbiePst.dat]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov word [rcx + 0x18], ax
test bpl, bpl
je 0x7d261547
mov eax, 2
mov ebx, 0x40000000
mov esi, eax
xor edi, edi
jmp 0x7d26155b
mov ebx, 0x80000000
mov edi, 1
mov eax, 3
mov esi, 0x80
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov r8d, edi
mov dword [rsp + 0x20], eax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x7d2615bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x7d2615dd
test bpl, bpl
je 0x7d2615dd
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov r8d, edi
mov dword [rsp + 0x20], eax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x7d2615dd
mov rdx, rax
lea rcx, [rsp + 0x2f0]
call fcn.7d22111d
test eax, eax
jne 0x7d2615dd
mov rax, qword [rsp + 0x2f0]
jmp 0x7d2615df
xor eax, eax
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x7d2617b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7d2617b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
mov rcx, rsi
lea rdx, [rsp + 0x48]
mov rbx, r9
mov rdi, r8
call fcn.7d221866
test eax, eax
je 0x7d2617e5
xor al, al
jmp 0x7d261851
mov r8d, dword [rsp + 0x48]
mov edx, 4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [rsp + 0x48]
mov rcx, rsi
mov r8, rax
mov qword [rdi], rax
call fcn.7d221497
test eax, eax
jne 0x7d2617e1
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.7d221866
test eax, eax
jne 0x7d2617e1
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x48]
not eax
cmp eax, ecx
jne 0x7d2617e1
xor eax, eax
mov dword [rbx], ecx
test ecx, ecx
jle 0x7d26184f
nop word [rax + rax]
mov rcx, qword [rdi]
movsxd rdx, eax
xor byte [rdx + rcx], al
inc eax
cmp eax, dword [rbx]
jl 0x7d261840
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x7d261ca0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7d261ca0
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov esi, r9d
mov rcx, rbp
mov edx, r9d
mov rdi, r8
call fcn.7d2217cb
test eax, eax
je 0x7d261cd9
xor al, al
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov eax, ebx
test esi, esi
jle 0x7d261cfc
mov rcx, rdi
nop dword [rax]
xor byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, esi
jl 0x7d261cf0
mov r8, rdi
mov edx, esi
mov rcx, rbp
call fcn.7d22128a
test eax, eax
sete al
test esi, esi
jle 0x7d261d1e
xor byte [rdi], bl
lea rdi, [rdi + 1]
inc ebx
cmp ebx, esi
jl 0x7d261d12
mov rbx, qword [rsp + 0x30]
test al, al
je 0x7d261cc7
not esi
mov rcx, rbp
mov edx, esi
call fcn.7d2217cb
mov rbp, qword [rsp + 0x38]
test eax, eax
mov rsi, qword [rsp + 0x40]
sete al
add rsp, 0x20
pop rdi
ret