joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d704b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_RtlDetermineDosPathNameType_U]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
je 0x7d704b82
cmp dword [ebp - 0xc], 2
je 0x7d704b82
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d704c8e
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call sym.kernel32_wrapper.dll_GetFullPathNameW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x7d704ba9
xor eax, eax
jmp 0x7d704c8e
lea eax, [ebp - 0x214]
push eax
call sym.kernel32_wrapper.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x7d704bc1
xor eax, eax
jmp 0x7d704c8e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, 8
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
push ecx
push 0
call sym.kernel32_wrapper.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x7d704bf3
xor eax, eax
jmp 0x7d704c8e
mov edx, dword [ebp - 8]
shl edx, 1
push edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
call sub.ntext.dll_memcpy
add esp, 0xc
mov edx, dword [0x7d712458]
movzx eax, byte [edx]
and eax, 8
je 0x7d704c64
push 0x7d73f7fc
push 0x225
push 0x7d73f7fd
push 0x7d73d8f0
mov ecx, dword [0x7d712458]
push ecx
push 3
call fcn.7d70d8f0
add esp, 0x18
cmp eax, 0xffffffff
je 0x7d704c64
mov edx, dword [ebp - 4]
add edx, 8
push edx
call fcn.7d7052f0
add esp, 4
push eax
push 0x7d73d944
call fcn.7d70d960
add esp, 8
push 0x7d73f818
call dword [sym.imp.ntext.dll_RtlEnterCriticalSection]
mov eax, dword [ebp - 4]
push eax
push 0x7d73da10
call fcn.7d705920
add esp, 8
push 0x7d73f818
call dword [sym.imp.ntext.dll_RtlLeaveCriticalSection]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x7d705580
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
cmp dword [0x7d73da58], 0xffffffff
jne 0x7d7056be
lea eax, [ebp - 0x130]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x100
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [0x7d73da58], 1
push str.RegistryMachineSystemCurrentControlSetControlSession_Manager
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.ntext.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x30]
push eax
push 0x20019
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ntext.dll_NtOpenKey]
test eax, eax
jne 0x7d705671
push str.SafeDllSearchMode
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.ntext.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x130]
push edx
push 2
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntext.dll_NtQueryValueKey]
test eax, eax
jne 0x7d705667
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 4
jne 0x7d705667
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 4
jne 0x7d705667
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x7d705657
mov dword [ebp - 0xc], 1
jmp 0x7d70565e
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov dword [0x7d73da58], edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ntext.dll_NtClose]
cmp dword [0x7d73da58], 0
jne 0x7d7056be
mov ecx, dword [0x7d712458]
movzx edx, byte [ecx]
and edx, 8
je 0x7d7056be
push 0x7d73f806
push 0xa3
push 0x7d73f807
push 0x7d73da90
mov eax, dword [0x7d712458]
push eax
push 3
call fcn.7d70d8f0
add esp, 0x18
cmp eax, 0xffffffff
je 0x7d7056be
push str.SafeDllSearchMode_disabled_through_the_registry_n
call fcn.7d70d960
add esp, 4
mov eax, dword [0x7d73da58]
mov esp, ebp
pop ebp
ret
Function at 0x7d7056d0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x7d73f83c], 0
jne 0x7d7057f5
mov dword [ebp - 8], 1
push 0
push 0
call sym.kernel32_wrapper.dll_GetSystemDirectoryW
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
push 0
push 0
call sym.kernel32_wrapper.dll_GetWindowsDirectoryW
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
shl eax, 1
push eax
push 0
call sym.kernel32_wrapper.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx*2]
sub ecx, dword [ebp - 4]
sar ecx, 1
push ecx
mov edx, dword [ebp - 4]
push edx
call sym.kernel32_wrapper.dll_GetSystemDirectoryW
mov eax, dword [ebp - 4]
push eax
call sub.ntext.dll_wcslen
add esp, 4
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
mov eax, 2
imul eax, eax, 0xfffffffe
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + eax]
cmp edx, 0x33
jne 0x7d7057c0
mov eax, 2
imul eax, eax, 0xffffffff
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + eax]
cmp edx, 0x32
jne 0x7d7057c0
mov eax, 0x3b
mov ecx, dword [ebp - 4]
mov word [ecx], ax
mov edx, dword [ebp - 4]
add edx, 2
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax*2]
sub edx, dword [ebp - 4]
sar edx, 1
push edx
mov eax, dword [ebp - 4]
push eax
call sym.kernel32_wrapper.dll_GetSystemDirectoryW
mov ecx, dword [ebp - 4]
push ecx
call sub.ntext.dll_wcslen
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [edx + eax*2 - 4]
mov dword [ebp - 4], eax
mov ecx, 0x3b
mov edx, dword [ebp - 4]
mov word [edx], cx
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx*2]
sub eax, dword [ebp - 4]
sar eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
call sym.kernel32_wrapper.dll_GetWindowsDirectoryW
mov edx, dword [ebp - 0xc]
mov dword [0x7d73f83c], edx
mov eax, dword [0x7d73f83c]
mov esp, ebp
pop ebp
ret
Function at 0x7d705b30
Capabilities:
Access pe header
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
and ecx, 0x40
jne 0x7d705b63
mov edx, dword [ebp - 0xc]
or edx, 2
mov dword [ebp - 0xc], edx
push 0
lea eax, [ebp - 0x218]
push eax
push 0x104
push 0x7d712518
mov ecx, dword [ebp + 8]
push ecx
push 0
call sym.kernel32_wrapper.dll_SearchPathW
test eax, eax
je 0x7d705ba5
push 0
push 0
push 3
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x80000000
lea eax, [ebp - 0x218]
push eax
call sym.kernel32_wrapper.dll_CreateFileW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x7d705baf
xor eax, eax
jmp 0x7d705c2a
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call sym.kernel32_wrapper.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
push edx
call sym.kernel32_wrapper.dll_CloseHandle
cmp dword [ebp - 0x10], 0
jne 0x7d705bd8
xor eax, eax
jmp 0x7d705c2a
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sym.kernel32_wrapper.dll_MapViewOfFile
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sym.kernel32_wrapper.dll_CloseHandle
cmp dword [ebp - 8], 0
jne 0x7d705bff
xor eax, eax
jmp 0x7d705c2a
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ntext.dll_RtlImageNtHeader]
test eax, eax
jne 0x7d705c1a
mov eax, dword [ebp - 8]
push eax
call sym.kernel32_wrapper.dll_UnmapViewOfFile
xor eax, eax
jmp 0x7d705c2a
mov ecx, dword [ebp - 8]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x7d7063f0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x7d706412
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d70657c
push 2
lea ecx, [ebp - 0x14]
push ecx
push 0x20001009
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call sym.kernel32_wrapper.dll_GetLocaleInfoW
test eax, eax
jne 0x7d706434
xor eax, eax
jmp 0x7d70657c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
and edx, 0xbfffffff
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 8
ja case.0x7d706453.3
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 0x7d706590]
jmp dword [ecx*4 + 0x7d706580]
mov dword [ebp - 4], 0x1f
jmp 0x7d706483
mov dword [ebp - 4], 0x20
jmp 0x7d706483
mov dword [ebp - 4], 0x1006
jmp 0x7d706483
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d70657c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
and eax, 0x40000000
or eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x7d7064be
push 0x100
lea edx, [ebp - 0x31c]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call sym.kernel32_wrapper.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
jmp 0x7d7064dd
push 0x100
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call sym.kernel32_wrapper.dll_GetLocaleInfoA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x7d706577
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x7d706503
cmp dword [ebp - 8], 1
je 0x7d70652e
cmp dword [ebp - 8], 2
je 0x7d70655d
jmp 0x7d706577
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x7d706517
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0xc], ecx
jmp 0x7d706520
lea edx, [ebp - 0x11c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
call edx
jmp 0x7d706577
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x7d706542
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x10], ecx
jmp 0x7d70654b
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
call eax
jmp 0x7d706577
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x31c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x7d7065a0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x7d7065c2
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d7066b8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
and edx, 0xbfffffff
mov dword [ebp - 0x14], edx
je 0x7d7065db
cmp dword [ebp - 0x14], 2
je 0x7d7065e4
jmp 0x7d7065ed
mov dword [ebp - 4], 0x1003
jmp 0x7d7065fb
mov dword [ebp - 4], 0x79
jmp 0x7d7065fb
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d7066b8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
and ecx, 0x40000000
or ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 0
je 0x7d706637
push 0x100
lea eax, [ebp - 0x314]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call sym.kernel32_wrapper.dll_GetLocaleInfoW
mov dword [ebp - 0x10], eax
jmp 0x7d706656
push 0x100
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call sym.kernel32_wrapper.dll_GetLocaleInfoA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x7d7066b3
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x7d706672
cmp dword [ebp - 8], 1
je 0x7d70669d
jmp 0x7d7066b3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x7d706686
lea edx, [ebp - 0x314]
mov dword [ebp - 0xc], edx
jmp 0x7d70668f
lea eax, [ebp - 0x114]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
call eax
jmp 0x7d7066b3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
lea eax, [ebp - 0x314]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
call edx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x7d7066d0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 4], 0
mov eax, 2
imul eax, eax, 0
xor ecx, ecx
mov word [ebp + eax - 0xa8], cx
push 0x50
lea edx, [ebp - 0xa8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.kernel32_wrapper.dll_GetLocaleInfoW
mov edx, 2
imul edx, edx, 0
movzx eax, word [ebp + edx - 0xa8]
test eax, eax
je 0x7d706775
mov ecx, 2
shl ecx, 0
movzx edx, word [ebp + ecx - 0xa8]
cmp edx, 0x3b
jne 0x7d706775
mov eax, 2
shl eax, 1
movzx ecx, word [ebp + eax - 0xa8]
cmp ecx, 0x30
je 0x7d706775
mov edx, 2
imul edx, edx, 0
movzx eax, word [ebp + edx - 0xa8]
sub eax, 0x30
imul eax, eax, 0xa
mov ecx, 2
shl ecx, 1
movzx edx, word [ebp + ecx - 0xa8]
lea eax, [eax + edx - 0x30]
mov dword [ebp - 4], eax
jmp 0x7d7067b9
lea ecx, [ebp - 0xa8]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
movzx eax, word [edx]
cmp eax, 0x30
jl 0x7d7067b9
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x39
jg 0x7d7067b9
mov eax, dword [ebp - 4]
imul eax, eax, 0xa
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
lea eax, [eax + edx - 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 8], ecx
jmp 0x7d706785
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x7d7076b0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x7d73f8cc]
mov dword [ebp - 4], eax
mov ecx, dword [0x7d73f8cc]
add ecx, 1
mov dword [0x7d73f8cc], ecx
cmp dword [ebp - 4], 0
jne 0x7d7076e0
push str.FlushProcessWriteBuffers_is_stub_n
call sub.ntext.dll_DbgPrint
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x7d707a80
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.__u__p__p__n
call sub.ntext.dll_DbgPrint
add esp, 0x10
cmp dword [ebp + 0x10], 0
jne 0x7d707ab0
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d707b01
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 4
lea ecx, [ebp + 8]
push ecx
push 1
call fcn.7d707c50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc0000004
jne 0x7d707ae2
push 0x7a
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d707b01
cmp dword [ebp - 4], 0
je 0x7d707afc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d707b01
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x7d707c50
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xc0000002
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._0x_08x__p__u__p__u__p__stub_n
call sub.ntext.dll_DbgPrint
add esp, 0x1c
mov dword [ebp - 8], 0xe4
mov eax, dword [ebp - 8]
push eax
push 0
call sym.kernel32_wrapper.dll_GetProcessHeap
push eax
call dword [sym.imp.ntext.dll_RtlAllocateHeap]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
call fcn.7d708680
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push str.NtQuerySystemInformationExInternal::_Status:__0x_08x_n
call sub.ntext.dll_DbgPrint
add esp, 8
cmp dword [ebp - 4], 0
je 0x7d707cea
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call sym.kernel32_wrapper.dll_GetProcessHeap
push eax
call dword [sym.imp.ntext.dll_RtlFreeHeap]
mov eax, dword [ebp - 4]
jmp 0x7d707d41
mov edx, dword [ebp + 0x18]
cmp edx, dword [ebp - 8]
jb 0x7d707d17
cmp dword [ebp + 0x14], 0
jne 0x7d707d01
mov dword [ebp - 4], 0xc0000005
jmp 0x7d707d15
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call sub.ntext.dll_memcpy
add esp, 0xc
jmp 0x7d707d1e
mov dword [ebp - 4], 0xc0000004
mov eax, dword [ebp - 0xc]
push eax
push 0
call sym.kernel32_wrapper.dll_GetProcessHeap
push eax
call dword [sym.imp.ntext.dll_RtlFreeHeap]
cmp dword [ebp + 0x1c], 0
je 0x7d707d3e
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x7d70acd0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 8], 0
je 0x7d70acea
cmp dword [ebp + 0xc], 1
jl 0x7d70acea
cmp dword [ebp + 0x10], 0xffffffff
jge 0x7d70acf8
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d70ada7
push 0x18
push 0
mov eax, dword [ebp + 8]
push eax
call sub.ntext.dll_memset
add esp, 0xc
cmp dword [ebp + 0x10], 0xffffffff
jne 0x7d70ad15
mov dword [ebp + 0x10], 0x7d0
push 0
push 0
push 1
push 0
call sym.kernel32_wrapper.dll_CreateEventA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x7d70ad2f
xor eax, eax
jmp 0x7d70ada7
push 0
push 0
push 1
push 0
call sym.kernel32_wrapper.dll_CreateEventA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x7d70ad52
mov ecx, dword [ebp - 4]
push ecx
call sym.kernel32_wrapper.dll_CloseHandle
xor eax, eax
jmp 0x7d70ada7
lea edx, [ebp - 0x2c]
push edx
call sym.kernel32_wrapper.dll_GetNativeSystemInfo
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx + ecx + 8], eax
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + ecx + 8], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x14], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x7d70b2e0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.kernel32_wrapper.dll_CreateRemoteThread
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x20

Function at 0x7d70b9b0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push 0x7d73ea40
call sym.kernel32_wrapper.dll_GetModuleHandleA
mov dword [ebp - 4], eax
push str.SetThreadStackGuarantee
mov eax, dword [ebp - 4]
push eax
call sym.kernel32_wrapper.dll_GetProcAddress
mov dword [0x7d73f990], eax
cmp dword [0x7d73f990], 0
je 0x7d70b9ef
mov ecx, dword [ebp + 8]
push ecx
call dword [0x7d73f990]
jmp 0x7d70ba21
mov edx, dword [0x7d73f99c]
mov dword [ebp - 8], edx
mov eax, dword [0x7d73f99c]
add eax, 1
mov dword [0x7d73f99c], eax
cmp dword [ebp - 8], 0
jne 0x7d70ba1c
mov ecx, dword [ebp + 8]
push ecx
push str.SetThreadStackGuarantee:_stub_n
call sub.ntext.dll_DbgPrint
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x7d70c5a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 0x110]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0xf0
jbe 0x7d70c5c4
xor eax, eax
jmp 0x7d70c647
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.ntext.dll_RtlInitUnicodeString]
lea eax, [ebp + 0x18]
push eax
push 0x100
lea ecx, [ebp - 0x110]
push ecx
push 2
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_NtQueryValueKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x7d70c60f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d70c647
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
cmp eax, dword [ebp + 0x10]
je 0x7d70c628
push 0x65d
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d70c647
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call sub.ntext.dll_memcpy
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x7d70ca80
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_BaseThreadInitThunk___n
call sub.ntext.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], str.kernel32_wrapper.dll
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.BaseThreadInitThunk
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sym.kernel32_wrapper.dll_RaiseException

Function at 0x7d70cae0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push str.WARNING:_calling_stub_WerpNotifyLoadStringResourceEx___n
call sub.ntext.dll_DbgPrint
add esp, 4
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 8], 0x7d73f3e8
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 8], str.WerpNotifyLoadStringResourceEx
lea edx, [ebp - 8]
push edx
push 2
push 1
push 0x80000100
call sym.kernel32_wrapper.dll_RaiseException

Function at 0x7d70d590
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0xc], eax
cmp dword [0x7d73f54c], 0xffffffff
je 0x7d70d5ab
jmp 0x7d70d619
mov dword [0x7d73f54c], 0
push 0
push 0
push 0x7d73f570
call sym.kernel32_wrapper.dll_GetEnvironmentVariableA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x7d70d610
mov eax, dword [ebp - 4]
push eax
call fcn.7d70d6a0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x7d70d610
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push str.DEBUGCHANNEL
call sym.kernel32_wrapper.dll_GetEnvironmentVariableA
cmp eax, dword [ebp - 4]
jae 0x7d70d604
mov eax, dword [ebp - 8]
push eax
call fcn.7d70d6f0
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.7d70d680
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call sub.kernel32.dll_SetLastError
mov esp, ebp
pop ebp
ret