joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d280840
Capabilities:
Check mutex on windows
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
push str.SBIE_ServiceManager_Mutex
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, eax
test ebx, ebx
jne 0x7d280870
push str.SBIE_ServiceManager_Mutex
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
test ebx, ebx
je 0x7d28087c
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push edi
push str.SbieSvc
call fcn.7d281bd0
xor ebp, ebp
mov dword [esp + 0x10], ebp
call fcn.7d282600
mov edi, dword [esp + 0x24]
mov esi, eax
mov dword [esp + 0x14], esi
cmp word [esi], bp
je 0x7d2808fa
push edi
push esi
call sub.ntdll.dll__wcsicmp
add esp, 8
test eax, eax
je 0x7d28098b
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d2808c0
sub ecx, edx
mov eax, esi
sar ecx, 1
inc ebp
add ebp, ecx
mov dword [esp + 0x10], ebp
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7d2808e0
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], cx
jne 0x7d2808a2
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d280900
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ebp]
lea eax, [eax*2 + 0x10]
push eax
call fcn.7d221505
mov esi, dword [esp + 0x10]
mov ebp, eax
add esi, esi
push esi
push dword [esp + 0x18]
push ebp
call sub.ntdll.dll_memcpy
add esp, 0xc
mov ecx, edi
sub esi, edi
lea edx, [esi + ebp]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x7d280940
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x7d280953
mov eax, dword [esp + 0x10]
sub edi, ecx
inc eax
sar edi, 1
add eax, edi
push 1
push str.SbieSvc
lea esi, [eax + eax]
xor eax, eax
mov word [esi + ebp], ax
call fcn.7d221de3
mov edi, eax
test edi, edi
jne 0x7d280992
mov esi, 0xc0000001
jmp 0x7d2809c0
mov esi, 0xc0000035
jmp 0x7d2809c6
push str.SandboxedServices
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esi + 2]
push eax
push ebp
push 7
push 0
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push edi
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
push ebp
call fcn.7d221537
pop edi
pop ebp
test ebx, ebx
je 0x7d2809da
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SbieSvc
call fcn.7d281bd0
push dword [esp + 0xc]
call fcn.7d221537
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x7d280d80
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
call fcn.7d2826f0
mov esi, eax
test esi, esi
je 0x7d280dcc
push esi
call fcn.7d284440
test al, al
jne 0x7d280dd5
push 0x11
push str.clr_optimization_
push esi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d280dc4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
pop esi
add esp, 8
ret 0x2c
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
add esp, 8
ret 0x2c
push 1
push esi
call fcn.7d221de3
mov esi, eax
test esi, esi
jne 0x7d280df4
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
add esp, 8
ret 0x2c
cmp dword [esp + 0x14], 0xffffffff
push ebx
push ebp
mov ebp, dword [sym.imp.ntdll.dll_NtSetValueKey]
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
je 0x7d280e31
push str.Type
lea eax, [esp + 0x14]
push eax
call edi
push 4
lea eax, [esp + 0x24]
push eax
push 4
push 0
lea eax, [esp + 0x20]
push eax
push esi
call ebp
test eax, eax
js 0x7d280f59
cmp dword [esp + 0x24], 0xffffffff
je 0x7d280e5f
push str.Start
lea eax, [esp + 0x14]
push eax
call edi
push 4
lea eax, [esp + 0x28]
push eax
push 4
push 0
lea eax, [esp + 0x20]
push eax
push esi
call ebp
test eax, eax
js 0x7d280f59
cmp dword [esp + 0x28], 0xffffffff
je 0x7d280e8d
push str.ErrorControl
lea eax, [esp + 0x14]
push eax
call edi
push 4
lea eax, [esp + 0x2c]
push eax
push 4
push 0
lea eax, [esp + 0x20]
push eax
push esi
call ebp
test eax, eax
js 0x7d280f59
mov ebx, dword [esp + 0x44]
test ebx, ebx
je 0x7d280ed2
push str.DisplayName
lea eax, [esp + 0x14]
push eax
call edi
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d280ea6
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x20]
push eax
push esi
call ebp
test eax, eax
js 0x7d280f59
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x7d280f18
push str.ImagePath
lea eax, [esp + 0x14]
push eax
call edi
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d280ef0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x20]
push eax
push esi
call ebp
test eax, eax
js 0x7d280f59
mov ebx, dword [esp + 0x3c]
test ebx, ebx
je 0x7d280f74
push str.ObjectName
lea eax, [esp + 0x14]
push eax
call edi
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d280f31
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x20]
push eax
push esi
call ebp
test eax, eax
jns 0x7d280f74
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 8
ret 0x2c
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 8
ret 0x2c
Function at 0x7d282600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push esi
push edi
push 0
push str.SbieSvc
call fcn.7d221de3
mov edi, eax
test edi, edi
je 0x7d2826a3
push str.SandboxedServices
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 8]
push eax
push 0x200
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push edi
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x7d2826a3
cmp dword [esp + 0x18], 7
jne 0x7d2826a3
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x7d2826a3
add eax, 8
push eax
call fcn.7d221505
mov ecx, dword [esp + 0x1c]
mov esi, eax
add ecx, 8
push ecx
push 0
push esi
call sub.ntdll.dll_memset
push dword [esp + 0x28]
lea eax, [esp + 0x30]
push eax
push esi
call sub.ntdll.dll_memcpy
add esp, 0x18
test esi, esi
je 0x7d2826a3
pop edi
mov eax, esi
pop esi
add esp, 0x20c
ret
push 4
call fcn.7d221505
pop edi
pop esi
mov dword [eax], 0
add esp, 0x20c
ret
Function at 0x7d286e70
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x110
cmp dword [esp + 0x118], 0x12340003
je 0x7d286e96
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0x110
ret 0x10
push ebx
mov ebx, dword [esp + 0x120]
lea eax, [esp + 0x10]
push ebp
push esi
push edi
push dword [ebx + 4]
push str.SetServiceStatus__status:___08X_
push 0x82
push eax
call sym.SbieDll.dll_Sbie_snwprintf
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
push 0xe
call sym.SbieDll.dll__SbieApi_MonitorPutMsg_8
mov ebp, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x14]
push str.SBIE_ProcessId
push eax
call ebp
cmp byte [esp + 0x130], 0
mov edi, dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, dword [esp + 0x124]
je 0x7d286f0e
mov eax, dword [0x7d2b7340]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push esi
call edi
jmp 0x7d286f1a
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push str.SBIE_CurrentState
lea eax, [esp + 0x18]
push eax
call ebp
mov eax, dword [ebx + 4]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push esi
call edi
push str.SBIE_StartTicks
lea eax, [esp + 0x18]
push eax
call ebp
cmp dword [ebx + 4], 2
jne 0x7d286f71
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push esi
call edi
jmp 0x7d286f7d
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push str.SBIE_ControlsAccepted
lea eax, [esp + 0x18]
push eax
call ebp
mov eax, dword [ebx + 8]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push esi
call edi
push str.SBIE_Win32ExitCode
lea eax, [esp + 0x18]
push eax
call ebp
mov eax, dword [ebx + 0xc]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push esi
call edi
push str.SBIE_ServiceSpecificExitCode
lea eax, [esp + 0x18]
push eax
call ebp
mov eax, dword [ebx + 0x10]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push esi
call edi
push str.SBIE_CheckPoint
lea eax, [esp + 0x18]
push eax
call ebp
mov eax, dword [ebx + 0x14]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push esi
call edi
push str.SBIE_WaitHint
lea eax, [esp + 0x18]
push eax
call ebp
mov eax, dword [ebx + 0x18]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push esi
call edi
mov eax, dword [ebx + 4]
cmp eax, 4
pop edi
pop esi
pop ebp
pop ebx
jne 0x7d28705c
mov byte [0x7d2de94e], 1
mov eax, 1
add esp, 0x110
ret 0x10
cmp eax, 1
jne 0x7d287066
mov byte [0x7d2de94f], al
mov eax, 1
add esp, 0x110
ret 0x10
Function at 0x7d28b1d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x7d2a4d38
push str.ILIsParent
push dword [0x7d2b6114]
xor bl, bl
call fcn.7d2219c9
push 0x7d2a1a14
push str.ILCombine
push dword [0x7d2b6114]
mov edi, eax
mov dword [esp + 0x1c], edi
call fcn.7d2219c9
push 0x7d2a1a60
push str.SHFree
push dword [0x7d2b6114]
mov esi, eax
mov dword [esp + 0x20], esi
call fcn.7d2219c9
mov ebp, eax
test edi, edi
je 0x7d28b285
test esi, esi
je 0x7d28b285
test ebp, ebp
je 0x7d28b285
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
test esi, esi
je 0x7d28b251
test edi, edi
je 0x7d28b251
push 0
push edi
push esi
call dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
push edi
push esi
call dword [esp + 0x1c]
mov esi, eax
test esi, esi
je 0x7d28b285
mov edi, dword [esp + 0x24]
push edi
push esi
call dword [0x7d2deb34]
test eax, eax
je 0x7d28b282
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
push esi
call ebp
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 0xc
Function at 0x7d28b9a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x454
mov eax, dword [esp + 0x460]
xorps xmm0, xmm0
push esi
push edi
push 0x104
mov dword [eax], 0
mov eax, 0x22
mov word [esp + 0x60], ax
lea eax, [esp + 0x62]
push eax
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
mov dword [esp + 0x60], 0
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 0x80
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea edi, [esp + 0x5c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x7d28ba20
mov ax, word [esp + 0x464]
mov ecx, 8
mov esi, str.explorer.exe_
rep movsd dword es:[edi], dword [esi]
cmp ax, 0x65
jne 0x7d28ba6d
lea ecx, [esp + 0x5c]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x7d28ba50
mov eax, dword [0x7d2a4c54]
mov dword [ecx], eax
mov eax, dword [0x7d2a4c58]
mov dword [ecx + 4], eax
jmp 0x7d28babb
cmp ax, 0x73
jne 0x7d28babb
lea ecx, [esp + 0x5c]
add ecx, 0xfffffffe
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x7d28ba80
mov eax, dword [str._n__select_]
mov dword [ecx], eax
mov eax, dword [0x7d2a4c64]
mov dword [ecx + 4], eax
mov eax, dword [0x7d2a4c68]
mov dword [ecx + 8], eax
mov eax, dword [0x7d2a4c6c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x7d2a4c70]
mov dword [ecx + 0x10], eax
mov eax, dword [0x7d2a4c74]
mov dword [ecx + 0x14], eax
lea edi, [esp + 0x5c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x7d28bac2
mov eax, dword [0x7d2a1d68]
mov edx, dword [esp + 0x460]
mov esi, edx
mov dword [edi], eax
nop
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x7d28bae0
lea edi, [esp + 0x5c]
sub edx, esi
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x7d28baf4
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x5c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x7d28bb15
sub edx, esi
sar edx, 1
cmp word [esp + edx*2 + 0x5a], 0x5c
jne 0x7d28bb33
xor ecx, ecx
mov word [esp + edx*2 + 0x5a], cx
lea edi, [esp + 0x5c]
add edi, 0xfffffffe
nop word [eax + eax]
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x7d28bb40
mov dword [edi], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x7d28bba2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esp + 0x464]
push str._S___d_
push 0x8a2
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x10
xor eax, eax
pop edi
pop esi
add esp, 0x454
ret 0xc
push dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 8]
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x454
ret 0xc
Function at 0x7d290470
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 0
push eax
push 0x80000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x7d2904d7
mov eax, dword [esp + 0x14]
test eax, eax
je 0x7d2904b9
cmp eax, 0x80000
jb 0x7d2904d7
push eax
push dword [0x7d2b6d8c]
push 0x89d
call sym.SbieDll.dll_SbieApi_Log
add esp, 0xc
push ebx
mov edi, 0x36b4
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x7d2904c7
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov byte [ecx + ebp], 0
pop ebp
pop ebx
ret 8
Function at 0x7d2905a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x144
push ebx
push ebp
mov ebp, dword [esp + 0x150]
push esi
push edi
push 1
push str.HideOtherBoxes
push 0
call sym.SbieDll.dll_SbieApi_QueryConfBool
xor esi, esi
movzx eax, al
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
xor ebx, ebx
push 0xd8
lea eax, [esp + 0x7c]
push eax
mov eax, ebx
or eax, 0x20000000
push eax
push str.HideHostProcess
push 0
call sym.SbieDll.dll_SbieApi_QueryConf
test eax, eax
js 0x7d290668
test esi, esi
jne 0x7d290615
push 0x55f0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x7d290687
mov edi, esi
lea ecx, [esp + 0x78]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d290620
mov eax, edi
sub ecx, edx
sub eax, esi
sar ecx, 1
sar eax, 1
add eax, 2
add eax, ecx
cmp eax, 0x2af8
ja 0x7d290675
lea esi, [ecx*2 + 2]
push esi
lea eax, [esp + 0x7c]
push eax
push edi
call sub.ntdll.dll_memcpy
add edi, esi
xor eax, eax
mov esi, dword [esp + 0x1c]
add esp, 0xc
inc ebx
mov word [edi], ax
jmp 0x7d2905d0
cmp eax, 0xc0000023
jne 0x7d290687
inc ebx
jmp 0x7d2905d0
push str.__HideProcess
push 0x906
call sym.SbieDll.dll_SbieApi_Log
add esp, 8
mov ebx, dword [ebp]
add ebx, ebp
cmp ebx, ebp
je 0x7d290760
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push dword [ebx + 0x44]
call sym.SbieDll.dll_SbieApi_QueryProcess
cmp dword [esp + 0x14], 0
je 0x7d2906d1
cmp word [esp + 0x18], 0
je 0x7d2906d1
push dword [0x7d2b730c]
lea eax, [esp + 0x1c]
push eax
call sub.ntdll.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x7d290781
test esi, esi
je 0x7d29074d
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x7d29074d
push 0x5c
push eax
call sub.ntdll.dll_wcschr
mov edi, eax
add esp, 8
test edi, edi
je 0x7d2906f2
add edi, 2
jmp 0x7d2906f5
mov edi, dword [ebx + 0x3c]
cmp word [esp + 0x18], 0
je 0x7d290711
push 9
push 0x7d2995cc
push edi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d29074d
mov eax, dword [esp + 0x10]
cmp word [eax], 0
je 0x7d29074d
nop dword [eax + eax]
push esi
push edi
call sub.ntdll.dll__wcsicmp
add esp, 8
test eax, eax
je 0x7d290781
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7d290733
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], cx
jne 0x7d290720
mov eax, dword [ebx]
mov ebp, ebx
mov esi, dword [esp + 0x10]
lea ebx, [eax + ebp]
cmp ebx, ebp
jne 0x7d290694
test esi, esi
je 0x7d290774
push esi
push 4
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret 4
mov eax, dword [ebx]
test eax, eax
je 0x7d29078f
add dword [ebp], eax
mov eax, dword [ebp]
jmp 0x7d290751
mov dword [ebp], 0
xor eax, eax
jmp 0x7d290751
Function at 0x7d292240
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
add eax, 8
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, eax
test ecx, ecx
jne 0x7d29226c
push eax
push 0x901
call sym.SbieDll.dll_SbieApi_Log
add esp, 8
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [str.sbox5.58.0]
mov dword [ecx], eax
lea eax, [ecx + 8]
mov dword [ecx + 4], 0
ret 4
Function at 0x401037
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x454618]
mov dword [ebp - 0x28], eax
mov eax, dword [0x45461c]
xor ebx, ebx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
call fcn.00401030
mov eax, dword [0x454620]
add dword [ebp - 0x14], 0x23f
mov dword [ebp - 0x30], eax
mov eax, dword [0x454624]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x1a451c4], 0xc
mov dword [ebp - 4], eax
jne 0x4010b9
push ebx
lea eax, [ebp - 0x34]
push eax
push ebx
lea eax, [ebp - 0x43c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov eax, dword [0x1a451c4]
cmp eax, 0xfa9
jne 0x4010d5
mov dword [0x1a451c0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ed
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x1a45114], ebx
mov eax, dword [ebp - 0x14]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1a451bc], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
sub esi, dword [ebp - 8]
cmp dword [0x1a451c4], 0xc
mov dword [ebp - 4], eax
jne 0x40114f
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x14], 0x61c88647
sub edi, eax
dec dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
jne 0x401089
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x404b17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45333c]
jne 0x404b21
repz ret
jmp fcn.0040acf6

Function at 0x40bd24
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c1c
and dword [ebp - 4], 0
cmp dword [0x45d9f4], 0
mov ebx, eax
jne 0x40bdd5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40be86
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40be86
push eax
call fcn.00404baa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45d9f4], eax
call esi
push eax
call fcn.00404baa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45d9f8], eax
call esi
push eax
call fcn.00404baa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45d9fc], eax
call esi
push eax
call fcn.00404baa
pop ecx
mov dword [0x45da04], eax
test eax, eax
je 0x40bdd5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404baa
pop ecx
mov dword [0x45da00], eax
mov eax, dword [0x45da00]
cmp eax, ebx
je 0x40be2d
cmp dword [0x45da04], ebx
je 0x40be2d
push eax
call fcn.00404c25
push dword [0x45da04]
mov esi, eax
call fcn.00404c25
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40be2d
test edi, edi
je 0x40be2d
call esi
test eax, eax
je 0x40be24
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40be24
test byte [ebp - 0xc], 1
jne 0x40be2d
or dword [ebp + 0x10], 0x200000
jmp 0x40be66
mov eax, dword [0x45d9f8]
cmp eax, ebx
je 0x40be66
push eax
call fcn.00404c25
pop ecx
test eax, eax
je 0x40be66
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40be66
mov eax, dword [0x45d9fc]
cmp eax, ebx
je 0x40be66
push eax
call fcn.00404c25
pop ecx
test eax, eax
je 0x40be66
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45d9f4]
call fcn.00404c25
pop ecx
test eax, eax
je 0x40be86
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40be88
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret