joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d22145b
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x7d286bc0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
call fcn.7d221744
cmp qword [rax + 0x138], 0
je 0x7d286d49
mov r8d, 0x12
lea rdx, str.RegistryMachine_
mov rcx, rbx
call sub.ntdll.dll__wcsnicmp
test eax, eax
jne 0x7d286d49
lea r8d, [rax + 0xa]
lea rdx, str.Components
lea rcx, [rbx + 0x24]
call sub.ntdll.dll__wcsnicmp
test eax, eax
je 0x7d286c71
mov r8d, 9
lea rdx, str.Software_
lea rcx, [rbx + 0x24]
call sub.ntdll.dll__wcsnicmp
test eax, eax
jne 0x7d286d49
add rbx, 0x36
lea r8d, [rax + 0xc]
mov rcx, rbx
lea rdx, str.Wow6432Node_
call sub.ntdll.dll__wcsnicmp
test eax, eax
jne 0x7d286c5a
add rbx, 0x18
lea rdx, str.MicrosoftWindowsCurrentVersionSideBySide
mov rcx, rbx
call sub.ntdll.dll__wcsicmp
test eax, eax
jne 0x7d286d49
mov rdx, qword [str._registrymachine_systemcurrentcontrolset_servicesimfsbSvc]
lea rax, [rsp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x68], rax
xor ebx, ebx
mov dword [rsp + 0x58], 0x30
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x60], rbx
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x70], 0x40
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r8, [rsp + 0x58]
mov edx, 0x20019
lea rcx, [rsp + 0xb8]
call qword [0x7d2acd90]
test eax, eax
je 0x7d286cd3
mov qword [rsp + 0xb8], rbx
jmp 0x7d286d38
cmp qword [rsp + 0xb8], rbx
je 0x7d286d38
lea rdx, str.PreferExternalManifest
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov r8d, 2
mov dword [rsp + 0x20], 0x18
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
je 0x7d286d5c
mov dword [rsp + 0x44], ebx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.PreferExternalManifest
mov ecx, 0x89d
call sym.imfsbDll.dll_SbieApi_Log
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
cmp dword [rsp + 0x44], 4
jne 0x7d286d2a
cmp dword [rsp + 0x48], 4
jne 0x7d286d2a
cmp dword [rsp + 0x4c], ebx
je 0x7d286d2a
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xa0]
mov qword [rdi], rax
mov al, 1
add rsp, 0x90
pop rdi
ret

Function at 0x7d22147e
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d26fd30
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x68
call fcn.7d221988
test rax, rax
je 0x7d26fd5b
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.7d221631
add rsp, 0x20
pop rbx
ret
Function at 0x7d221497
Capabilities:
Read file on windows

Disassembly:
jmp 0x7d258c30
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rsi, r8
mov ebp, edx
mov rbx, rcx
test edx, edx
je 0x7d258ccb
xor r14d, r14d
nop dword [rax]
cmp dword [rbx + 0x10], r14d
jne 0x7d258cb3
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
lea rdi, [rbx + 0x18]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x30], 0xfe0
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov ecx, r14d
mov qword [rbx + 8], rdi
test eax, eax
cmovns ecx, dword [rsp + 0x58]
mov dword [rbx + 0x10], ecx
js 0x7d258ccd
test ecx, ecx
je 0x7d258ce8
mov rax, qword [rbx + 8]
movzx ecx, byte [rax]
mov byte [rsi], cl
inc rsi
inc qword [rbx + 8]
dec dword [rbx + 0x10]
add ebp, 0xffffffff
jne 0x7d258c60
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov eax, 0xc0000011
jmp 0x7d258ccd
Function at 0x7d2214ba
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
jmp 0x7d272080
sub rsp, 0xd8
lea r8, [rsp + 0xe0]
mov edx, 0xf01ff
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
test eax, eax
js 0x7d272274
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rbx
call fcn.7d270a60
mov rcx, qword [rsp + 0xe0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x7d27226c
mov qword [rsp + 0xf0], rbp
mov ecx, 0x4000
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0xd0], rdi
call fcn.7d2212da
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rbp
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x7d272110
mov ecx, 0x4000
call fcn.7d2212da
xor ebx, ebx
mov rdx, rax
mov ecx, 0x3ffc
mov rdi, rax
mov word [rax], bx
call qword [sym.imp.ntdll.dll_RtlGetCurrentDirectory_U]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 7]
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
mov edx, 0x120089
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov word [rdi + 0x3ffc], bx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x7d2721c9
mov ecx, 0x4000
call fcn.7d2212da
lea r8, [rsp + 0xe0]
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call sym.imfsbDll.dll_SbieDll_GetHandlePath
test eax, eax
js 0x7d2721c0
mov rcx, rbx
call sym.imfsbDll.dll_SbieDll_TranslateNtToDosPath
test al, al
je 0x7d2721c0
mov rcx, rdi
sub rcx, rbx
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x7d2721b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x68]
call sub.ntdll.dll_memset
xor eax, eax
mov dword [rsp + 0x60], 0x68
mov qword [rsp + 0x40], rax
lea rcx, str.THREAD
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rdi
lea rax, [rsp + 0x40]
mov dword [rsp + 0x9c], 0x80
mov qword [rsp + 0x28], rax
mov rdx, rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call sym.imfsbDll.dll_SbieDll_RunSandboxed
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0xf0]
test eax, eax
je 0x7d272263
cmp dword [0x7d2abfb4], 0x3ab1
mov rcx, qword [rsp + 0x40]
jae 0x7d272258
or edx, 0xffffffff
jmp 0x7d27225d
mov edx, 0xfa
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd8
ret

Function at 0x7d2214dd
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22f200
push rbx
sub rsp, 0x20
inc dword [rcx + 0x120]
mov rbx, rcx
mov r8d, dword [rcx + 0x120]
cmp r8d, 8
jle 0x7d22f22d
lea rdx, [0x7d290c74]
mov ecx, 0x906
call sym.imfsbDll.dll_SbieApi_Log
cmp dword [rbx + 0x120], 0xc
jl 0x7d22f240
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x20
pop rbx
ret
Function at 0x7d2214ec
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x7d25fae0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x130
movzx r8d, byte [rdx + 0xe]
mov r15, rdx
movzx eax, byte [rdx + 0xf]
mov r13, rcx
movzx r10d, byte [rdx + 0xd]
lea rcx, [rsp + 0xd0]
movzx r11d, byte [rdx + 0xc]
movzx ebx, byte [rdx + 0xb]
movzx edi, byte [rdx + 0xa]
movzx esi, byte [rdx + 9]
movzx ebp, byte [rdx + 8]
movzx r14d, word [rdx + 6]
movzx r9d, word [rdx + 4]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], r8d
mov r8d, dword [rdx]
lea rdx, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call sym.imfsbDll.dll_Sbie_swprintf
mov rax, qword [r13 + 8]
mov r14, qword [rax]
test r14, r14
je 0x7d25fc3d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r14 + 0x1e]
movzx edx, byte [r14 + 0x1d]
movzx r8d, byte [r14 + 0x1c]
movzx eax, byte [r14 + 0x1f]
movzx r10d, byte [r14 + 0x1b]
movzx r11d, byte [r14 + 0x1a]
movzx ebx, byte [r14 + 0x19]
movzx edi, byte [r14 + 0x18]
movzx esi, word [r14 + 0x16]
movzx r9d, word [r14 + 0x14]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x50], edx
lea rdx, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x48], r8d
mov r8d, dword [r14 + 0x10]
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call sym.imfsbDll.dll_Sbie_swprintf
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0xd0]
sub rdx, rax
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x7d25fc26
add rax, 2
test cx, cx
jne 0x7d25fc10
xor eax, eax
jmp 0x7d25fc2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x7d25fc6c
jg 0x7d25fc3d
mov r14, qword [r14]
test r14, r14
jne 0x7d25fb90
mov ecx, 0x20
call fcn.7d221988
mov r8, rax
movups xmm0, xmmword [r15]
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [r13 + 8]
test r14, r14
je 0x7d25fc65
mov rdx, r14
call fcn.7d221438
jmp 0x7d25fc6c
xor edx, edx
call fcn.7d2214e7
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x7d221537
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d28a790
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp rcx, qword [0x7d2abf48]
mov rdi, rcx
jne 0x7d28a850
lea rdx, str.GetAppliedGPOListInternalW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
lea r8, [0x7d28a6c0]
lea rcx, str.GetAppliedGPOList
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8b0], rax
test rax, rax
je 0x7d28a843
lea rdx, str.GetVersionExW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetVersionExA
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x7d28a730]
mov rdx, rbx
lea rcx, str.GetVersionExW
mov rdi, rax
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8b8], rax
test rax, rax
je 0x7d28a843
lea r8, [0x7d28a6e0]
mov rdx, rdi
lea rcx, str.GetVersionExA
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8c0], rax
test rax, rax
jne 0x7d28a8c2
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, str.RegisterGPNotification
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnregisterGPNotification
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x7d28a920]
mov rdx, rbx
lea rcx, str.RegisterGPNotification
mov rdi, rax
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8a0], rax
test rax, rax
je 0x7d28a843
lea r8, [0x7d28a940]
mov rdx, rdi
lea rcx, str.UnregisterGPNotification
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8a8], rax
test rax, rax
jne 0x7d28a8c2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x7d221541
Capabilities:
Terminate process

Disassembly:
jmp 0x7d22ed60
sub rsp, 0x28
mov rcx, qword [0x7d2ac010]
mov edx, 0x80
call fcn.7d221505
test rax, rax
jne 0x7d22ed90
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x28
ret

Function at 0x7d221564
Capabilities:
Print debug messages
Terminate process

Disassembly:
jmp 0x7d223940
test rcx, rcx
jne fcn.7d221938
ret
Function at 0x7d221587
Capabilities:
Query environment variable

Disassembly:
jmp 0x7d22d570
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xe0
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
jne 0x7d22d5a2
mov rsi, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret
lea ecx, [rdi*2 + 0x10]
mov qword [rsp + 0xf0], rbx
call fcn.7d2212da
mov r8d, edi
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
xor edx, edx
xor edi, edi
mov word [rbx + rcx*2], di
lea rcx, [rsp + 0x70]
lea r8d, [rdi + 0x68]
call sub.ntdll.dll_memset
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov rdx, rbx
lea rax, [rsp + 0x50]
mov dword [rsp + 0xac], 0x81
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov word [rsp + 0xb0], di
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, rbx
mov esi, eax
call fcn.7d221938
mov rbx, qword [rsp + 0xf0]
test esi, esi
je 0x7d22d682
mov rcx, qword [rsp + 0x50]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne al
mov rsi, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret
Function at 0x7d2215b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x7d223f80
mov dword [rsp + 0x20], r9d
push rdi
push r12
push r15
sub rsp, 0x40
mov r15, r8
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x7d224185
test r8, r8
je 0x7d224185
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rsi
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x28], r13
mov rbp, rsi
mov qword [rsp + 0x20], r14
nop dword [rax]
inc rbp
cmp word [rdx + rbp*2], 0
jne 0x7d223fd0
nop word [rax + rax]
inc rsi
cmp word [r8 + rsi*2], 0
jne 0x7d223fe0
mov r8b, 1
lea r9, [rsp + 0x68]
movzx edx, r8b
xor ecx, ecx
call fcn.7d2218d4
mov ecx, dword [rsp + 0x68]
mov r13, rax
shr ecx, 1
mov dword [rsp + 0x68], ecx
add ecx, esi
add ecx, ebp
lea ebx, [rcx*2 + 0x80]
mov ecx, ebx
call fcn.7d2212da
mov r14, rax
mov dword [rax], ebx
mov dword [rax + 4], 0x1205
sub rax, rdi
nop dword [rax]
movzx ecx, word [rdi]
mov word [rax + rdi + 8], cx
lea rdi, [rdi + 2]
test cx, cx
jne 0x7d224030
mov rcx, qword [rsp + 0x80]
lea rdi, [r14 + 0x70]
mov eax, dword [rcx + 0x3c]
mov dword [r14 + 0x64], eax
movzx eax, word [rcx + 0x40]
mov dword [r14 + 0x68], eax
mov eax, dword [rsp + 0x78]
mov dword [r14 + 0x6c], eax
mov eax, edi
sub eax, r14d
mov dword [r14 + 0x50], ebp
mov dword [r14 + 0x4c], eax
test ebp, ebp
je 0x7d22408b
mov ebx, ebp
mov rdx, r12
add rbx, rbx
mov rcx, rdi
mov r8, rbx
call sub.ntdll.dll_memcpy
add rdi, rbx
xor ebp, ebp
mov word [rdi], bp
add rdi, 2
mov eax, edi
mov dword [r14 + 0x58], esi
sub eax, r14d
mov dword [r14 + 0x54], eax
test esi, esi
je 0x7d2240bb
mov ebx, esi
mov rdx, r15
add rbx, rbx
mov rcx, rdi
mov r8, rbx
call sub.ntdll.dll_memcpy
add rdi, rbx
mov rsi, qword [rsp + 0x30]
mov word [rdi], bp
add rdi, 2
mov eax, edi
sub eax, r14d
mov dword [r14 + 0x5c], eax
mov eax, dword [rsp + 0x68]
mov dword [r14 + 0x60], eax
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x7d2240f9
mov r8d, eax
mov rdx, r13
add r8, r8
mov rcx, rdi
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdi, [rdi + rax*2]
mov rcx, r14
mov word [rdi], bp
call sym.imfsbDll.dll_SbieDll_CallServer
mov rcx, r14
mov rbx, rax
call fcn.7d221938
mov r14, qword [rsp + 0x20]
test rbx, rbx
je 0x7d224150
mov edi, dword [rbx + 4]
test edi, edi
jne 0x7d224146
mov rcx, qword [rbx + 8]
lea ebp, [rdi + 1]
mov rdx, qword [rsp + 0x88]
mov qword [rdx], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rdx + 8], rcx
mov eax, dword [rbx + 0x18]
mov dword [rdx + 0x10], eax
mov eax, dword [rbx + 0x1c]
mov dword [rdx + 0x14], eax
mov rcx, rbx
call fcn.7d221938
jmp 0x7d224155
mov edi, 0x53d
mov rbx, qword [rsp + 0x60]
test r13, r13
je 0x7d224167
mov rcx, r13
call fcn.7d221938
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13, qword [rsp + 0x28]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r15
pop r12
pop rdi
ret
Function at 0x7d2215b9
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x7d265f10
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x138]
sub rsp, 0x230
mov rax, qword gs:[0x60]
xor edi, edi
mov r9d, edi
mov rcx, qword [rax + 0x18]
lea r14d, [rdi + 0x64]
mov rdx, qword [rcx + 0x10]
cmp qword [rdx + 0x30], rdi
je 0x7d265f85
cmp word [rdx + 0x5a], 0x1a
jne 0x7d265f7c
cmp word [rdx + 0x58], 0x18
jne 0x7d265f7c
mov rcx, qword [rdx + 0x60]
movzx eax, word [rcx + 8]
or ax, 0x20
cmp ax, 0x62
jne 0x7d265f7c
movzx eax, word [rcx + 0xa]
or ax, 0x20
cmp ax, r14w
je 0x7d265f81
mov rdx, qword [rdx]
jmp 0x7d265f48
mov r9, qword [rdx + 0x30]
mov rax, qword [r9 + 0x942c0]
lea rdx, [rsp + 0x20]
mov rbx, qword [r9 + 0x94368]
mov r8d, 0x104
mov rcx, r9
call rax
mov rdx, rax
test eax, eax
je 0x7d266016
add edx, 0xfffffff4
mov eax, 0x44
mov word [rsp + rdx*2 + 0x20], ax
inc edx
mov eax, 0x67
mov word [rsp + rdx*2 + 0x20], ax
inc edx
lea ecx, [rax - 0x26]
lea r8d, [rax + 5]
mov word [rsp + rdx*2 + 0x20], cx
inc edx
lea ecx, [rax + 9]
mov word [rsp + rdx*2 + 0x20], cx
inc edx
lea ecx, [rax + 2]
mov word [rsp + rdx*2 + 0x20], cx
inc edx
lea ecx, [rax - 0x39]
mov word [rsp + rdx*2 + 0x20], cx
inc edx
mov word [rsp + rdx*2 + 0x20], r14w
inc edx
mov word [rsp + rdx*2 + 0x20], r8w
inc edx
lea ecx, [rdx + 1]
mov word [rsp + rdx*2 + 0x20], r8w
mov word [rsp + rcx*2 + 0x20], di
lea rcx, [rsp + 0x20]
call rbx
lea r11, [rsp + 0x230]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x7d2215eb
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x7d281e40
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
cmp dword [0x7d2abfb0], 0xa
je 0x7d281e62
xor eax, eax
add rsp, 0x170
pop rbp
ret
lea rdx, str.REGISTRYMACHINESOFTWAREMicrosoftInternet_Explorer
mov qword [rsp + 0x190], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x40], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], 0
mov edx, 0x20019
mov dword [rsp + 0x58], 0x40
lea rcx, [rbp + 0x88]
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x7d281fd2
lea rdx, str.svcVersion
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x100
call sub.ntdll.dll_memset
mov rcx, qword [rbp + 0x88]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
mov r8d, 2
mov dword [rsp + 0x20], 0xfc
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jns 0x7d281f79
lea rdx, [0x7d28ee28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x100
call sub.ntdll.dll_memset
mov rcx, qword [rbp + 0x88]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
mov r8d, 2
mov dword [rsp + 0x20], 0xfc
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d281fac
cmp dword [rsp + 0x74], 1
jne 0x7d281fac
lea rcx, [rsp + 0x7c]
call sub.ntdll.dll__wtoi
mov rcx, qword [rbp + 0x88]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
mov rcx, qword [rbp + 0x88]
mov ebx, dword [rbp + 0x80]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
mov ebx, dword [rbp + 0x80]
mov eax, ebx
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret

Function at 0x7d2215f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x7d26b8c0
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov r8, qword [rdx + 0x30]
mov rax, qword [r8]
cmp rax, r8
je 0x7d26b8ee
nop dword [rax]
cmp qword [rax + 0x10], rcx
je 0x7d26b8f1
mov rax, qword [rax]
cmp rax, r8
jne 0x7d26b8e0
xor al, al
ret
mov ecx, 0xffff
mov word [rax + 0x4c], cx
mov al, 1
ret
Function at 0x7d221631
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d26df40
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rax, [0x7d296cf8]
mov rbx, rcx
mov qword [rcx], rax
mov rsi, r8
lea rax, [0x7d296cb0]
mov rdi, rdx
mov qword [rcx + 0x20], rax
lea rcx, [0x7d2905d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebp, ebp
mov qword [rbx + 0x30], rax
test rax, rax
je 0x7d26e05e
lea rdx, str.DragQueryFileW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, [0x7d296d88]
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, str.ILGetSize
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, str.SHGetPathFromIDListW
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, str.SHILCreateFromPath
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x30]
lea rdx, [0x7d296de0]
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x7d2ad070], ebp
mov qword [rbx + 0x60], rax
jne 0x7d26e026
lea rcx, str.FileName
call qword [0x7d2ac640]
mov dword [0x7d2ad070], eax
cmp dword [0x7d2ad074], ebp
jne 0x7d26e041
lea rcx, str.FileNameW
call qword [0x7d2ac640]
mov dword [0x7d2ad074], eax
cmp dword [0x7d2ad078], ebp
jne 0x7d26e06a
lea rcx, str.Shell_IDList_Array
call qword [0x7d2ac640]
mov dword [0x7d2ad078], eax
jmp 0x7d26e06a
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x50], rbp
mov qword [rbx + 0x58], rbp
mov qword [rbx + 8], rdi
test rdi, rdi
je 0x7d26e07c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov qword [rbx + 0x10], rsi
test rsi, rsi
je 0x7d26e0b0
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x7d26e0b0
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rsi
call rax
mov dword [rbx + 0x18], eax
cmp eax, 0xffffffff
mov rax, rbx
mov dword [rbx + 0x1c], 1
je 0x7d26e0ba
jmp 0x7d26e0bd
mov dword [rbx + 0x1c], 1
mov rax, rbx
mov dword [rbx + 0x18], ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x7d221677
Capabilities:
Get system information on windows

Disassembly:
jmp 0x7d25e440
push rbx
sub rsp, 0x50
mov eax, dword [0x7d2abfb0]
movzx ebx, cl
dec eax
cmp eax, 1
jbe 0x7d25e48f
cmp byte [0x7d2abfab], 0
jne 0x7d25e48f
test cl, cl
je 0x7d25e47b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
movzx ebx, bl
cmp dword [rsp + 0x40], 2
cmovb ebx, eax
mov rcx, qword [str.hF_]
movzx edx, bl
add rsp, 0x50
pop rbx
jmp fcn.7d25dce0
mov al, 1
add rsp, 0x50
pop rbx
ret