joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f870
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x270
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx esi, dl
lea rdx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionMisc.
mov edi, 1
test rdx, rdx
mov rbp, r8
mov rbx, rcx
mov dword [rsp + 0x30], edi
je 0x14001f93b
lea r12, str.DumpEnableExceptionHelper
test r12, r12
je 0x14001f93b
lea rax, [rsp + 0x40]
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f937
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, edi
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [rsp + 0x30]
mov r8d, 0x60
lea rax, str.InitExceptionHandlerW
lea r9, str._s____Exception_Helper__nEnable____d_.
lea rdx, str..eh_ExceptionHelper.cpp
lea ecx, [r8 - 0x1c]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.140038200
test edi, edi
jne 0x14001f974
or eax, 0xffffffff
jmp 0x14001fa6d
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea r12d, [rax + 2]
not rcx
sub rcx, 1
cmp rcx, 0x1e8
jb 0x14001f99b
mov word [rsp + 0x50], ax
jmp 0x14001f9b6
mov edx, r12d
mov rcx, rbx
call fcn.140048a90
test eax, eax
jne 0x14001f9af
mov r8, rbx
jmp 0x14001f9dd
mov word [rsp + 0x50], 0
lea rcx, [rsp + 0x52]
mov r8d, 0x208
xor edx, edx
call fcn.140041940
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, [rsp + 0x50]
lea rcx, [0x140241e20]
mov edx, 0x1e9
call fcn.1400445a0
lea rbx, [0x140242620]
lea r8, [0x140241e20]
mov rcx, rbx
mov edx, 0x209
call fcn.1400445a0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp word [rbx + rcx*2 - 4], 0x5c
je 0x14001fa34
lea r8, [0x1401cd148]
mov edx, 0x209
mov rcx, rbx
call fcn.1400445a0
lea r8, str._04d_02d_02d__02d_02d_02d.dmp
mov edx, 0x209
mov rcx, rbx
call fcn.1400445a0
mov edx, dword [reloc.WS2_32.dll_connect]
test sil, sil
cmovne edx, r12d
mov rcx, rbp
mov dword [reloc.WS2_32.dll_connect], edx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [0x140241e08], rax
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140041910
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14001fca0
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x290
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x70], 0
call fcn.140041940
lea rcx, [rsp + 0x70]
mov edx, 0x105
mov r8d, 2
call fcn.14001faa0
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14001fe49
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x2a8], rdi
mov rdi, qword [rsp + 0x58]
lea rdx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionMisc.
mov ebx, 0x400
shr rdi, 0x14
test rdx, rdx
mov dword [rsp + 0x40], ebx
je 0x14001fdbd
lea rsi, str.DumpMinimumFreeSpaceInMB
test rsi, rsi
je 0x14001fdbd
lea rax, [rsp + 0x50]
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001fdb9
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rsp + 0x40]
lea rsi, str.CheckDiskSpaceAvailableToGenerateDump
lea r9, str._s____Exception_Helper__nMinimumFreeSpaceInMB____d_.
lea rdx, str..eh_ExceptionHelper.cpp
mov r8d, Ordinal_200
mov ecx, 0x44
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call fcn.140038200
cmp edi, ebx
jbe 0x14001fe1a
mov al, 1
mov rbx, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140041910
add rsp, 0x290
pop rsi
ret
mov dword [rsp + 0x30], ebx
lea r9, str._s___Disk_free_space___d__is_less_than_dump_available_space_setting___d_.
lea rdx, str..eh_ExceptionHelper.cpp
mov r8d, 0xcd
mov ecx, 0x44
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call fcn.140038200
xor al, al
jmp 0x14001fdf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, str.CheckDiskSpaceAvailableToGenerateDump
lea r9, str._s___Unable_to_get_disk_free_space:___d_.
mov dword [rsp + 0x28], eax
lea rdx, str..eh_ExceptionHelper.cpp
mov r8d, Ordinal_211
mov ecx, 0x45
mov qword [rsp + 0x20], rsi
call fcn.140038200
xor al, al
jmp 0x14001fe01
Function at 0x1400200c0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x700
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x758], rbx
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov rdi, r8
mov r12, rdx
mov rbp, rcx
mov word [rsp + 0x4e0], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x4e2]
call fcn.140041940
mov qword [rsp + 0x20], rdi
mov r9, r12
lea r8, [0x1401cfec8]
mov edx, 0x105
lea rcx, [rsp + 0x4e0]
call fcn.1400463e0
xor r13d, r13d
mov dword [rsp + 0x80], r13d
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x84]
call fcn.140041940
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002036c
lea r14, str.GetDumpFileName
movabs r15, 0x7ffffffffffffffe
nop
nop
nop
nop
lea rsi, [rsp + 0xac]
lea rdi, [0x1401cd15c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14002034a
lea rsi, [rsp + 0xac]
lea rdi, [0x1401cd160]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14002034a
test byte [rsp + 0x80], 0x10
jne 0x14002034a
mov word [rsp + 0x2d0], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x2d2]
call fcn.140041940
lea rdx, [rsp + 0xac]
mov qword [rsp + 0x20], rdx
mov r9, r12
lea r8, [0x1401cfec8]
mov edx, 0x105
lea rcx, [rsp + 0x2d0]
call fcn.1400463e0
lea rdx, [rsp + 0x2d0]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
lea r9, str._s___Found_dump_file:___s_
mov r8d, 0x121
lea rdx, str..eh_ExceptionHelper.cpp
mov ecx, 0x44
call fcn.140038200
mov edx, 7
mov qword [rsp + 0x50], rdx
mov r8, r13
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2d0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, r15
jbe 0x1400202a7
call fcn.14003b3f0
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
cmp rdx, rsi
jae 0x1400202c0
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14000ba60
mov rdx, qword [rsp + 0x50]
jmp 0x1400202de
test rsi, rsi
jne 0x1400202de
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x38]
cmp rdx, 8
cmovae rax, qword [rsp + 0x38]
mov word [rax], si
jmp 0x140020325
test rsi, rsi
je 0x140020325
lea rcx, [rsp + 0x38]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x38]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x2d0]
call fcn.140041310
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
mov word [rdi + rax], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.140020ee0
nop
cmp qword [rsp + 0x50], 8
jb 0x14002034a
mov rcx, qword [rsp + 0x38]
call fcn.140041700
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400201a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x758]
add rsp, 0x700
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140023190
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp qword [rcx + 0x120], 0
mov ebp, r9d
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
jne 0x1400231cc
or eax, 0xffffffff
jmp 0x14002327c
test rdx, rdx
jne 0x1400231d9
lea eax, [rdx - 0x66]
jmp 0x14002327c
cmp qword [rcx + 8], 0
je 0x1400231c4
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x40], 0
call fcn.140041940
test rbx, rbx
je 0x140023210
lea rcx, [rsp + 0x40]
mov r8, rbx
mov edx, 0x105
call fcn.1400433f0
jmp 0x140023220
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, qword [rsi + 8]
mov edx, ebp
call qword [rsi + 0x140]
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8, rdi
xor ebx, ebx
call qword [rsi + 0x138]
test eax, eax
mov esi, eax
je 0x14002327a
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
lea r9, str._CZipAU::AddFile__Can_not_add___s___s__into_zip_file__Zip_Append_returned_with___d_
lea rdx, str..Zip.cpp
lea ecx, [rbx + 5]
mov r8d, 0x335
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.1400382e0
mov ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140041910
add rsp, 0x168
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140023ea0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov eax, 0x450
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov rbp, r8
mov rdi, rdx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x40], 0
call fcn.140041940
lea r8, str.SELECT_HS__FID__FC_FROM_TBL_SAA_WHERE_HS__:HS_
lea rcx, [rsp + 0x40]
mov edx, 0x400
call fcn.1400418a0
xor eax, eax
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov rcx, rbx
xor sil, sil
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rax
call fcn.140036934
test eax, eax
je 0x140023f5d
mov dword [rsp + 0x28], eax
lea rbx, str.QuerySampleQueueTableBySHA1
lea r9, str._s___sqlite3_prepare_v2___d
lea rdx, str..cntmss_dbDda.cpp
mov r8d, 0x151
mov ecx, 0x44
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
xor al, al
jmp 0x1400240d5
cmp qword [rdi + 0x20], 0x10
jb 0x140023f6a
mov rdi, qword [rdi + 8]
jmp 0x140023f6e
add rdi, 8
mov rcx, qword [rsp + 0x30]
lea rdx, [0x14018dd70]
call fcn.140036940
mov rcx, qword [rsp + 0x30]
or r9d, 0xffffffff
mov r8, rdi
mov edx, eax
mov qword [rsp + 0x20], 0xffffffffffffffff
call fcn.140036946
mov rcx, qword [rsp + 0x30]
call fcn.14003692e
lea rbx, str.QuerySampleQueueTableBySHA1
cmp eax, 0x64
je 0x140023ff1
cmp eax, 0x65
je 0x14002409d
test eax, eax
je 0x14002409d
mov dword [rsp + 0x28], eax
lea r9, str._s___sqlite3_step_____d
lea rdx, str..cntmss_dbDda.cpp
mov r8d, 0x15b
mov ecx, 0x45
xor sil, sil
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
jmp 0x14002409d
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.140036952
test rax, rax
je 0x14002402a
mov qword [rsp + 0x28], rax
lea r9, str._s___SHA1___s
lea rdx, str..cntmss_dbDda.cpp
mov r8d, 0x164
mov ecx, 0x44
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
mov rcx, qword [rsp + 0x30]
mov edx, 1
call fcn.140036952
lea r9, str._s___File_path___s
lea rdx, str..cntmss_dbDda.cpp
mov qword [rsp + 0x28], rax
mov r8d, 0x168
mov ecx, 0x44
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
mov rcx, qword [rsp + 0x30]
mov edx, 2
call fcn.14003694c
lea r9, str._s___nFailUploadCount___d
lea rdx, str..cntmss_dbDda.cpp
mov dword [rsp + 0x28], eax
mov r8d, 0x16c
mov ecx, 0x44
mov qword [rsp + 0x20], rbx
mov dword [rbp], eax
call fcn.1400382e0
mov sil, 1
mov rcx, qword [rsp + 0x30]
call fcn.140036928
test eax, eax
je 0x1400240d2
mov dword [rsp + 0x28], eax
lea r9, str._s___sqlite3_finalize_____d
lea rdx, str..cntmss_dbDda.cpp
mov r8d, 0x175
mov ecx, 0x45
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
mov al, sil
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x488]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
Function at 0x140029940
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x9d0
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x9c0], rax
mov qword [rsp + 0x28], rcx
mov ebx, edx
lea rax, str.AtseScanFolder
mov qword [rsp + 0x38], r8
mov rsi, rcx
mov qword [rsp + 0x30], rcx
lea rdx, str..cnttmss_AtseScan.cpp
lea r9, [0x1401cd9c0]
mov r8d, 0xdc
mov ecx, 0x44
mov qword [rsp + 0x20], rax
call fcn.1400382e0
lea rcx, [rsp + 0x181]
xor edx, edx
mov r8d, 0x410
mov byte [rsp + 0x180], 0
call fcn.140041940
lea rcx, [rsp + 0x5a1]
xor edx, edx
mov r8d, 0x410
mov byte [rsp + 0x5a0], 0
call fcn.140041940
test rsi, rsi
je 0x140029bab
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x140029bab
lea r8, [0x1401cd9d4]
lea rcx, [rsp + 0x5a0]
mov r9, rsi
mov edx, 0x411
mov qword [rsp + 0xa08], rbp
call fcn.1400418a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x140029b74
mov rcx, qword [0x14023c898]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140029b6b
lea rsi, [rsp + 0x6c]
lea rdi, [0x1401d06b8]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x140029b50
lea rsi, [rsp + 0x6c]
lea rdi, [0x1401d06bc]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x140029b49
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0x411
call fcn.140041940
mov rsi, qword [rsp + 0x30]
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x20], rdx
lea r8, [0x1401cd9dc]
lea rcx, [rsp + 0x180]
mov r9, rsi
mov edx, 0x411
call fcn.1400418a0
test byte [rsp + 0x40], 0x10
je 0x140029af2
test ebx, ebx
je 0x140029b55
mov r8, qword [rsp + 0x38]
lea edx, [rbx - 1]
lea rcx, [rsp + 0x180]
call fcn.140029940
jmp 0x140029b55
lea rax, [rsp + 0x180]
lea r9, str._s___file__s_
lea rdx, str..cnttmss_AtseScan.cpp
mov qword [rsp + 0x28], rax
lea rax, str.AtseScanFolder
mov r8d, 0x10a
mov ecx, 0x44
mov qword [rsp + 0x20], rax
call fcn.1400382e0
lea rcx, [rsp + 0x180]
call fcn.140002130
test eax, eax
je 0x140029b55
lea rcx, [rsp + 0x180]
call fcn.140028c70
jmp 0x140029b55
mov rsi, qword [rsp + 0x30]
jmp 0x140029b55
mov rsi, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140029a40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, str.AtseScanFolder
lea r9, str._s______folder__s_
lea rdx, str..cnttmss_AtseScan.cpp
mov r8d, 0x115
mov ecx, 0x44
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.1400382e0
mov rbp, qword [rsp + 0xa08]
mov eax, 1
mov rcx, qword [rsp + 0x9c0]
xor rcx, rsp
call fcn.140041910
add rsp, 0x9d0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002a700
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, Ordinal_41
call fcn.140189b00
sub rsp, rax
sub ecx, 1
je 0x14002a72f
sub ecx, 1
je 0x14002a747
sub ecx, 1
je 0x14002a72a
cmp ecx, 1
jne 0x14002a742
add rsp, 0x28
jmp fcn.1400287e0
call fcn.1400015e0
mov rcx, qword [0x14023c898]
lea rdx, [0x14002a1a0]
call fcn.140001490
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.1400015e0

Function at 0x14002b4c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
mov qword [rsp + 0x30], 0
lea r8d, [rax - 0x3f]
xor r9d, r9d
mov edx, 0x80000080
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor edx, edx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14002e080
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x80
call fcn.140189b00
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rdi, rcx
lea rcx, [rsp + 0x50]
call fcn.14002cda0
nop
lea r8, str.SampleSubmission_
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400110d0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.1400023d0
nop
cmp qword [rsp + 0x48], 0x10
jb 0x14002e0e8
mov rcx, qword [rsp + 0x30]
call fcn.140041700
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
cmp qword [rsp + 0x70], 0x10
jb 0x14002e111
mov rcx, qword [rsp + 0x58]
call fcn.140041700
cmp qword [rdi + 0x20], 0x10
jb 0x14002e121
lea rbx, [rdi + 8]
mov rcx, qword [rbx]
jmp 0x14002e128
lea rbx, [rdi + 8]
mov rcx, rbx
xor edx, edx
call fcn.1400428d0
cmp eax, 0xffffffff
jne 0x14002e149
cmp qword [rdi + 0x20], 0x10
jb 0x14002e13e
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x14002e1c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov eax, 0x160
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebp, ebp
mov rbx, rcx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], ebp
mov byte [rsp + 0x40], bpl
call fcn.140041940
lea rdx, [rsp + 0x38]
mov r9d, 0x20219
mov qword [rsp + 0x20], rdx
lea rdx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersion
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002e38e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.GUID
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002e381
mov rdx, qword [rbx + 0x20]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x180], rdi
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
cmp rdx, 0x10
not rcx
lea rsi, [rcx - 1]
jb 0x14002e2b3
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x14002e2ba
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x40]
cmp rcx, rax
jb 0x14002e301
cmp rdx, 0x10
jb 0x14002e2cf
mov rcx, qword [rdi]
jmp 0x14002e2d2
mov rcx, rdi
add rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x40]
cmp rcx, rax
jbe 0x14002e301
cmp rdx, 0x10
jb 0x14002e2e9
mov rdi, qword [rdi]
lea r8, [rsp + 0x40]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
call fcn.1400023d0
jmp 0x14002e371
cmp rsi, 0xfffffffffffffffe
jbe 0x14002e30c
call fcn.14003b3f0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x14002e338
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400026b0
test rsi, rsi
je 0x14002e371
mov rdx, qword [rbx + 0x20]
cmp rdx, 0x10
jb 0x14002e34f
mov rcx, qword [rdi]
jmp 0x14002e352
test rsi, rsi
jne 0x14002e324
cmp rax, 0x10
mov qword [rbx + 0x18], rbp
jb 0x14002e34a
mov rdi, qword [rdi]
mov byte [rdi], bpl
jmp 0x14002e371
mov rcx, rdi
lea r8, [rsp + 0x40]
mov r9, rsi
call fcn.140041310
cmp qword [rbx + 0x20], 0x10
mov qword [rbx + 0x18], rsi
jb 0x14002e36d
mov rdi, qword [rdi]
mov byte [rdi + rsi], bpl
mov rsi, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002e3bc
mov dword [rsp + 0x28], eax
lea rax, str.ReadOsceClientUUID
lea r9, str._s___registry_key_error__d_
lea rdx, str..cnttmss_UploadSample.cpp
mov r8d, 0x2f5
mov ecx, 0x45
mov qword [rsp + 0x20], rax
call fcn.1400382e0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x188]
add rsp, 0x160
pop rbp
ret
Function at 0x14002e3e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov eax, 0x160
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebp, ebp
mov rbx, rcx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], ebp
mov byte [rsp + 0x40], bpl
call fcn.140041940
lea rdx, [rsp + 0x38]
mov r9d, 0x20219
mov qword [rsp + 0x20], rdx
lea rdx, [0x14018f5b0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002e5ae
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.ServerID
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002e5a1
mov rdx, qword [rbx + 0x20]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x180], rdi
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
cmp rdx, 0x10
not rcx
lea rsi, [rcx - 1]
jb 0x14002e4d3
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x14002e4da
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x40]
cmp rcx, rax
jb 0x14002e521
cmp rdx, 0x10
jb 0x14002e4ef
mov rcx, qword [rdi]
jmp 0x14002e4f2
mov rcx, rdi
add rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x40]
cmp rcx, rax
jbe 0x14002e521
cmp rdx, 0x10
jb 0x14002e509
mov rdi, qword [rdi]
lea r8, [rsp + 0x40]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
call fcn.1400023d0
jmp 0x14002e591
cmp rsi, 0xfffffffffffffffe
jbe 0x14002e52c
call fcn.14003b3f0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x14002e558
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400026b0
test rsi, rsi
je 0x14002e591
mov rdx, qword [rbx + 0x20]
cmp rdx, 0x10
jb 0x14002e56f
mov rcx, qword [rdi]
jmp 0x14002e572
test rsi, rsi
jne 0x14002e544
cmp rax, 0x10
mov qword [rbx + 0x18], rbp
jb 0x14002e56a
mov rdi, qword [rdi]
mov byte [rdi], bpl
jmp 0x14002e591
mov rcx, rdi
lea r8, [rsp + 0x40]
mov r9, rsi
call fcn.140041310
cmp qword [rbx + 0x20], 0x10
mov qword [rbx + 0x18], rsi
jb 0x14002e58d
mov rdi, qword [rdi]
mov byte [rdi + rsi], bpl
mov rsi, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002e5dc
mov dword [rsp + 0x28], eax
lea rax, str.ReadOsceServerUID
lea r9, str._s___registry_key_error__d_
lea rdx, str..cnttmss_UploadSample.cpp
mov r8d, 0x30b
mov ecx, 0x45
mov qword [rsp + 0x20], rax
call fcn.1400382e0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x188]
add rsp, 0x160
pop rbp
ret