joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fb80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12d, r8d
mov rdi, rdx
mov r15, rcx
mov r14d, 0x104
mov r8d, r14d
lea rcx, [rsp + 0x70]
xor edx, edx
mov r13, r9
call fcn.140136540
mov eax, dword [rbp + 0xf0]
xor esi, esi
mov r8d, eax
mov qword [rsp + 0x60], rsi
xor edx, edx
mov qword [rsp + 0x50], rsi
mov rcx, r13
mov dword [rsp + 0x58], 0xffffffff
mov dword [rsp + 0x5c], eax
call fcn.140136540
test rdi, rdi
je 0x14002fd72
mov rax, 0xffffffffffffffff
mov rbx, rax
nop
inc rbx
cmp byte [rdi + rbx], sil
jne 0x14002fc10
test rbx, rbx
je 0x14002fc2c
nop
cmp byte [rdi + rbx], 0x5c
je 0x14002fc5d
sub rbx, 1
jne 0x14002fc20
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002fcc5
mov qword [rsp + 0x60], rsi
jmp 0x14002fd5e
cmp rbx, r14
jae 0x14002fd72
inc rax
cmp byte [rdi + rax], sil
jne 0x14002fc66
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.140135ea0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r15
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002fd0d
mov qword [rsp + 0x50], rsi
jmp 0x14002fd4e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14002fd0d
mov qword [rsp + 0x50], rsi
jmp 0x14002fd4e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14002fd49
test eax, eax
jne 0x14002fd4e
cmp dword [rsp + 0x58], r12d
jne 0x14002fd4e
cmp dword [rsp + 0x5c], esi
jbe 0x14002fd4e
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14002fd5e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14002fd6e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x14002fd74
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b2a30
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002fda0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, r9
mov qword [rsp + 0x70], rbx
mov ebp, r8d
mov qword [rsp + 0x78], rbx
mov rdi, rdx
test rdx, rdx
jne 0x14002fdf6
mov r8d, 0x8a
lea rdx, str.D:_a_rufus_rufus_src_registry.h
lea rcx, str.key_name___NULL
call fcn.1400fbe54
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov edx, 0x5c
mov rcx, rdi
call fcn.1400b41b4
test rax, rax
je 0x14002fe21
mov r8d, 0x91
lea rdx, str.D:_a_rufus_rufus_src_registry.h
lea rcx, str.strchr_key_name_____NULL
call fcn.1400fbe54
mov edx, 0x5c
mov rcx, rdi
call fcn.1400b41b4
test rax, rax
jne 0x14002fde4
lea rax, [rsp + 0x70]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002fe63
mov qword [rsp + 0x70], rbx
jmp 0x14002fee7
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREAkeo_ConsultingRufus
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14002feae
mov qword [rsp + 0x78], rbx
jmp 0x14002fed7
mov eax, dword [rsp + 0x90]
mov r9d, ebp
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002fee7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14002fef7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140034d10
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
xor bl, bl
call fcn.14002e8b0
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov r8d, 1
mov rcx, rax
mov dword [rsp + 0x20], 3
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test rdi, rdi
je 0x140034d7d
mov rcx, rdi
call fcn.1400e8c70
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbp, rbp
jne 0x140034da9
call fcn.14004fba0
mov r8, rax
lea rcx, str.FindArch:_Could_not_open_file__s:__s
mov rdx, rsi
call fcn.14004f2f0
xor al, al
jmp 0x140034eed
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r15d
mov r8d, 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
jne 0x140034de8
call fcn.14004fba0
mov rdx, rax
lea rcx, str.FindArch:_Could_not_create_file_mapping:__s
call fcn.14004f2f0
jmp 0x140034edb
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov edx, 4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
jne 0x140034e22
call fcn.14004fba0
mov rdx, rax
lea rcx, str.FindArch:_Could_not_get_mapped_view_address:__s
call fcn.14004f2f0
jmp 0x140034ecc
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x140034e3d
lea rcx, str.FindArch:_DOS_header_not_found
call fcn.14004f2f0
jmp 0x140034ec3
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
je 0x140034e58
lea rcx, str.FindArch:_NT_header_not_found
call fcn.14004f2f0
jmp 0x140034ec3
movzx ecx, word [rax + rdi + 4]
cmp ecx, 0x5032
ja 0x140034e95
je 0x140034e91
sub ecx, 0x14c
je 0x140034e8d
sub ecx, 0x74
je 0x140034e89
sub ecx, 0x40
je 0x140034e85
cmp ecx, 0xcbc
jne 0x140034ec3
mov bl, 9
jmp 0x140034ec3
mov bl, 5
jmp 0x140034ec3
mov bl, 3
jmp 0x140034ec3
mov bl, 1
jmp 0x140034ec3
mov bl, 6
jmp 0x140034ec3
cmp ecx, 0x5064
je 0x140034ec1
cmp ecx, 0x5128
je 0x140034ebd
cmp ecx, 0x8664
je 0x140034eb9
cmp ecx, 0xaa64
jne 0x140034ec3
mov bl, 4
jmp 0x140034ec3
mov bl, 2
jmp 0x140034ec3
mov bl, 8
jmp 0x140034ec3
mov bl, 7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp rsi, 0xffffffffffffffff
je 0x140034edb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbp, 0xffffffffffffffff
je 0x140034eea
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14003ca20
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, qword [0x1401e87b8]
mov edx, 0x1f5
mov rcx, rbx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14003ca75
call fcn.14004fba0
mov r8, rax
lea rdx, str.rufus.com
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f2f0
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rdx, rdi
mov qword [rsp + 0x60], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x14003cabb
call fcn.14004fba0
mov r8, rax
lea rdx, str.rufus.com
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f2f0
mov rsi, qword [rsp + 0x60]
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rdx, rdi
mov qword [rsp + 0x58], rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x14003ccd2
lea r8, [0x140163468]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rsp + 0x30], 0
lea rcx, str.rufus.com
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
mov r8d, 1
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003cb62
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rbx, rbx
je 0x14003cb62
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x28
mov ecx, 0xa
call fcn.1400c4f6c
mov rbx, rax
test rax, rax
je 0x14003ccbf
mov dword [rax], 1
mov r8d, 0x28
mov dword [rax + 0xc], 4
mov rdx, rbx
movsx eax, byte [str.rufus.com]
mov ecx, 0xa
mov word [rbx + 0xa], ax
mov dword [rbx + 0x28], 1
mov dword [rbx + 0x34], 4
movsx eax, byte [0x1401617c9]
mov word [rbx + 0x32], ax
mov dword [rbx + 0x50], 1
mov dword [rbx + 0x5c], 4
movsx eax, byte [0x1401617ca]
mov word [rbx + 0x5a], ax
mov dword [rbx + 0x78], 1
mov dword [rbx + 0x84], 4
movsx eax, byte [0x1401617cb]
mov word [rbx + 0x82], ax
mov dword [rbx + 0xa0], 1
mov dword [rbx + 0xac], 4
movsx eax, byte [0x1401617cc]
mov word [rbx + 0xaa], ax
mov dword [rbx + 0xc8], 1
mov dword [rbx + 0xd4], 4
movsx eax, byte [0x1401617cd]
mov word [rbx + 0xd2], ax
mov dword [rbx + 0xf0], 1
mov dword [rbx + 0xfc], 4
movsx eax, byte [0x1401617ce]
mov word [rbx + 0xfa], ax
mov dword [rbx + 0x118], 1
mov dword [rbx + 0x124], 4
movsx eax, byte [0x1401617cf]
mov word [rbx + 0x122], ax
mov dword [rbx + 0x140], 1
mov dword [rbx + 0x14c], 4
movsx eax, byte [0x1401617d0]
mov word [rbx + 0x14a], ax
mov dword [rbx + 0x168], 1
mov word [rbx + 0x170], 0xd
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, rbx
call fcn.1400e8c70
test rdi, rdi
je 0x14003cccf
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rdi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400418c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rax, [rcx + 0x10]
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov dword [rcx + 0x30], ebx
xor r9d, r9d
mov rcx, qword [rcx]
mov r8d, 0x10000
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140041929
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x140041915
mov r8d, 0x6b
lea rdx, str.D:_a_rufus_rufus_srcwinio.h
lea rcx, str.GetLastError_____ERROR_HANDLE_EOF
call fcn.1400fbe54
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov ecx, ebx
setne cl
dec ecx
jmp 0x14004192e
mov ecx, 1
test ecx, ecx
mov dword [rdi + 8], ecx
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140046f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xc0]
mov rdi, rcx
mov rbx, rax
mov qword [rsp + 0x40], r14
and ebx, 0x3f
lea r14, [rax*8]
mov byte [rbx + rcx], 0x80
inc rbx
cmp rbx, 0x38
je 0x140046fb9
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
nop
and ebx, 0x3f
mov esi, ebx
mov ebp, ebx
lea rax, [rbx + 1]
jne 0x140046fa2
cmp dword [0x14019f114], 0
mov rbx, rax
mov rdx, rdi
je 0x140046f94
lea rcx, [rdi + 0x80]
mov r8d, 0x40
call fcn.140044f80
mov byte [rdi + rbp], 0
jmp 0x140046f60
mov rcx, rdi
call fcn.140043690
mov byte [rdi + rsi], 0
jmp 0x140046f60
mov byte [rbx + rdi], 0
mov rbx, rax
cmp rax, 0x38
jne 0x140046f60
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov byte [rdi + 0x3f], r14b
shr rax, 8
mov rdx, rdi
mov byte [rdi + 0x3e], al
mov rax, r14
shr rax, 0x10
mov byte [rdi + 0x3d], al
mov rax, r14
shr rax, 0x18
mov byte [rdi + 0x3c], al
mov rax, r14
shr rax, 0x20
mov byte [rdi + 0x3b], al
mov rax, r14
shr rax, 0x28
mov byte [rdi + 0x3a], al
mov rax, r14
shr r14, 0x38
shr rax, 0x30
cmp dword [0x14019f114], 0
mov byte [rdi + 0x38], r14b
mov r14, qword [rsp + 0x40]
mov byte [rdi + 0x39], al
je 0x140047029
lea rbx, [rdi + 0x80]
mov r8d, 0x40
mov rcx, rbx
call fcn.140044f80
jmp 0x140047038
mov rcx, rdi
call fcn.140043690
lea rbx, [rdi + 0x80]
mov eax, dword [rbx]
mov rbx, qword [rsp + 0x48]
bswap eax
mov dword [rdi], eax
mov eax, dword [rdi + 0x88]
bswap eax
mov dword [rdi + 4], eax
mov eax, dword [rdi + 0x90]
bswap eax
mov dword [rdi + 8], eax
mov eax, dword [rdi + 0x98]
bswap eax
mov dword [rdi + 0xc], eax
mov eax, dword [rdi + 0xa0]
bswap eax
mov dword [rdi + 0x10], eax
mov eax, dword [rdi + 0xa8]
bswap eax
mov dword [rdi + 0x14], eax
mov eax, dword [rdi + 0xb0]
bswap eax
mov dword [rdi + 0x18], eax
mov eax, dword [rdi + 0xb8]
bswap eax
mov dword [rdi + 0x1c], eax
add rsp, 0x20
pop rdi
ret
Function at 0x140047330
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x11d0
call fcn.1400b3400
sub rsp, rax
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffc0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x1140], rax
xorps xmm0, xmm0
mov r15d, ecx
xor eax, eax
xor ebx, ebx
mov byte [rbp + 0x40], bl
mov r12, r8
mov qword [rbp + 0xb1], rax
mov dword [rbp + 0xb9], eax
mov word [rbp + 0xbd], ax
mov byte [rbp + 0xbf], al
mov dword [rbp], ebx
movups xmmword [rbp + 0x41], xmm0
movups xmmword [rbp + 0x51], xmm0
movups xmmword [rbp + 0x61], xmm0
movups xmmword [rbp + 0x71], xmm0
movups xmmword [rbp + 0x81], xmm0
movups xmmword [rbp + 0x91], xmm0
movups xmmword [rbp + 0xa1], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
test rdx, rdx
je 0x14004753d
test r8, r8
je 0x14004753d
mov rcx, rdx
call fcn.1400414c0
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000000
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test rsi, rsi
je 0x140047451
mov rcx, rsi
call fcn.1400e8c70
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rdi, 0xffffffffffffffff
jne 0x140047483
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_open_file:__s
call fcn.14004f2f0
mov dword [0x14019f120], 0xc003006e
jmp 0x14004753b
lea r14, [0x140000000]
lea rcx, [rbp + 0x40]
call qword [r14 + r15*8 + 0x152860]
mov eax, dword [0x14019f120]
test eax, eax
jns 0x1400474aa
cmp ax, 0x4c7
je 0x14004752d
lea r9, [rbp]
mov qword [rsp + 0x20], rbx
mov r8d, 0x1000
lea rdx, [rbp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004750f
mov eax, dword [rbp]
lea rcx, [rbp + 0x40]
test eax, eax
je 0x1400474ec
mov r8d, eax
lea rdx, [rbp + 0x140]
call qword [r14 + r15*8 + 0x152880]
jmp 0x140047496
call qword [r14 + r15*8 + 0x152840]
mov r8d, dword [r14 + r15*4 + 0x152f08]
lea rdx, [rbp + 0x40]
mov rcx, r12
call fcn.140135ea0
mov ebx, 1
jmp 0x14004752d
mov dword [0x14019f120], 0xc003001e
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Read_error:__s
call fcn.14004f2f0
test rdi, rdi
je 0x14004753b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x1140]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0x11d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140048d60
Capabilities:
Get file version info

Disassembly:
push r12
sub rsp, 0x80
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x30]
mov r12, rcx
call fcn.1400479f0
test eax, eax
jne 0x140048d93
mov eax, 0xffffffff
jmp 0x140048ed3
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x78], rsi
xor esi, esi
mov qword [rsp + 0x70], rdi
mov ebx, esi
lea rdi, [0x1401983f0]
mov edx, ebx
lea rcx, [rsp + 0x30]
add rdx, rdi
mov r8d, 0x20
call fcn.1401368e0
test eax, eax
je 0x140048fd4
add ebx, 0x20
cmp ebx, 0x40a0
jb 0x140048db0
mov edi, dword [0x1401a0464]
mov ebx, esi
shl edi, 5
mov qword [rsp + 0xa0], rbp
test edi, edi
je 0x140048e24
mov rbp, qword [0x1401a0478]
nop word [rax + rax]
mov edx, ebx
lea rcx, [rsp + 0x30]
add rdx, rbp
mov r8d, 0x20
call fcn.1401368e0
test eax, eax
je 0x140048eb4
add ebx, 0x20
cmp ebx, edi
jb 0x140048e00
xorps xmm0, xmm0
mov qword [rsp + 0x68], r14
mov rcx, r12
mov rdi, rsi
movups xmmword [0x1401e2ce8], xmm0
call fcn.14004a720
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test rbx, rbx
je 0x140048e67
mov rcx, rbx
call fcn.1400e8c70
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14d, r14d
je 0x140048f8c
mov rcx, r14
call fcn.1400e8c84
mov rdi, rax
test rax, rax
je 0x140048f8c
mov ebx, dword [rsp + 0x20]
mov rcx, r12
mov qword [rsp + 0x60], r15
mov r15d, esi
call fcn.14004a720
mov rbp, rax
test ebx, ebx
je 0x140048eea
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140048efe
mov eax, 2
mov rbp, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0x80
pop r12
ret
mov r9, rdi
mov r8d, r14d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rbp, rbp
je 0x140048f13
mov rcx, rbp
call fcn.1400e8c70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r15d, r15d
mov r15, qword [rsp + 0x60]
je 0x140048f8c
lea r9, [rsp + 0x24]
mov rcx, rdi
lea r8, [rsp + 0x28]
lea rdx, [0x1401560f8]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x140048f8c
cmp dword [rsp + 0x24], esi
je 0x140048f8c
mov rcx, qword [rsp + 0x28]
cmp dword [rcx], 0xfeef04bd
jne 0x140048f8c
movzx eax, word [rcx + 0xa]
mov dword [0x1401e2ce8], eax
movzx eax, word [rcx + 8]
mov dword [0x1401e2cec], eax
movzx eax, word [rcx + 0xe]
mov dword [0x1401e2cf0], eax
movzx eax, word [rcx + 0xc]
mov dword [0x1401e2cf4], eax
lea rax, [0x1401e2ce8]
mov qword [0x1401e2cf8], rax
mov rcx, rdi
call fcn.1400e8c70
mov rcx, qword [0x1401e2cf8]
mov r14, qword [rsp + 0x68]
test rcx, rcx
je 0x140048fcd
cmp dword [rcx], 0xa
jne 0x140048fcd
cmp dword [rcx + 4], esi
jne 0x140048fcd
mov ecx, dword [rcx + 8]
mov eax, 3
sub ecx, 0x383a
cmp ecx, 0x1226
cmovbe esi, eax
mov eax, esi
jmp 0x140048eb9
xor eax, eax
jmp 0x140048eb9
mov eax, 1
jmp 0x140048ec1
Function at 0x14004aad0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
mov r12, rcx
mov r14d, 0x104
lea rcx, [rsp + 0x70]
mov r8d, r14d
xor edx, edx
mov r15, r9
call fcn.140136540
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
xor eax, eax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x5c], 4
mov dword [r15], eax
test rdi, rdi
je 0x14004acb2
mov rax, 0xffffffffffffffff
mov rbx, rax
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], sil
jne 0x14004ab50
test rbx, rbx
je 0x14004ab6c
nop
cmp byte [rdi + rbx], 0x5c
je 0x14004ab9d
sub rbx, 1
jne 0x14004ab60
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14004ac05
mov qword [rsp + 0x60], rsi
jmp 0x14004ac9e
cmp rbx, r14
jae 0x14004acb2
inc rax
cmp byte [rdi + rax], sil
jne 0x14004aba6
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.140135ea0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r12
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14004ac4d
mov qword [rsp + 0x50], rsi
jmp 0x14004ac8e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14004ac4d
mov qword [rsp + 0x50], rsi
jmp 0x14004ac8e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14004ac89
test eax, eax
jne 0x14004ac8e
cmp dword [rsp + 0x58], 4
jne 0x14004ac8e
cmp dword [rsp + 0x5c], esi
jbe 0x14004ac8e
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14004ac9e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14004acae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x14004acb4
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0x190
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004d350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbp, r9
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14004d38d
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_locate_resource__s:__s
mov rdx, rbp
call fcn.14004f2f0
xor eax, eax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
mov rdx, rdi
mov qword [rsp + 0x50], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x14004d3cc
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_load_resource__s:__s
mov rdx, rbp
call fcn.14004f2f0
mov r15, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x48], r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [rsp + 0x68], 0
mov edi, eax
mov r14, qword [rsp + 0x60]
je 0x14004d460
mov eax, dword [r14]
test eax, eax
jne 0x14004d3fc
mov dword [r14], edi
mov eax, edi
mov ecx, eax
mov edx, 1
call fcn.1400c4f6c
mov rsi, rax
test rax, rax
jne 0x14004d421
mov rdx, rbp
lea rcx, str.Could_not_allocate_resource__s
call fcn.14004f2f0
jmp 0x14004d46f
mov eax, dword [r14]
mov rcx, r15
cmp edi, eax
cmovb eax, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call fcn.140135ea0
mov eax, dword [r14]
cmp edi, eax
jbe 0x14004d46c
mov r8d, edi
lea rcx, str.WARNING:_Resource__s_was_truncated_by__d_bytes_
sub r8d, eax
mov rdx, rbp
call fcn.14004f2f0
jmp 0x14004d46c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov dword [r14], edi
mov r14, qword [rsp + 0x48]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret