joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011c10
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r15, r9
mov r12, r8
mov rbx, rdx
mov rbp, rcx
lea rcx, [rax - 0x38]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
mov rcx, rbx
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
mov r8, rax
lea rdx, str.SELECT________________________________FROM_WebTransfer_______________________________WHERE___LicenseSerialID____s___
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
lea rsi, [rbp + 0x3948]
lea rbx, str.SELECT__FROM_WebTransfer___WHERE_SessionID_____
test rax, rax
cmovne rbx, rax
lea rdx, [rbp + 0x268]
lea rcx, [rsi + 0x1f0]
call fcn.14000eb00
mov edi, eax
test eax, eax
js 0x140011d0e
mov qword [rsp + 0x70], 0
mov rcx, qword [rsi + 0x1f0]
mov rax, qword [rcx]
lea r8, [rsp + 0x70]
lea rdx, [0x1400d4ba8]
call qword [rax]
mov edi, eax
test eax, eax
js 0x140011cdb
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov r8, rbx
lea rdx, [0x1400f2a30]
call qword [rax + gethostname]
mov edi, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140011ceb
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test edi, edi
js 0x140011d12
lea rdx, [rbp + 0x270]
mov dword [rsp + 0x20], 0
mov r9b, 1
xor r8d, r8d
mov rcx, rsi
call fcn.140017b60
mov edi, eax
test edi, edi
jns 0x140011d67
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
mov r8d, edi
lea rdx, str.DataBase___m_WebTransferTable.Open_IV_failed_with_0x_.8X
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
mov rbx, qword [0x140122018]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
mov r8, rax
mov edx, 2
lea rcx, [rbx + 0xc0]
call fcn.14006a5c0
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
jmp 0x140011d7a
lea rcx, [rbp + 0x3b10]
mov r8b, 1
xor edx, edx
call fcn.140017600
mov edi, eax
test edi, edi
je 0x140011dba
mov rbx, qword [rsi + 0x1c8]
test rbx, rbx
je 0x140011dac
mov rdx, rbx
mov rcx, rsi
call fcn.14000fda0
mov rdx, rbx
mov rcx, rsi
call fcn.140018300
lea rcx, [rsi + 0x1c8]
call fcn.14000e710
lea rcx, [rbp + 0x3b38]
call fcn.1400183e0
jmp 0x140011e16
lea rdx, [rbp + 0x3a2c]
mov rcx, r12
call qword [sym.imp.mfc110u.dll_Ordinal_1494]
lea rdx, [rbp + 0x3a92]
mov rcx, r15
call qword [sym.imp.mfc110u.dll_Ordinal_1494]
mov rbx, qword [rsi + 0x1c8]
test rbx, rbx
je 0x140011e08
mov rdx, rbx
mov rcx, rsi
call fcn.14000fda0
mov rdx, rbx
mov rcx, rsi
call fcn.140018300
lea rcx, [rsi + 0x1c8]
call fcn.14000e710
lea rcx, [rbp + 0x3b38]
call fcn.1400183e0
xor edi, edi
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
mov eax, edi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140014350
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r14, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
lea rdx, str.SELECT__________________________________FROM_WebTransfer_________________________________WHERE_TransferNo_________________________________________SELECT_MIN__TransferNo____________________________________________FROM_WebTransfer__________________________________________WHERE___Acknowledged__0____
lea rcx, [rax - 0x38]
call qword [sym.imp.mfc110u.dll_Ordinal_286]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
lea rbp, [rsi + 0x3948]
lea rbx, str.SELECT__FROM_WebTransfer___WHERE_SessionID_____
test rax, rax
cmovne rbx, rax
lea rdx, [rsi + 0x268]
lea rcx, [rbp + 0x1f0]
call fcn.14000eb00
mov edi, eax
test eax, eax
js 0x14001443c
mov qword [rsp + 0x70], 0
mov rcx, qword [rbp + 0x1f0]
mov rax, qword [rcx]
lea r8, [rsp + 0x70]
lea rdx, [0x1400d4ba8]
call qword [rax]
mov edi, eax
test eax, eax
js 0x140014409
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov r8, rbx
lea rdx, [0x1400f2a30]
call qword [rax + gethostname]
mov edi, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140014419
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test edi, edi
js 0x140014440
lea rdx, [rsi + 0x270]
mov dword [rsp + 0x20], 0
mov r9b, 1
xor r8d, r8d
mov rcx, rbp
call fcn.140017b60
mov edi, eax
test edi, edi
jns 0x140014495
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
mov r8d, edi
lea rdx, str.DataBase___m_WebTransferTable.Open_IV_failed_with_0x_.8X
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
mov rbx, qword [0x140122018]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
mov r8, rax
mov edx, 2
lea rcx, [rbx + 0xc0]
call fcn.14006a5c0
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
jmp 0x1400144a8
lea rcx, [rsi + 0x3b10]
mov r8b, 1
xor edx, edx
call fcn.140017600
mov edi, eax
test edi, edi
jne 0x140014519
lea rdx, [rsi + 0x3960]
mov rcx, r12
call qword [sym.imp.mfc110u.dll_Ordinal_1494]
lea rdx, [rsi + 0x39c6]
mov rcx, r13
call qword [sym.imp.mfc110u.dll_Ordinal_1494]
movzx ecx, byte [rsi + 0x3b04]
test ecx, ecx
je 0x1400144f1
dec ecx
je 0x1400144e8
dec ecx
jne 0x140014501
lea rdx, [0x1400dbd30]
jmp 0x1400144f8
lea rdx, [0x1400dbd24]
jmp 0x1400144f8
lea rdx, str.PENDING
mov rcx, r14
call qword [sym.imp.mfc110u.dll_Ordinal_1494]
mov dword [rsi + 0x3b08], 1
lea rcx, [rsi + 0x3b10]
call fcn.140018520
mov edi, eax
mov rbx, qword [rbp + 0x1c8]
test rbx, rbx
je 0x140014547
mov rdx, rbx
mov rcx, rbp
call fcn.14000fda0
mov rdx, rbx
mov rcx, rbp
call fcn.140018300
lea rcx, [rbp + 0x1c8]
call fcn.14000e710
lea rcx, [rsi + 0x3b38]
call fcn.1400183e0
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140017890
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
test r8, r8
mov rdi, r9
mov r9, qword [rsp + 0x68]
mov rbx, rcx
lea rax, str.SELECT__FROM_License_WHERE___LicenseShortName_____
cmovne rax, r8
add rcx, 0x350
mov r8, rax
call fcn.14000ea80
test eax, eax
js 0x1400178e4
mov eax, dword [rsp + 0x78]
movzx r9d, byte [rsp + 0x70]
mov r8, qword [rsp + 0x60]
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.1400178f0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140017b00
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
test r8, r8
mov rdi, r9
mov r9, qword [rsp + 0x68]
mov rbx, rcx
lea rax, str.SELECT__FROM_WebTransfer___WHERE_SessionID_____
cmovne rax, r8
add rcx, 0x1f0
mov r8, rax
call fcn.14000ea80
test eax, eax
js 0x140017b54
mov eax, dword [rsp + 0x78]
movzx r9d, byte [rsp + 0x70]
mov r8, qword [rsp + 0x60]
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140017b60
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400185c0
Capabilities:
Reference sql statements

Disassembly:
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rsi, rcx
mov rcx, rdx
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
lea rcx, [rsi + 0x3960]
or r9, 0xffffffffffffffff
mov r8, rax
lea edx, [r9 + 0x34]
call qword [sym.imp.MSVCR110.dll_wcsncpy_s]
lea r14, [rsi + 0x3948]
lea rdx, [rsi + 0x268]
lea rcx, [r14 + 0x1f0]
call fcn.14000eb00
mov edi, eax
xor r15d, r15d
test eax, eax
js 0x140018696
mov qword [rsp + 0x70], r15
mov rcx, qword [r14 + 0x1f0]
mov rax, qword [rcx]
lea r8, [rsp + 0x70]
lea rdx, [0x1400d4ba8]
call qword [rax]
mov edi, eax
test eax, eax
js 0x140018666
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea r8, str.SELECT__FROM_WebTransfer___WHERE_SessionID_____
lea rdx, [0x1400f2a30]
call qword [rax + gethostname]
mov edi, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140018676
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test edi, edi
js 0x140018696
lea rdx, [rsi + 0x270]
mov dword [rsp + 0x20], r15d
mov r9b, 1
xor r8d, r8d
mov rcx, r14
call fcn.140017b60
mov edi, eax
mov dword [rsp + 0x70], edi
test edi, edi
jns 0x1400186f3
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
mov r8d, edi
lea rdx, str.DataBase___m_WebTransferTable.Open_III_failed_with_0x_.8X
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
mov rbx, qword [0x140122018]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
mov r8, rax
mov edx, 2
lea rcx, [rbx + 0xc0]
call fcn.14006a5c0
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
jmp 0x140018705
lea rcx, [rsi + 0x3b10]
call fcn.140016c60
mov edi, eax
mov dword [rsp + 0x70], eax
test edi, edi
je 0x14001874a
mov rbx, qword [r14 + 0x1c8]
test rbx, rbx
je 0x140018737
mov rdx, rbx
mov rcx, r14
call fcn.14000fda0
mov rdx, rbx
mov rcx, r14
call fcn.140018300
lea rcx, [r14 + 0x1c8]
call fcn.14000e710
lea rcx, [rsi + 0x3b38]
call fcn.1400183e0
mov eax, edi
jmp 0x1400187cd
cmp dword [r13 + 0x10], 0
jne 0x14001875d
cmp dword [r13 + 0x14], 0
mov eax, 1
je 0x140018760
mov eax, r15d
test al, al
sete al
inc al
mov byte [rsi + 0x3b04], al
mov eax, dword [r13 + 0x10]
mov dword [rsi + 0x3afc], eax
mov dword [rsi + 0x3b08], r15d
lea rcx, [rsi + 0x3b10]
call fcn.140018520
mov dword [rsp + 0x70], eax
mov rbx, qword [r14 + 0x1c8]
test rbx, rbx
je 0x1400187bc
mov rdx, rbx
mov rcx, r14
call fcn.14000fda0
mov rdx, rbx
mov rcx, r14
call fcn.140018300
lea rcx, [r14 + 0x1c8]
call fcn.14000e710
lea rcx, [rsi + 0x3b38]
call fcn.1400183e0
nop
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140029af0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x970]
sub rsp, 0xa70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rbp + 0x960], rax
mov r12d, r9d
mov r15, r8
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov word [rsp + 0x60], bx
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x62]
call sub.MSVCR110.dll_memset
mov word [rbp + 0x160], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x162]
call sub.MSVCR110.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov qword [rsp + 0x40], rbx
mov r8, rdi
lea rdx, str.API___s_
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov r8d, r14d
lea rdx, str.os_error_code___d_
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
test r15, r15
jne 0x140029c2e
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_1027
mov r8d, r14d
xor edx, edx
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8, qword [rsp + 0x40]
lea rdx, str.os_message___s
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140029c43
mov r8, r15
lea rdx, str.message___s
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc110u.dll_Ordinal_286]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
mov r8, rax
mov edx, 1
lea rcx, [rsi + 0xc0]
call fcn.14006a5c0
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r12d, r12d
je 0x140029cdb
xchg dword [0x140122010], ebx
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rsi + 0x1a8]
test rax, rax
je 0x140029cdb
mov edi, dword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, edi
jne 0x140029cdb
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov r8d, r14d
mov edx, 0x42a
mov rcx, rsi
call fcn.1400688c0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0xa70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14002b7a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
call fcn.14002b320
mov ebx, eax
test eax, eax
jne 0x14002b8b7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14002b891
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14002b7a0
mov ebx, eax
test eax, eax
jne 0x14002b8b7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14002b840
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002b8a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x50], ebp
call fcn.140029a00
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002b8c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400bb310
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002bd60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14002bdee
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14002bdee
call fcn.140028e30
mov ebx, eax
jmp 0x14002bf16
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14002be0f
call fcn.140028e30
jmp 0x14002bf05
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14002be32
call fcn.140028e30
jmp 0x14002bf05
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14002be54
mov ebx, 0x8007000e
jmp 0x14002bf07
mov ecx, eax
test eax, eax
je 0x14002be8c
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14002be82
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14002be8c
lea rcx, [rsp + 0x70]
call fcn.140028bc0
jmp 0x14002be96
mov ecx, 0x80070216
call fcn.1400025f0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14002bea9
cmp qword [rsp + 0x70], 0
jne 0x14002beb8
mov ebx, 0x8007000e
jmp 0x14002bf07
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14002bee2
call fcn.140028e30
jmp 0x14002bf05
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14002b9a0
mov ebx, eax
test rdi, rdi
je 0x14002bf16
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14002bf2d
lea rcx, [rsp + 0x70]
call fcn.140029d70
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002e610
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x14002e650
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x14002e668
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002e674
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x14002e670
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x14002f5d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rax, [rsp + 0x40]
mov rdi, r8
xor ebx, ebx
lea rdx, str.SOFTWARESiemensSWSCommonData
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x78], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002f6bb
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, str.NetWork
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002f6ab
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.OldServer
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002f6ab
cmp dword [rsp + 0x70], 4
jne 0x14002f6ab
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
lea rdx, str.OldServer
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x78], ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002f6bb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002f6cb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rdi], ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400423f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x88
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rdi, rcx
lea rcx, [rsp + 0x50]
call fcn.1400abf20
nop
xor ebx, ebx
mov qword [rsp + 0xb8], rbx
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xa8], ebx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESiemensSWSCommonData
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140042476
mov dword [rsp + 0x30], 0xa
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x30]
call fcn.1400bb178
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea rdx, str.CheckOutData
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140042566
cmp dword [rsp + 0xa8], 3
jne 0x140042566
mov ecx, dword [rsp + 0xb0]
call qword [sym.imp.MSVCR110.dll_malloc]
mov qword [rsp + 0xb8], rax
test rax, rax
jne 0x1400424da
call sub.mfc110u.dll_Ordinal_2292
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea rdx, str.CheckOutData
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004254d
cmp dword [rsp + 0xa8], 3
jne 0x14004254d
mov r8d, dword [rsp + 0xb0]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x50]
call fcn.1400acc00
mov qword [rsp + 0xb8], rbx
lea rdx, [rdi + 0x64d0]
lea rcx, [rsp + 0x50]
call fcn.1400ac220
nop
jmp 0x140042582
mov dword [rsp + 0x34], reloc.OLEAUT32.dll_SafeArrayLock
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x34]
call fcn.1400bb178
mov dword [rsp + 0x38], reloc.OLEAUT32.dll_SafeArrayLock
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x38]
call fcn.1400bb178
nop
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140042592
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x1400425ad
call qword [sym.imp.MSVCR110.dll_free]
mov qword [rsp + 0xb8], rbx
lea rcx, [rsp + 0x50]
call fcn.1400acc60
mov rcx, rax
call qword [sym.imp.MSVCR110.dll_free]
nop
lea rcx, [rsp + 0x50]
call fcn.1400abfb0
add rsp, 0x88
pop rdi
pop rbx
ret