joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7c15b2210
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x7ff7c1620328]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x40], 0
mov rdi, rcx
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], 0
call fcn.7ff7c15b2144
mov ebx, eax
test eax, eax
js 0x7ff7c15b238b
cmp byte [rsp + 0x30], 0
lea rax, str.SOFTWAREMicrosoftMicrosoft_Security_Client
lea rbx, str.SOFTWAREMicrosoftMicrosoft_Security_Essentials
cmove rbx, rax
call fcn.7ff7c15abfac
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x7ff7c15b238b
and dword [rsp + 0x34], 0
lea rcx, [rsp + 0x50]
mov ebx, 0x208
xor edx, edx
mov r8d, ebx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x38], ebx
mov rbx, qword [rsp + 0x40]
call fcn.7ff7c15abfac
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x50]
mov rcx, rbx
lea rdx, str.Market
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x7ff7c15b238b
cmp dword [rsp + 0x34], 1
je 0x7ff7c15b2325
mov ebx, 0x8007065e
jmp 0x7ff7c15b238b
mov eax, dword [rsp + 0x38]
test al, 1
je 0x7ff7c15b2334
mov ebx, 0x8000ffff
jmp 0x7ff7c15b238b
and eax, 0xfffffffe
cmp eax, 0x28
jbe 0x7ff7c15b2343
mov ebx, 0x8007007a
jmp 0x7ff7c15b238b
lea r8, [rsp + 0x50]
mov edx, 0x14
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcscpy_s]
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15b238b
test byte [rcx + 0x1c], 4
je 0x7ff7c15b238b
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15f8b08]
mov edx, 0xc
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.7ff7c15a595c
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x7ff7c15b23a3
call fcn.7ff7c15abfac
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.7ff7c15e78d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x7ff7c15b2bf0
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov dil, r9b
mov rbx, r8
mov r14, rdx
xor esi, esi
call fcn.7ff7c15a3e90
mov rcx, rax
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.7ff7c15afbe0
nop
test dil, dil
je 0x7ff7c15b2ca7
call fcn.7ff7c15b0bcc
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.7ff7c15b2d20
mov esi, eax
test eax, eax
js 0x7ff7c15b2ce0
mov rbx, qword [r14]
call fcn.7ff7c15abfac
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8, rax
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.7ff7c15af034
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.7ff7c15a4168
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x7ff7c15b2ca7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [r14]
call fcn.7ff7c15abfac
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x7ff7c15b2ce0
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x7ff7c15b2d06
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret

Function at 0x7ff7c15b2d20
Capabilities:
Check if file exists
Create directory

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rdx
xor edi, edi
mov rbx, qword [rdx]
call fcn.7ff7c15abfac
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x7ff7c15b2e06
mov rdx, rsi
call fcn.7ff7c15b3114
mov edi, eax
test eax, eax
js 0x7ff7c15b2e06
mov edx, 0x5c
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
jne 0x7ff7c15b2d81
or eax, 0xffffffff
jmp 0x7ff7c15b2d87
sub rax, qword [rsi]
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.7ff7c15b012c
mov rbx, rax
call fcn.7ff7c15b0bcc
mov rcx, rax
mov rdx, rbx
call fcn.7ff7c15b2d20
mov edi, eax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x7ff7c15b2dd2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
test edi, edi
js 0x7ff7c15b2e06
mov rbx, qword [rsi]
call fcn.7ff7c15abfac
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x7ff7c15b2e06
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff7c15b31d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rdx]
mov r15, r8
xor edi, edi
xor ebp, ebp
call fcn.7ff7c15abfac
and qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 1
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff7c15b3248
xor ebx, ebx
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x7ff7c15b327d
test rbx, rbx
je 0x7ff7c15b327d
call fcn.7ff7c15abfac
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x7ff7c15b327d
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea eax, [rbp + 1]
test edi, edi
js 0x7ff7c15b3308
mov ecx, eax
mov r14d, eax
call fcn.7ff7c15a164c
mov rsi, rax
test rbx, rbx
je 0x7ff7c15b32ff
and dword [rsp + 0x78], 0
mov r8d, r14d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
call fcn.7ff7c15abfac
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, eax
mov eax, dword [rsp + 0x78]
mov byte [rax + rsi], 0
test ecx, ecx
je 0x7ff7c15b32e6
mov rdx, rsi
mov rcx, r15
call fcn.7ff7c15b4154
jmp 0x7ff7c15b32ff
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
je 0x7ff7c15b331b
call fcn.7ff7c15abfac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x7ff7c15b3340
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x7ff7c1620328]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, r8
mov rbx, rdx
xor edi, edi
call fcn.7ff7c15abfac
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x7ff7c15b33e9
cmp eax, 0x104
jb 0x7ff7c15b3393
mov edi, 0x8004ee03
jmp 0x7ff7c15b3402
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.7ff7c15af034
mov rbx, qword [rax]
call fcn.7ff7c15abfac
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov qword [rsi], rax
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x7ff7c15b33e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
cmp qword [rsi], rdi
jne 0x7ff7c15b3402
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.7ff7c15e78d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x7ff7c15b3430
Capabilities:
Check if file exists
Delete file
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, qword [rdx]
mov rbp, r8
mov rsi, rdx
xor edi, edi
call fcn.7ff7c15abfac
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x7ff7c15b353a
and qword [rsp + 0x58], rdi
mov rbx, qword [rsi]
call fcn.7ff7c15abfac
and qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff7c15b34be
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x7ff7c15b353a
call fcn.7ff7c15abfac
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x7ff7c15b34ee
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test rbx, rbx
je 0x7ff7c15b3501
call fcn.7ff7c15abfac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x7ff7c15b353a
cmp qword [rsp + 0x58], rbp
jl 0x7ff7c15b353a
mov rbx, qword [rsi]
call fcn.7ff7c15abfac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x7ff7c15b353a
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x7ff7c15b3600
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
test r8, r8
jne 0x7ff7c15b3623
mov eax, 0x80070057
jmp 0x7ff7c15b3659
call fcn.7ff7c15abfac
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x7ff7c15b3657
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7c15b3af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
mov rax, qword [rsp + 0x38]
mov r10, r9
mov r9, qword [rsp + 0x30]
mov r11, r8
mov ecx, edx
mov qword [rsp + 0x30], rax
mov r8, r10
mov rdx, r11
pop rbx
jmp fcn.7ff7c15b3b18
Function at 0x7ff7c15b49e0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov eax, r8d
mov rcx, rdx
mov edx, eax
movzx r8d, r9w
jmp fcn.7ff7c15bb598

Function at 0x7ff7c15b4eb4
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x7ff7c1620328]
xor rax, rsp
mov qword [rbp], rax
mov rbx, r9
mov rsi, r8
movzx r15d, dx
mov r14, qword [rbp + 0x60]
mov rax, qword [0x7ff7c161b338]
lea rcx, [0x7ff7c161b338]
mov rax, qword [rax + 0x18]
call qword [0x7ff7c15f6588]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rdx, qword [rbx]
lea rcx, [rsp + 0x30]
call fcn.7ff7c15b1034
mov edi, eax
test eax, eax
js 0x7ff7c15b503e
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.7ff7c15b5144
mov edi, eax
test eax, eax
js 0x7ff7c15b503e
mov rax, qword [0x7ff7c161b338]
lea rcx, [0x7ff7c161b338]
mov rax, qword [rax + 0x18]
call qword [0x7ff7c15f6588]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov r8d, 0xaa
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
call fcn.7ff7c15abfac
movzx ecx, r15w
mov r9d, 0x55
lea r8, [rsp + 0x50]
lea edx, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x7ff7c15b4fae
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x7ff7c15b4fc4
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.7ff7c15b1034
mov edi, eax
mov rbx, qword [rsp + 0x38]
test edi, edi
jns 0x7ff7c15b4ffb
lea rax, [0x7ff7c161b240]
mov rcx, qword [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15b501c
test byte [rcx + 0x1c], 1
je 0x7ff7c15b501c
mov edx, 0x10
mov r9d, edi
lea r8, [0x7ff7c15f9190]
mov rcx, qword [rcx + 0x10]
call fcn.7ff7c15a1eb4
jmp 0x7ff7c15b501c
mov rax, qword [rsi]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, qword [rsp + 0x30]
lea rdx, str._s_s_s.mui
mov rcx, r14
call fcn.7ff7c15b11d0
mov edi, eax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x7ff7c15b503e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x7ff7c15b5064
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x7ff7c15f6588]
mov eax, edi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.7ff7c15e78d0
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff7c15b6500
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x7ff7c1620328]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x7ff7c15b658d
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
lea r8, str.Slwga.dll
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r8, [rbx + 8]
lea rdx, [rsp + 0x230]
call fcn.7ff7c15b5eb4
mov ecx, eax
jmp 0x7ff7c15b65a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.7ff7c15e78d0
add rsp, 0x450
pop rbx
ret
Function at 0x7ff7c15ba15c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x7ff7c15ba1b9
lea rax, [0x7ff7c161b240]
mov ebx, 0x80070057
mov rcx, qword [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15ba2f2
test byte [rcx + 0x1c], 1
jne 0x7ff7c15ba2da
jmp 0x7ff7c15ba2f2
movzx edx, r9w
mov r8, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
jne 0x7ff7c15ba20e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x7ff7c15ba20e
lea rax, [0x7ff7c161b240]
mov rcx, qword [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15ba312
test byte [rcx + 0x1c], 1
jne 0x7ff7c15ba2fa
jmp 0x7ff7c15ba312
mov rdx, rsi
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
jne 0x7ff7c15ba261
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x7ff7c15ba261
lea rax, [0x7ff7c161b240]
mov rcx, qword [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15ba332
test byte [rcx + 0x1c], 1
jne 0x7ff7c15ba31a
jmp 0x7ff7c15ba332
and qword [rsp + 0x50], 0
and qword [rsp + 0x28], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x7ff7c15ba2a9
lea rax, [0x7ff7c161b240]
mov ebx, 0x8007000e
mov rcx, qword [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15ba352
test byte [rcx + 0x1c], 1
jne 0x7ff7c15ba33a
jmp 0x7ff7c15ba352
test r14, r14
je 0x7ff7c15ba2be
mov rdx, rsi
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [r14], eax
mov qword [r15], rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov edx, 0xc
mov r9d, ebx
lea r8, [0x7ff7c15f92d8]
mov rcx, qword [rcx + 0x10]
call fcn.7ff7c15a1eb4
mov ecx, ebx
call fcn.7ff7c15bc23c
int3
mov edx, 0xd
mov r9d, ebx
lea r8, [0x7ff7c15f92d8]
mov rcx, qword [rcx + 0x10]
call fcn.7ff7c15a1eb4
mov ecx, ebx
call fcn.7ff7c15bc23c
int3
mov edx, 0xe
mov r9d, ebx
lea r8, [0x7ff7c15f92d8]
mov rcx, qword [rcx + 0x10]
call fcn.7ff7c15a1eb4
mov ecx, ebx
call fcn.7ff7c15bc23c
nop
mov edx, 0xf
mov r9d, ebx
lea r8, [0x7ff7c15f92d8]
mov rcx, qword [rcx + 0x10]
call fcn.7ff7c15a1eb4
mov ecx, ebx
call fcn.7ff7c15bc23c
int3
Function at 0x7ff7c15ba35c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x7ff7c1620328]
xor rax, rsp
mov qword [rbp + 0x150], rax
and qword [rsp + 0x20], 0
mov r14, rcx
xor dil, dil
xor ebx, ebx
call fcn.7ff7c15a3e90
mov rcx, rax
call fcn.7ff7c15af0b0
mov edx, 0x104
lea rcx, [rsp + 0x40]
mov r8, qword [rax]
call fcn.7ff7c15ac064
mov esi, eax
test eax, eax
js 0x7ff7c15ba426
cmp ebx, 2
jae 0x7ff7c15ba41d
lea rdx, str.EppManifest.dll
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x7ff7c15ba3ea
call fcn.7ff7c15abfac
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x7ff7c15ba3ec
xor eax, eax
test eax, eax
setne dil
test eax, eax
jne 0x7ff7c15ba41d
call fcn.7ff7c15a3e90
mov rcx, rax
call fcn.7ff7c15af3e0
mov edx, 0x104
lea rcx, [rsp + 0x40]
mov r8, qword [rax]
call fcn.7ff7c15ac064
inc ebx
mov esi, eax
test eax, eax
jns 0x7ff7c15ba3bd
test dil, dil
jne 0x7ff7c15ba4ae
and qword [rsp + 0x30], 0
xor ebx, ebx
mov qword [rsp + 0x28], rbx
test esi, esi
js 0x7ff7c15ba44a
lea rcx, [rsp + 0x28]
call fcn.7ff7c15ba098
mov rbx, qword [rsp + 0x28]
mov esi, eax
test eax, eax
jne 0x7ff7c15ba494
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x7ff7c15ba48c
lea rdx, str.EppManifest.dll
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x7ff7c15ba48c
call fcn.7ff7c15abfac
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x7ff7c15ba48e
xor eax, eax
test eax, eax
setne dil
test rbx, rbx
je 0x7ff7c15ba4a2
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
test dil, dil
jne 0x7ff7c15ba4ae
mov edi, 0x8004ff70
jmp 0x7ff7c15ba521
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.7ff7c15bddd0
mov edi, eax
test eax, eax
js 0x7ff7c15ba50e
lea rdi, [r14 + 0x10]
mov rcx, qword [rdi]
test rcx, rcx
je 0x7ff7c15ba4d9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rdi], 0
mov rbx, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.7ff7c15bac74
mov edi, eax
test eax, eax
js 0x7ff7c15ba513
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x7ff7c15ba503
call qword [sym.imp.msvcrt.dll_free]
and qword [r14 + 0x18], 0
mov rcx, rbx
xor ebx, ebx
mov qword [r14 + 0x18], rcx
jmp 0x7ff7c15ba513
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x7ff7c15ba521
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.7ff7c15e78d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x7ff7c15baf00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x7ff7c15bafc0
test rdx, rdx
je 0x7ff7c15bafc0
xor r9d, r9d
lea rdx, [0x7ff7c15f9568]
lea edi, [r9 + 1]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x7ff7c15baf47
xor ebx, ebx
jmp 0x7ff7c15baf56
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
xor r9d, r9d
lea rdx, [0x7ff7c15f9568]
mov r8, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x7ff7c15baf75
xor ecx, ecx
jmp 0x7ff7c15baf84
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
test rbx, rbx
je 0x7ff7c15bafb5
test rcx, rcx
je 0x7ff7c15bafb5
mov eax, 0xfecdfecd
cmp dword [rbx], eax
jne 0x7ff7c15bafaf
cmp dword [rcx], eax
jne 0x7ff7c15bafaf
mov rax, qword [rbx + 0x1c]
cmp rax, qword [rcx + 0x1c]
jne 0x7ff7c15bafaf
mov rax, qword [rbx + 0x24]
cmp rax, qword [rcx + 0x24]
je 0x7ff7c15bafb1
xor edi, edi
mov eax, edi
jmp 0x7ff7c15bafc2
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7c15bc5c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, qword [r9]
mov rdi, r9
mov eax, r14d
mov r12, r8
mov dword [rsp + 0x78], eax
mov rbp, rdx
cmp rax, r14
je 0x7ff7c15bc600
mov ebx, 0x80070057
jmp 0x7ff7c15bc71e
mov r15, qword [rsp + 0x80]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov r9, r12
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x7ff7c15bc685
test r15, r15
je 0x7ff7c15bc650
mov eax, dword [rsp + 0x78]
cmp rax, qword [rdi]
jbe 0x7ff7c15bc650
mov qword [rdi], rax
mov ebx, 0x800700ea
jmp 0x7ff7c15bc71e
mov eax, dword [rsp + 0x78]
mov qword [rdi], rax
mov r8d, dword [r12]
mov r9, rdi
mov rdx, r14
mov qword [rsp + 0x20], r15
mov rcx, rbp
call fcn.7ff7c15bc4e4
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ebx, 0x80070002
cmp esi, ebx
jne 0x7ff7c15bc6c1
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15bc71e
test byte [rcx + 0x1c], 4
je 0x7ff7c15bc71e
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15fb138]
mov edx, 0x15
mov r9, rbp
call fcn.7ff7c15a1e54
jmp 0x7ff7c15bc71e
mov ebx, 0x800700ea
cmp esi, ebx
je 0x7ff7c15bc703
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15bc6ff
test byte [rcx + 0x1c], 1
je 0x7ff7c15bc6ff
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15fb138]
mov edx, 0x16
mov dword [rsp + 0x20], esi
mov r9, rbp
call fcn.7ff7c15a595c
mov ebx, esi
jmp 0x7ff7c15bc716
mov eax, dword [rsp + 0x78]
cmp qword [rdi], rax
jb 0x7ff7c15bc713
mov ebx, 0x8000ffff
jmp 0x7ff7c15bc71e
mov qword [rdi], rax
test ebx, ebx
jns 0x7ff7c15bc657
mov eax, ebx
jmp 0x7ff7c15bc66e