Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- .text:0000000140001150 sub_140001150 proc near ; CODE XREF: wWinMain+48↓p
- .text:0000000140001150 ; DATA XREF: .rdata:0000000140010AD8↓o ...
- .text:0000000140001150
- .text:0000000140001150 dwCreationDisposition= dword ptr -38h
- .text:0000000140001150 dwFlagsAndAttributes= dword ptr -30h
- .text:0000000140001150 hTemplateFile = qword ptr -28h
- .text:0000000140001150 var_18 = qword ptr -18h
- .text:0000000140001150 NumberOfBytesWritten= dword ptr 8
- .text:0000000140001150 arg_8 = qword ptr 10h
- .text:0000000140001150 arg_10 = qword ptr 18h
- .text:0000000140001150
- .text:0000000140001150 push rbx
- .text:0000000140001152 push rdi
- .text:0000000140001153 sub rsp, 48h
- .text:0000000140001157 xor ebx, ebx
- .text:0000000140001159 xor ecx, ecx ; lpModuleName
- .text:000000014000115B mov [rsp+58h+NumberOfBytesWritten], ebx
- .text:000000014000115F call cs:GetModuleHandleA
- .text:0000000140001165 mov rdi, rax
- .text:0000000140001168 test rax, rax
- .text:000000014000116B jnz short loc_14000118F
- .text:000000014000116D call cs:GetLastError
- .text:0000000140001173 mov ebx, eax
- .text:0000000140001175 test eax, eax
- .text:0000000140001177 jle loc_1400012CE
- .text:000000014000117D movzx ebx, ax
- .text:0000000140001180 or ebx, 80070000h
- .text:0000000140001186 mov eax, ebx
- .text:0000000140001188 add rsp, 48h
- .text:000000014000118C pop rdi
- .text:000000014000118D pop rbx
- .text:000000014000118E retn
- .text:000000014000118F ; ---------------------------------------------------------------------------
- .text:000000014000118F
- .text:000000014000118F loc_14000118F: ; CODE XREF: sub_140001150+1B↑j
- .text:000000014000118F lea r8, Type ; "CONFIG"
- .text:0000000140001196 mov edx, 65h ; 'e' ; lpName
- .text:000000014000119B mov rcx, rax ; hModule
- .text:000000014000119E
- .text:000000014000119E loc_14000119E: ; DATA XREF: .rdata:0000000140010AD8↓o
- .text:000000014000119E ; .rdata:0000000140010B34↓o ...
- .text:000000014000119E mov [rsp+58h+arg_10], rsi
- .text:00000001400011A3 call cs:FindResourceA
- .text:00000001400011A9 mov rsi, rax
- .text:00000001400011AC test rax, rax
- .text:00000001400011AF jz short loc_1400011CE
- .text:00000001400011B1 mov rdx, rax ; hResInfo
- .text:00000001400011B4 mov rcx, rdi ; hModule
- .text:00000001400011B7 call cs:SizeofResource
- .text:00000001400011BD mov rdx, rsi ; hResInfo
- .text:00000001400011C0 mov rcx, rdi ; hModule
- .text:00000001400011C3 call cs:LoadResource
- .text:00000001400011C9 test rax, rax
- .text:00000001400011CC jnz short loc_1400011F5
- .text:00000001400011CE
- .text:00000001400011CE loc_1400011CE: ; CODE XREF: sub_140001150+5F↑j
- .text:00000001400011CE call cs:GetLastError
- .text:00000001400011D4 mov ebx, eax
- .text:00000001400011D6 test eax, eax
- .text:00000001400011D8 jle loc_1400012C9
- .text:00000001400011DE mov rsi, [rsp+58h+arg_10]
- .text:00000001400011E3 movzx ebx, ax
- .text:00000001400011E6 or ebx, 80070000h
- .text:00000001400011EC mov eax, ebx
- .text:00000001400011EE add rsp, 48h
- .text:00000001400011F2 pop rdi
- .text:00000001400011F3 pop rbx
- .text:00000001400011F4 retn
- .text:00000001400011F5 ; ---------------------------------------------------------------------------
- .text:00000001400011F5
- .text:00000001400011F5 loc_1400011F5: ; CODE XREF: sub_140001150+7C↑j
- .text:00000001400011F5 ; DATA XREF: .rdata:0000000140010AE8↓o ...
- .text:00000001400011F5 mov rcx, rax ; hResData
- .text:00000001400011F8
- .text:00000001400011F8 loc_1400011F8: ; DATA XREF: .rdata:0000000140010AE8↓o
- .text:00000001400011F8 ; .rdata:0000000140010AF8↓o ...
- .text:00000001400011F8 mov [rsp+58h+var_18], r12
- .text:00000001400011FD call cs:LockResource
- .text:0000000140001203 mov r12, rax
- .text:0000000140001206 test rax, rax
- .text:0000000140001209 jnz short loc_140001229
- .text:000000014000120B call cs:GetLastError
- .text:0000000140001211 mov ebx, eax
- .text:0000000140001213 test eax, eax
- .text:0000000140001215 jle loc_1400012C4
- .text:000000014000121B movzx ebx, ax
- .text:000000014000121E or ebx, 80070000h
- .text:0000000140001224 jmp loc_1400012C4
- .text:0000000140001229 ; ---------------------------------------------------------------------------
- .text:0000000140001229
- .text:0000000140001229 loc_140001229: ; CODE XREF: sub_140001150+B9↑j
- .text:0000000140001229 xor r9d, r9d ; lpSecurityAttributes
- .text:000000014000122C mov [rsp+58h+hTemplateFile], rbx ; hTemplateFile
- .text:0000000140001231 lea rcx, FileName ; "brbconfig.tmp"
- .text:0000000140001238 lea r8d, [r9+1] ; dwShareMode
- .text:000000014000123C mov edx, 0C0000000h ; dwDesiredAccess
- .text:0000000140001241 mov [rsp+58h+dwFlagsAndAttributes], ebx ; dwFlagsAndAttributes
- .text:0000000140001245
- .text:0000000140001245 loc_140001245: ; DATA XREF: .rdata:0000000140010AF8↓o
- .text:0000000140001245 ; .rdata:0000000140010B0C↓o ...
- .text:0000000140001245 mov [rsp+58h+arg_8], rbp
- .text:000000014000124A mov [rsp+58h+dwCreationDisposition], 2 ; dwCreationDisposition
- .text:0000000140001252 call cs:CreateFileA
- .text:0000000140001258 mov rbp, rax
- .text:000000014000125B cmp rax, 0FFFFFFFFFFFFFFFFh
- .text:000000014000125F jnz short loc_140001278
- .text:0000000140001261 call cs:GetLastError
- .text:0000000140001267 mov ebx, eax
- .text:0000000140001269 test eax, eax
- .text:000000014000126B jle short loc_1400012BF
- .text:000000014000126D movzx ebx, ax
- .text:0000000140001270 or ebx, 80070000h
- .text:0000000140001276 jmp short loc_1400012BF
- .text:0000000140001278 ; ---------------------------------------------------------------------------
- .text:0000000140001278
- .text:0000000140001278 loc_140001278: ; CODE XREF: sub_140001150+10F↑j
- .text:0000000140001278 mov rdx, rsi ; hResInfo
- .text:000000014000127B mov rcx, rdi ; hModule
- .text:000000014000127E call cs:SizeofResource
- .text:0000000140001284 lea r9, [rsp+58h+NumberOfBytesWritten] ; lpNumberOfBytesWritten
- .text:0000000140001289 mov rdx, r12 ; lpBuffer
- .text:000000014000128C mov rcx, rbp ; hFile
- .text:000000014000128F mov r8d, eax ; nNumberOfBytesToWrite
- .text:0000000140001292 mov qword ptr [rsp+58h+dwCreationDisposition], rbx ; lpOverlapped
- .text:0000000140001297 call cs:WriteFile
- .text:000000014000129D test eax, eax
- .text:000000014000129F jnz short loc_1400012B6
- .text:00000001400012A1 call cs:GetLastError
- .text:00000001400012A7 mov ebx, eax
- .text:00000001400012A9 test eax, eax
- .text:00000001400012AB jle short loc_1400012B6
- .text:00000001400012AD movzx ebx, ax
- .text:00000001400012B0 or ebx, 80070000h
- .text:00000001400012B6
- .text:00000001400012B6 loc_1400012B6: ; CODE XREF: sub_140001150+14F↑j
- .text:00000001400012B6 ; sub_140001150+15B↑j
- .text:00000001400012B6 mov rcx, rbp ; hObject
- .text:00000001400012B9 call cs:CloseHandle
- .text:00000001400012BF
- .text:00000001400012BF loc_1400012BF: ; CODE XREF: sub_140001150+11B↑j
- .text:00000001400012BF ; sub_140001150+126↑j
- .text:00000001400012BF mov rbp, [rsp+58h+arg_8]
- .text:00000001400012C4
- .text:00000001400012C4 loc_1400012C4: ; CODE XREF: sub_140001150+C5↑j
- .text:00000001400012C4 ; sub_140001150+D4↑j
- .text:00000001400012C4 ; DATA XREF: ...
- .text:00000001400012C4 mov r12, [rsp+58h+var_18]
- .text:00000001400012C9
- .text:00000001400012C9 loc_1400012C9: ; CODE XREF: sub_140001150+88↑j
- .text:00000001400012C9 ; DATA XREF: .pdata:0000000140016048↓o ...
- .text:00000001400012C9 mov rsi, [rsp+58h+arg_10]
- .text:00000001400012CE
- .text:00000001400012CE loc_1400012CE: ; CODE XREF: sub_140001150+27↑j
- .text:00000001400012CE ; DATA XREF: .pdata:0000000140016054↓o ...
- .text:00000001400012CE mov eax, ebx
- .text:00000001400012D0 add rsp, 48h
- .text:00000001400012D4 pop rdi
- .text:00000001400012D5 pop rbx
- .text:00000001400012D6 retn
- .text:00000001400012D6 sub_140001150 endp
Advertisement
Add Comment
Please, Sign In to add comment
