joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14028cc00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x14028cc3f
test r15, r15
je 0x14028cd2d
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x14028cc89
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.14024de40
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x14028cc1d
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x14028cd59
lea rcx, [r12*8]
call fcn.14024abdc
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x14028ccfd
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x14028cd2d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x14028cce5
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x14028cc1d
mov rcx, r14
call fcn.14024ac18
mov r15, qword [rsi + 0x10]
jmp 0x14028cc1d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14028c680
call fcn.1402885d0
int3
Function at 0x14028cd60
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14028cda2
mov r14, rbx
add r14, 0xfffffffffffffff8
je 0x14028ce99
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x14028cdf4
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r14, [r15 + r12*8]
sub r15, rbx
je 0x14028cde6
sub r14, r15
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.14024de40
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r14
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14028cd7f
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x14028cec5
lea rcx, [r12*8]
call fcn.14024abdc
lea r14, [r12 + r12]
add r14, 6
and r14, 0xfffffffffffffff8
add r14, rax
mov rcx, r14
sub r15, rbx
je 0x14028ce6c
mov rdx, r15
sar rdx, 3
and r15, 0xfffffffffffffff8
mov rcx, r15
add rcx, r14
shl rdx, 3
xor r8d, r8d
mov r9, r14
add r9, r8
je 0x14028ce99
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x14028ce54
lea rdx, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
test rbx, rbx
je 0x14028cd7f
mov rcx, rbx
call fcn.14024ac18
mov r14, qword [rsi + 8]
jmp 0x14028cd7f
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14028c680
call fcn.1402885d0
int3
Function at 0x14028d5c0
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x198], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x170], xmm0
mov dword [rsp + 0x190], 0
cmp byte [rcx + 0x17], 0
jns 0x14028d606
mov rcx, qword [rsi]
lea r8, [rsp + 0x170]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14028d6a9
mov rcx, rsi
call fcn.1400fd090
movzx r8d, al
xor r8d, 5
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14028d63a
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
test eax, eax
je 0x14028d6bb
lea rcx, str.....chromeinstallerutildelete_after_reboot_helper.cc
mov edx, 0x3a
call fcn.1401ee400
test eax, eax
jle 0x14028d6c9
lea rdx, str.....chromeinstallerutildelete_after_reboot_helper.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x5e
mov r9d, 0xffffffff
call fcn.1400ee420
lea rcx, [rsp + 0x40]
lea rdx, str.Scheduled_for_deletion:
mov r8d, 0x18
call fcn.1402885e0
mov rcx, rax
mov rdx, rsi
call fcn.1400eee50
mov rcx, rbx
call fcn.1400ee910
jmp 0x14028d6c9
mov ecx, 1
call fcn.1401ee3d0
test al, al
jne 0x14028d6ec
xor esi, esi
jmp 0x14028d6cf
mov ecx, 2
call fcn.1401ee3d0
test al, al
jne 0x14028d744
test edi, edi
setne sil
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14024c3c0
mov eax, esi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutildelete_after_reboot_helper.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x3f
mov r9d, 1
call fcn.1402c61f0
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.1400eee50
lea rdx, str._does_not_exist.
mov r8d, 0x10
mov rcx, rax
call fcn.1402885e0
mov rcx, rdi
call fcn.1402c6270
jmp 0x14028d6b7
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutildelete_after_reboot_helper.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4a
mov r9d, 2
call fcn.1402c61f0
lea rcx, [rsp + 0x40]
lea rdx, str.Could_not_schedule
mov r8d, 0x13
call fcn.1402885e0
mov rcx, rax
mov rdx, rsi
call fcn.1400eee50
lea rdx, str._for_deletion.
mov r8d, reloc.WS2_32.dll_ntohl
mov rcx, rax
call fcn.1402885e0
mov rcx, rbx
call fcn.1402c6270
jmp 0x14028d6c9
Function at 0x140294a50
Capabilities:
Delete service

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rbx, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x140294aa8
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dil, 1
test eax, eax
je 0x140294acb
cmp qword [rsi], 0
je 0x140294aaa
call fcn.1401ee3c0
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsi], 0
jmp 0x140294aaa
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14024c3c0
mov eax, edi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, 1
call fcn.1401ee3d0
test al, al
jne 0x140294aed
cmp edi, 0x430
sete dil
jmp 0x140294a8b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_service_work_item_impl.cc
lea rcx, [rsp + 0x48]
mov r8d, 0x25d
mov r9d, 1
call fcn.1402c61f0
lea rcx, [rsp + 0x58]
lea rdx, str.DeleteService_failed
mov r8d, 0x15
call fcn.1402885e0
mov r14, rax
lea r15, [rsp + 0x30]
mov rcx, rbx
mov rdx, r15
call fcn.140294720
cmp byte [r15 + 0x17], 0
jns 0x140294b49
mov r15, qword [rsp + 0x30]
mov rcx, r14
mov rdx, r15
call fcn.1402c6330
cmp byte [rsp + 0x47], 0
jns 0x140294b65
mov rcx, qword [rsp + 0x30]
call fcn.14024ac18
lea rcx, [rsp + 0x48]
call fcn.1402c6270
jmp 0x140294ae1
Function at 0x14029ba10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rdx]
lea r15, [rdx + 8]
test rax, rax
mov rcx, r15
cmove rcx, rax
mov edx, dword [rcx + 8]
xor r8d, r8d
test edx, edx
setne r8b
lea r9, [rsi + 0x28]
xor ecx, ecx
cmp rax, 2
cmovb r9, rcx
mov dword [rsp + 0x20], edx
mov edx, dword [r9 + 8]
mov dword [rsp + 0x24], edx
test edx, edx
mov edx, 2
cmove rdx, r8
lea r8, [rsi + 0x48]
cmp rax, 3
cmovb r8, rcx
mov r8d, dword [r8 + 8]
test r8d, r8d
mov r9d, 3
cmove r9, rdx
lea rdx, [rsi + 0x68]
cmp rax, 4
cmovb rdx, rcx
mov dword [rsp + 0x28], r8d
mov edx, dword [rdx + 8]
mov dword [rsp + 0x2c], edx
test edx, edx
mov edx, 4
cmove rdx, r9
lea r8, [rsi + 0x88]
cmp rax, 5
cmovb r8, rcx
mov r8d, dword [r8 + 8]
test r8d, r8d
mov r9d, 5
cmove r9, rdx
lea rdx, [rsi + 0xa8]
cmp rax, 6
cmovb rdx, rcx
mov dword [rsp + 0x30], r8d
mov edx, dword [rdx + 8]
mov dword [rsp + 0x34], edx
test edx, edx
mov edx, 6
cmove rdx, r9
lea r8, [rsi + 0xc8]
cmp rax, 7
cmovb r8, rcx
mov r8d, dword [r8 + 8]
test r8d, r8d
mov r9d, 7
cmove r9, rdx
lea rdx, [rsi + 0xe8]
cmp rax, 8
cmovb rdx, rcx
mov dword [rsp + 0x38], r8d
mov edx, dword [rdx + 8]
mov dword [rsp + 0x3c], edx
test edx, edx
mov edx, 8
cmove rdx, r9
lea r8, [rsi + 0x108]
cmp rax, 9
cmovb r8, rcx
mov r8d, dword [r8 + 8]
test r8d, r8d
mov r9d, 9
cmove r9, rdx
cmp rax, 0xa
lea rax, [rsi + 0x128]
cmovb rax, rcx
mov dword [rsp + 0x40], r8d
mov eax, dword [rax + 8]
mov dword [rsp + 0x44], eax
test eax, eax
mov ebx, 0xa
cmove rbx, r9
mov r14, qword [rdi]
lea r12, [rdi + 8]
test r14, r14
cmovne r14, r12
mov rcx, r14
mov rdx, rbx
call fcn.14029b2f0
mov ebp, eax
test al, al
je 0x14029bbd2
test rbx, rbx
je 0x14029bbd2
mov r13d, 1
mov edx, dword [rsp + r13*4 + 0x1c]
mov rcx, r14
call fcn.14029b2f0
mov ebp, eax
test al, al
je 0x14029bbd2
lea rax, [r13 + 1]
cmp r13, rbx
mov r13, rax
jb 0x14029bbb3
test bpl, bpl
je 0x14029bc19
test rbx, rbx
je 0x14029bc19
mov r14d, 1
lea rax, [r14 - 1]
mov rcx, r12
cmp qword [rdi], rax
ja 0x14029bbf0
xor ecx, ecx
mov rdx, r15
cmp qword [rsi], rax
ja 0x14029bbfa
xor edx, edx
call fcn.14029b3e0
mov ebp, eax
test al, al
je 0x14029bc19
lea rax, [r14 + 1]
add r15, 0x20
add r12, 0x20
cmp r14, rbx
mov r14, rax
jb 0x14029bbe2
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14024c3c0
mov eax, ebp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1402a2360
Capabilities:
Encode data using base64

Disassembly:
mov rax, qword [rcx]
mov r8, qword [rcx + 8]
sub r8, rax
sar r8, 3
cmp r8, rdx
jb 0x1402a2376
ja 0x1402a237e
ret
sub rdx, r8
jmp fcn.1402a2640
lea rdx, [rax + rdx*8]
jmp fcn.14029fa60
Function at 0x1402a6440
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
test al, 1
jne 0x1402a6480
lea rdi, [rsi + 8]
mov ecx, 4
shr rax, 1
cmp rax, rcx
je 0x1402a648a
shl rax, 3
add rdi, rax
je 0x1402a6498
mov rcx, rdi
call fcn.1401e6070
add qword [rsi], 2
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov rdi, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
jmp 0x1402a6459
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1402a64d0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14028c680
int3

Function at 0x1402a7770
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x28]
mov qword [rdi], rdx
mov rdx, rdi
call fcn.1401e61c0
lea rdx, [rsi + 0xc8]
mov r8d, dword [rdi]
mov rcx, qword [rsi + 0x90]
mov qword [rsp + 0x20], rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1402a77cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1402a77fb
mov byte [rsi + 0xe9], 1
mov eax, 1
lock xadd dword [rsi + 8], eax
cmp eax, 0x7fffffff
je 0x1402a77f8
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14024c3c0
nop
add rsp, 0x38
pop rdi
pop rsi
ret
int3
mov rcx, rsi
xor edx, edx
call fcn.1400c5840
jmp 0x1402a77e3

Function at 0x1402bffe0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14024abdc
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1402c0050]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.14025e524
mov qword [rbx], rax
test rax, rax
je 0x1402c0037
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1402c5230
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1401ed9f0
test al, al
jne 0x1402c5251
mov rcx, rsi
call fcn.1401ed9f0
test al, al
je 0x1402c525a
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1402ccac0
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x1403be790]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.MoveUnsafe
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x421
call fcn.1401ee3a0
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1401fb430
mov al, byte [rdi + 0x17]
test al, al
jns 0x1402ccb87
cmp qword [rdi + 8], 0x103
jbe 0x1402ccb87
lea rcx, [rsp + 0x40]
call fcn.1401fb490
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14024c3c0
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov cl, byte [rsi + 0x17]
test cl, cl
jns 0x1402ccb9c
cmp qword [rsi + 8], 0x103
jbe 0x1402ccb9c
xor ebx, ebx
jmp 0x1402ccb5b
mov rdx, rsi
test cl, cl
jns 0x1402ccba6
mov rdx, qword [rsi]
mov rcx, rdi
test al, al
jns 0x1402ccbb0
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x1402ccb5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
call fcn.1400fd090
test al, al
jne 0x1402ccbe0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1402ccb98
mov rcx, rdi
mov rdx, rsi
call fcn.1402ccc00
test al, al
jne 0x1402ccb5b
jmp 0x1402ccbd6
Function at 0x1402c5a10
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140446a80], 0
je 0x1402c5a56
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14024c3c0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x140446a58]
test rdi, rdi
je 0x1402c5af7
test byte [0x140431c28], 1
je 0x1402c5a39
cmp byte [rdi + 0x17], 0
jns 0x1402c5a78
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140446a80], rax
inc rax
cmp rax, 1
ja 0x1402c5a39
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14024e4f0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1402c5bc2
xor esi, esi
jmp 0x1402c5a39
mov ecx, 0x18
call fcn.14024abdc
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.14024e4f0
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1403be790]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1402884c0
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x1402c5b5e
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
jmp 0x1402c5b64
and eax, 0x7f
mov rcx, rdi
test rax, rax
jne 0x1402c5b8a
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.1400d3eb0
mov qword [0x140446a58], rdi
jmp 0x1402c5a66
lea r8, [rax + rax]
test r8, r8
je 0x1402c5b69
lea rdx, [r8 - 2]
cmp word [rcx + r8 - 2], 0x5c
mov r8, rdx
jne 0x1402c5b8e
cmp rdx, 0xfffffffffffffffe
je 0x1402c5b69
sar rdx, 1
inc rdx
cmp rax, rdx
jb 0x1402c5c89
mov rcx, rdi
call fcn.140288740
jmp 0x1402c5b69
mov rdi, qword [0x140446a58]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140272ba4
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.1400d3b00
mov rcx, qword [0x140446a58]
call fcn.1400d1d50
cmp word [rax], 0x5c
je 0x1402c5c0f
mov rcx, qword [0x140446a58]
lea rdx, [0x1403bf940]
mov r8d, 1
call fcn.1400d3eb0
mov rcx, qword [0x140446a58]
lea rdx, str.debug.log
mov r8d, 9
call fcn.1400d3eb0
mov rcx, qword [0x140446a58]
cmp byte [rcx + 0x17], 0
jns 0x1402c5c38
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140446a80], rax
inc rax
cmp rax, 1
ja 0x1402c5a39
mov qword [0x140446a80], 0
jmp 0x1402c5af0
call fcn.140264f20
int3
Function at 0x1402cb140
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x858
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0x850], rax
cmp byte [0x140431c60], 0
je 0x1402cb303
mov rdx, qword [0x140446c68]
test rdx, rdx
je 0x1402cb303
cmp byte [rdx + 0x17], 0
jns 0x1402cb18b
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
je 0x1402cb32d
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1401ee3c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1403be790]
movaps xmmword [r14], xmm0
mov rdx, r14
call fcn.1401d0bc0
mov eax, dword [rsi + 8]
test eax, eax
je 0x1402cb240
cmp eax, 1
je 0x1402cb246
mov bx, 1
add eax, 0xfffffffe
cmp eax, 2
jae 0x1402cb24a
lea r12, [rsp + 0x78]
mov r8d, 0x7d8
mov rcx, r12
mov dl, 0xaa
call fcn.14024e4f0
mov rcx, r12
call fcn.1401483d0
lea r15, [rsp + 0x48]
mov rcx, r12
mov rdx, r15
call fcn.140319990
movzx r8d, byte [r15 + 0x17]
test r8b, r8b
jns 0x1402cb37b
mov r8, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
jmp 0x1402cb37f
mov bx, 4
jmp 0x1402cb24a
mov bx, 2
cmp byte [rsp + 0x77], 0
jns 0x1402cb256
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x48], 0
mov rcx, qword [0x140446c78]
cmp byte [rcx + 0x17], 0
jns 0x1402cb274
mov rcx, qword [rcx]
lea rdx, [rsp + 0x48]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x1402cb345
mov rax, qword [rsp + 0x48]
mov r9d, dword [0x140446c74]
movzx r8d, word [0x140446c70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x1402cb360
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1402cb2e4
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [rsp + 0x77], 0
jns 0x1402cb2f5
mov rcx, qword [rsp + 0x60]
call fcn.14024ac18
call fcn.1401ee3c0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.1400ee910
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14024c3c0
nop
add rsp, 0x858
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1402885e0
jmp 0x1402cb303
lea rcx, [rsi + 0x10]
lea rdx, str.___ERROR_GETTING_USER_SID__
mov r8d, 0x1b
call fcn.1402885e0
jmp 0x1402cb286
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1402885e0
jmp 0x1402cb2d4
and r8d, 0x7f
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.1400d2be0
cmp byte [rsp + 0x5f], 0
jns 0x1402cb24a
mov rcx, qword [rsp + 0x48]
call fcn.14024ac18
jmp 0x1402cb24a
Function at 0x1402cc090
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x50], rax
movaps xmm0, xmmword [0x1403be790]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x189
call fcn.1401ee3a0
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1401fb430
mov al, byte [rsi + 0x17]
test al, al
jns 0x1402cc120
cmp qword [rsi + 8], 0x103
ja 0x1402cc13e
test al, al
jns 0x1402cc127
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.1401fb490
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14024c3c0
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1402cc910
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14042f038]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x50], r12
movaps xmm6, xmmword [0x1403be790]
movaps xmmword [r14 + 0x40], xmm6
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x7d
call fcn.1401ee3a0
xor ebp, ebp
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1401fb430
mov rcx, rdi
call fcn.1401ed9f0
test al, al
je 0x1402cc9e9
lea rcx, [rsp + 0x60]
call fcn.1401fb490
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14024c3c0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rsi
call fcn.1401ed9f0
test al, al
je 0x1402cc9f9
xor ebp, ebp
jmp 0x1402cc9b3
cmp byte [rdi + 0x17], 0
jns 0x1402cca09
cmp qword [rdi + 8], 0x103
ja 0x1402cc9f5
cmp byte [rsi + 0x17], 0
jns 0x1402cca19
cmp qword [rsi + 8], 0x103
ja 0x1402cc9f5
lea r14, [rsp + 0x40]
mov qword [r14 + 0x10], r12
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x8a
call fcn.1401ee3a0
lea r8, [0x1404484f8]
mov rcx, r14
mov rdx, r15
call fcn.14014c720
cmp byte [rsi + 0x17], 0
jns 0x1402cca62
mov rsi, qword [rsi]
movzx r8d, bl
cmp byte [rdi + 0x17], 0
jns 0x1402cca6f
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1402ccaba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x1402ccaa4
mov eax, edi
and eax, 1
je 0x1402ccaa4
mov edx, edi
and edx, 0xfffffffe
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bpl
lea rcx, [rsp + 0x40]
call fcn.14014c830
jmp 0x1402cc9b3
xor ebp, ebp
jmp 0x1402ccaab