joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007be00
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rdi
push r12
push r15
sub rsp, 0x58
cmp byte [r8 + 8], 0
mov r12, rdx
mov rdi, rcx
je 0x14007be20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14007be23
mov rax, qword [r8]
mov rcx, rax
mov qword [rsp + 0x48], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rbx, qword [0x14017c138]
mov r15d, eax
test rbx, rbx
jne 0x14007be4a
xor esi, esi
mov qword [rdi], rsi
jmp 0x14007bf27
mov ecx, dword [0x140175c18]
mov qword [rsp + 0x50], rbp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x14007be6b
call fcn.140089c90
mov rcx, rax
movsxd rbp, dword [rbx + 0x1c]
mov eax, dword [rbx + 0x20]
add rbp, rbp
cmp dword [rcx + rbp*8 + 8], eax
jne 0x14007be84
mov rbp, qword [rcx + rbp*8]
test rbp, rbp
jne 0x14007be8f
mov rcx, rbx
call fcn.14007ad80
mov rbp, rax
xor esi, esi
mov qword [rdi], rbp
test rbp, rbp
je 0x14007bf22
mov rcx, qword [rbp + 8]
mov qword [rsp + 0x40], r14
mov r14d, dword [rcx + 0x38]
cmp r14d, dword [rbp + 0x18]
jb 0x14007beb6
mov rax, qword [rbp + 8]
jmp 0x14007bf12
mov rbx, r14
lea rcx, [rsp + 0x80]
shl rbx, 7
add rbx, qword [rbp + 0x10]
call qword [0x140175bf0]
mov byte [rsp + 0x20], 1
mov rcx, qword [rax]
mov qword [rbx], rcx
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], rsi
mov byte [rbx + 0x70], 0x51
mov qword [rbx + 0x78], r15
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
mov qword [rbx + 0x18], rsi
mov rax, qword [rbp + 8]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rcx
lea ecx, [r14 + 1]
mov dword [rax + 0x38], ecx
mov dword [rdi + 8], r14d
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov qword [rdi + 0x10], rsi
mov rax, rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rbx
ret

Function at 0x14007d460
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov edi, 8
lea rbp, [rsp + 0x70]
mov ebx, edi
mov r14, rcx
mov r15d, 0xffffffff
nop word [rax + rax]
cmp rbx, r15
mov esi, ebx
mov rcx, rbp
cmova esi, r15d
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x14007d4a9
int3
mov eax, esi
add rbp, rax
sub rbx, rax
jne 0x14007d490
mov rbp, qword [rsp + 0x70]
lea rsi, [rsp + 0x70]
nop dword [rax]
cmp rdi, r15
mov ebx, edi
mov rcx, rsi
cmova ebx, r15d
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x14007d4d9
int3
mov eax, ebx
add rsi, rax
sub rdi, rax
jne 0x14007d4c0
mov r10, qword [rsp + 0x70]
and rbp, 0xffffffffffff4fff
bts rbp, 0xe
movabs rax, 0x3fffffffffffffff
and r10, rax
movzx ecx, bp
movabs rax, 0x8000000000000000
or r10, rax
movabs rax, 0xffffffffffff
mov rdx, r10
shr r10, 0x30
and rdx, rax
mov rax, rbp
mov qword [rsp + 0x30], rdx
lea rdx, str._08x__04x__04x__04x__012llx
shr rax, 0x10
mov dword [rsp + 0x28], r10d
shr rbp, 0x20
mov dword [rsp + 0x20], ecx
mov r8d, ebp
movzx r9d, ax
mov rcx, r14
call fcn.140065790
mov rbx, qword [rsp + 0x80]
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140082f80
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
call fcn.14008ca10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14008cb90
mov rax, qword [rsp + 0x20]
bswap rax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140111850
add rsp, 0xa8
ret

Function at 0x140083d80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, qword [rcx]
mov rcx, qword [rcx + 8]
sub rcx, r9
sar rcx, 2
test rcx, rcx
je 0x140083e07
mov r10, rcx
lea r11, [0x1401513e0]
nop dword [rax]
mov eax, dword [r9]
lea r9, [r9 + 4]
movzx r8d, cl
shr ecx, 8
movzx edx, al
xor r8, rdx
mov dword [rsp + 8], eax
movzx eax, byte [rsp + 9]
mov edx, dword [r11 + r8*4]
xor edx, ecx
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xa]
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
mov edx, dword [r11 + rcx*4]
xor edx, r8d
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r11 + rcx*4]
xor eax, edx
mov ecx, eax
sub r10, 1
jne 0x140083da0
ret
mov eax, ecx
ret
Function at 0x140089c90
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1030
call fcn.140112490
sub rsp, rax
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov ebx, dword [0x140175c18]
cmp ebx, 0xffffffff
jne 0x140089d06
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, ebx
je 0x140089cce
mov ebx, eax
jmp 0x140089ce8
int3
or eax, 0xffffffff
lock cmpxchg dword [0x140175c18], ebx
cmp eax, 0xffffffff
je 0x140089d06
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ebx, dword [0x140175c18]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140089d14
int3
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x1000
call fcn.140113400
lea rdx, [rsp + 0x20]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, 0x1000
call fcn.140111e80
mov rdi, rax
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8d, 0x20
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rdx - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub r8, 1
jne 0x140089d50
mov rdx, rdi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rdi
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0x1040]
add rsp, 0x1030
pop rdi
ret

Function at 0x140089ff0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
mov rbp, rdx
mov ecx, dword [0x140175c18]
cmp ecx, 0xffffffff
je 0x14008a020
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14008a025
call fcn.140089c90
xor edi, edi
mov dword [rsi + 4], 0xffffffff
mov dword [rsi + 8], edi
call fcn.140089c20
mov rbx, rax
call fcn.14006b020
mov rdx, rax
lea rcx, [rsp + 0x20]
mov r8, rbx
call fcn.14007bbd0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea rcx, [rsp + 0x20]
call fcn.14007ac80
mov r8, qword [0x14017c1e8]
lea r9, [0x140179110]
nop
mov eax, edi
lea rcx, [r8 + 1]
add rcx, rax
movzx edx, cl
lea rax, [rdx + rdx*2]
cmp dword [r9 + rax*8], 0
je 0x14008a093
inc edi
cmp edi, 0x100
jl 0x14008a070
jmp 0x14008a0b6
lea rax, [rdx + rdx*2]
mov qword [0x14017c1e8], rdx
mov dword [r9 + rax*8], 1
mov qword [r9 + rax*8 + 8], rbp
mov dword [rsi + 4], edx
mov eax, dword [r9 + rax*8 + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [rsi + 4], 0xffffffff
jne 0x14008a0c6
int3
cmp dword [rsi + 4], 0x100
jl 0x14008a0d0
int3
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov dword [rsi], 1
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14008bee0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov r10, qword [rcx]
xor edi, edi
mov r14, rdx
mov dword [rsp + 0x60], edi
mov rsi, rcx
lea rax, [r10 + 1]
test rax, 0xfffffffffffffffe
jne 0x14008bf0f
xor al, al
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x68], rbx
mov eax, 4
mov qword [rsp + 0x70], rbp
mov ebp, edi
mov qword [rsp + 0x38], r13
mov edx, edi
mov ecx, edi
lea r13d, [rax - 2]
test r8d, r8d
je 0x14008bf52
sub r8d, 1
je 0x14008bf4e
cmp r8d, 1
jne 0x14008bf55
mov rcx, qword [r14 + 8]
mov ebp, eax
mov edx, dword [r14 + 8]
sar rcx, 0x20
jmp 0x14008bf55
mov ebp, eax
jmp 0x14008bf55
mov ebp, r13d
mov r9d, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edx
mov r8d, ebp
xor edx, edx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdx, rax
lea rcx, [rsi + 0x48]
call fcn.140033814
mov rax, qword [rsi + 0x48]
inc rax
test rax, 0xfffffffffffffffe
jne 0x14008bf8e
xor al, al
jmp 0x14008bfcc
mov qword [rsp + 0x78], r12
xor ebx, ebx
mov r12, qword [r14]
mov qword [rsp + 0x30], r15
mov r15d, edi
test r12, r12
jne 0x14008bfe4
cmp qword [r14 + 8], rbx
jne 0x14008bfe4
mov rcx, rsi
call fcn.140078a90
lea rcx, [rax - 1]
cmp rcx, 0x7ffffffe
jbe 0x14008c00d
xor al, al
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r13, qword [rsp + 0x38]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call fcn.140070410
mov r15d, r12d
mov rbx, qword [rax + 0x50]
mov rax, qword [r14 + 8]
dec rbx
and r15d, ebx
not rbx
movsxd rdi, r15d
add rdi, rax
and rbx, r12
js 0x14008bfc0
test rdi, rdi
js 0x14008bfc0
mov ecx, 4
mov qword [rsi + 0x40], rax
mov r8, rbx
mov qword [rsp + 0x20], rdi
shr r8, 0x20
mov r9d, ebx
test r13b, bpl
cmovne r13d, ecx
mov rcx, qword [rsi + 0x48]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x38], rax
mov rcx, rax
test rax, rax
je 0x14008bfc0
movsxd rax, r15d
add rax, rcx
mov qword [rsi + 0x38], rax
mov al, 1
jmp 0x14008bfc2

Function at 0x14008c150
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov edi, 8
lea rbx, [rsp + 0x40]
mov ebp, 0xffffffff
nop dword [rax + rax]
cmp rdi, rbp
mov esi, edi
mov rcx, rbx
cmova esi, ebp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x14008c188
int3
mov eax, esi
add rbx, rax
sub rdi, rax
jne 0x14008c170
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008c1b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
test rdx, rdx
je 0x14008c216
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov qword [rsp + 0x38], rbp
mov rdi, rdx
mov qword [rsp + 0x40], rsi
mov ebp, 0xffffffff
mov rbx, rcx
nop dword [rax]
nop dword [rax + rax]
cmp rdi, rbp
mov esi, edi
mov rcx, rbx
cmova esi, ebp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x14008c1f8
int3
mov eax, esi
add rbx, rax
sub rdi, rax
jne 0x14008c1e0
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14008cd00
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x44], eax
mov rbx, r8
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
call fcn.14008ca10
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14008cb90
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140111850
add rsp, 0xa0
pop rbx
ret

Function at 0x14008d780
Capabilities:
Encode data using xor

Disassembly:
mov r9d, edx
mov r8, rcx
mov eax, edx
test edx, edx
jle 0x14008d85e
test rcx, rcx
je 0x14008d85e
mov r10d, edx
sar r9d, 2
and r10d, 3
test r9d, r9d
jle 0x14008d7da
nop dword [rax]
movzx ecx, word [r8]
dec r9d
movzx edx, word [r8 + 2]
add eax, ecx
mov ecx, eax
shl edx, 0xb
shl ecx, 0x10
add r8, 4
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test r9d, r9d
jg 0x14008d7b0
sub r10d, 1
je 0x14008d81e
sub r10d, 1
je 0x14008d80a
cmp r10d, 1
jne 0x14008d831
movzx ecx, word [r8]
movsx edx, byte [r8 + 2]
add eax, ecx
mov ecx, eax
shl edx, 0x12
shl ecx, 0x10
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
jmp 0x14008d82f
movzx ecx, word [r8]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x14008d82f
movsx ecx, byte [r8]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [rax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
shr ecx, 6
add eax, ecx
ret
xor eax, eax
ret
Function at 0x140092254
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rdx
lea rax, [rsp + 0x60]
mov edx, ecx
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor ecx, ecx
xor r9d, r9d
mov word [rsp + 0x60], bx
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400922ab
xor al, al
jmp 0x140092307
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
cmp word [rsp + 0x60], bx
je 0x1400922d1
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400922c5
mov rbx, rax
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140059940
mov rdx, rax
mov rcx, rdi
call fcn.140059a60
lea rcx, [rsp + 0x40]
call fcn.1400599c0
mov al, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400928e8
Capabilities:
Move file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edi, edi
mov rbx, rcx
xor edx, edx
mov dword [rsp + 0x30], edi
lea rcx, [r11 - 0x40]
lea r8d, [rdi + 0x24]
call fcn.140113400
cmp qword [rbx + 0x18], 8
jb 0x14009292d
mov rcx, qword [rbx]
jmp 0x140092930
mov rcx, rbx
lea r8, [rsp + 0x148]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x1400929b6
lea ecx, [rax + 1]
call fcn.140067fc0
test al, al
je 0x14009299f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 1
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 0x3d]
call fcn.140068d00
cmp qword [rbx + 0x18], 8
jb 0x14009297f
mov rbx, qword [rbx]
lea rcx, [rax + 0x10]
mov rdx, rbx
call fcn.140068e50
lea rdx, str._does_not_exist.
mov rcx, rax
call fcn.14002bcb4
mov edi, 1
test dil, 1
je 0x1400929af
lea rcx, [rsp + 0x38]
call fcn.140068d80
xor al, al
jmp 0x140092ac3
mov rcx, rbx
call fcn.14004ed50
mov ecx, 5
test al, al
lea r8d, [rcx - 1]
cmove r8d, ecx
cmp qword [rbx + 0x18], 8
jb 0x1400929d9
mov rcx, qword [rbx]
jmp 0x1400929dc
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140092a58
cmp dword [0x14017c080], 2
jg 0x140092a4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 2
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 0x47]
call fcn.140068d00
lea rdx, str.Could_not_schedule
lea rcx, [rax + 0x10]
call fcn.14002bcb4
cmp qword [rbx + 0x18], 8
jb 0x140092a30
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140068e50
lea rdx, str._for_deletion.
mov rcx, rax
call fcn.14002bcb4
mov edi, 2
test dil, 2
jmp 0x1400929a3
mov edx, 0x3a
lea rcx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
call fcn.140067ff0
cmp eax, 1
jl 0x140092ab1
or r9d, 0xffffffff
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x38]
lea r8d, [r9 + 0x5e]
call fcn.1400681c0
lea rdx, str.Scheduled_for_deletion:
lea rcx, [rax + 8]
call fcn.14002bcb4
cmp qword [rbx + 0x18], 8
jb 0x140092aa1
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140068e50
mov edi, 4
test dil, 4
je 0x140092ac1
lea rcx, [rsp + 0x38]
call fcn.140068220
mov al, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
Function at 0x1400953dc
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor esi, esi
lea r8, str.SOFTWAREPoliciesGoogleUpdate
mov rdx, 0xffffffff80000002
mov qword [rbp - 0x48], rsi
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x40], esi
mov edi, esi
mov qword [rbp - 0x38], rsi
lea r14d, [rsi + 1]
mov ebx, esi
lea r9d, [rsi + 3]
mov dword [rbp - 0x4c], r14d
call fcn.14005d790
test eax, eax
jne 0x140095592
lea r8d, [rsi + 6]
mov dword [rbp - 0x50], esi
lea rdx, str.Update
mov qword [rbp - 0x18], 7
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
call fcn.140029c40
mov rax, qword [0x14017c010]
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x28]
cmp word [rdx], si
jne 0x140095485
mov r8d, esi
jmp 0x140095493
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x140095489
lea rcx, [rbp - 0x30]
call fcn.140029e90
cmp qword [rbp - 0x18], 8
lea rdx, [rbp - 0x30]
lea r8, [rbp - 0x50]
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.14005da50
test eax, eax
jne 0x1400954f4
mov ecx, dword [rbp - 0x50]
lea rdx, [rbp - 0x4c]
call fcn.1400942d4
test al, al
je 0x1400954d1
cmp dword [rbp - 0x4c], r14d
je 0x14009553d
cmp qword [rbp - 0x18], 8
lea rdx, [rbp - 0x30]
mov r8d, r14d
lea rcx, [rbp - 0x48]
cmovae rdx, qword [rbp - 0x30]
mov edi, r14d
call fcn.14005dcc0
test eax, eax
cmove ebx, r14d
lea r8, [rbp - 0x50]
lea rdx, str.UpdateDefault
lea rcx, [rbp - 0x48]
call fcn.14005da50
test eax, eax
jne 0x14009553d
mov ecx, dword [rbp - 0x50]
lea rdx, [rbp - 0x4c]
call fcn.1400942d4
test al, al
je 0x140095522
cmp dword [rbp - 0x4c], r14d
je 0x14009553d
mov rcx, qword [rbp - 0x48]
lea rdx, str.UpdateDefault
add edi, r14d
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14009553d
add ebx, r14d
lea r8, [rbp - 0x50]
lea rdx, str.AutoUpdateCheckPeriodMinutes
lea rcx, [rbp - 0x48]
call fcn.14005da50
test eax, eax
jne 0x14009557c
mov eax, dword [rbp - 0x50]
dec eax
cmp eax, 0xec3f
jbe 0x14009557c
mov rcx, qword [rbp - 0x48]
lea rdx, str.AutoUpdateCheckPeriodMinutes
add edi, r14d
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14009557c
add ebx, r14d
xor r8d, r8d
lea rcx, [rbp - 0x30]
mov dl, r14b
call fcn.140029bc0
cmp edi, ebx
sete bl
jmp 0x140095599
call fcn.140095314
mov bl, al
lea rcx, [rbp - 0x48]
call fcn.14005d610
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14009cb60
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
call fcn.140070410
mov rcx, rbx
cmp dword [rax], 5
jl 0x14009cb89
call fcn.14009abc4
jmp 0x14009cb8e
call fcn.14009ade8
mov edi, eax
cmp eax, 1
je 0x14009cc74
lea eax, [rax - 2]
cmp eax, 1
ja 0x14009ccb2
mov ecx, 0x58
call fcn.140111b94
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohl
lea rcx, str.LastWasDefault
mov qword [rbp - 0x20], rcx
lea rdx, [rbp - 0x20]
movaps xmm0, xmmword [rbp - 0x20]
xor r9d, r9d
mov rcx, rax
movdqa xmmword [rbp - 0x20], xmm0
lea r8d, [r9 + 1]
call fcn.1400a8bd4
mov rcx, rax
mov rbx, rax
call fcn.1400a8da0
test rbx, rbx
je 0x14009cc12
lea rcx, [rbx + 0x38]
xor r8d, r8d
mov dl, 1
call fcn.140029bc0
lea rcx, [rbx + 0x18]
xor r8d, r8d
mov dl, 1
call fcn.140029bc0
mov rcx, rbx
call fcn.140111e78
lea rcx, [rbp + 0x18]
call fcn.1400a8b80
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov rbx, qword [rax]
lea r8, [rbx + 0x18]
cmp qword [r8 + 0x18], 8
jb 0x14009cc3a
mov r8, qword [r8]
mov rdx, qword [rbx + 8]
lea rcx, [rbp - 0x20]
mov r9d, 0x202
call fcn.14005d790
test eax, eax
jne 0x14009cc69
lea rdx, [rbx + 0x38]
cmp qword [rdx + 0x18], 8
jb 0x14009cc5f
mov rdx, qword [rdx]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rcx, [rbp - 0x20]
call fcn.14005d610
jmp 0x14009cc85
lea rcx, [rbp + 0x18]
call fcn.1400a8b80
mov rcx, qword [rax]
call fcn.1400a8da0
mov rbx, qword [rbp + 0x18]
test rbx, rbx
je 0x14009ccb2
xor r8d, r8d
lea rcx, [rbx + 0x38]
mov dl, 1
call fcn.140029bc0
xor r8d, r8d
lea rcx, [rbx + 0x18]
mov dl, 1
call fcn.140029bc0
mov rcx, rbx
call fcn.140111e78
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x14009d964
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x240
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x100
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebp, ebp
test eax, eax
je 0x14009da54
cmp dword [rsp + 0x20], 1
jb 0x14009da54
mov edx, dword [rsp + 0x20]
mov rdi, qword [rbx + 0x10]
cmp rdi, rdx
ja 0x14009d9f1
cmp qword [rbx + 0x18], rdx
je 0x14009d9f1
mov r8b, 1
mov rcx, rbx
call fcn.14002b1d4
test al, al
je 0x14009d9f1
cmp qword [rbx + 0x18], 8
mov qword [rbx + 0x10], rdi
jb 0x14009d9ea
mov rax, qword [rbx]
jmp 0x14009d9ed
mov rax, rbx
mov word [rax + rdi*2], bp
cmp qword [rbx + 0x18], 1
jae 0x14009da09
mov r8, qword [rbx + 0x10]
mov edx, 1
mov rcx, rbx
call fcn.14002b780
cmp qword [rbx + 0x18], 8
jb 0x14009da15
mov rax, qword [rbx]
jmp 0x14009da18
mov rax, rbx
mov ecx, 0x2e
mov word [rax], cx
cmp qword [rbx + 0x18], 8
mov qword [rbx + 0x10], 1
jb 0x14009da34
mov rax, qword [rbx]
jmp 0x14009da37
mov rax, rbx
mov word [rax + 2], bp
lea rdx, [rsp + 0x30]
mov r8d, dword [rsp + 0x20]
mov rcx, rbx
dec r8d
call fcn.140029e90
mov al, 1
jmp 0x14009da56
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret