joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bc460
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x1401bd430
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1401bd4a1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1401bd4ab
mov dil, 1
test bl, bl
je 0x1401bd48a
cmp byte [rsi + 8], 0
je 0x1401bd4a6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140151210
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x1401bd45d
mov rcx, qword [rsi]
jmp 0x1401bd47f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x1401bd4d3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1401bd4d8
xor edi, edi
jmp 0x1401bd48a
mov rcx, qword [rsi]
jmp 0x1401bd4c0
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x1401bd4ff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x1401bd48a
mov rcx, qword [rsi]
jmp 0x1401bd4ef
Function at 0x1401bd660
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
movaps xmmword [rsp + 0x130], xmm6
mov ebx, r9d
mov edi, r8d
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x40], 0xa
mov rax, qword [str.0p7_]
mov al, byte [rax + 0xa]
test al, al
jne 0x1401bd90d
movabs r13, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x120], r13
movaps xmm6, xmmword [0x1402dffe0]
movaps xmmword [rsp + 0x110], xmm6
lea r15, [rsp + 0x80]
mov rcx, r14
mov rdx, r15
call fcn.140074850
cmp byte [r15 + 0x17], 0
js 0x1401bd791
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x120], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x110], xmm0
lea r12, [rsp + 0x80]
mov rcx, r12
call fcn.140106f00
lea r15, [rsp + 0xf0]
mov qword [r15 + 0x10], r13
movaps xmmword [r15], xmm6
mov rcx, r14
mov rdx, r15
call fcn.1401c5e20
xorps xmm0, xmm0
movups xmmword [r12 + 0x60], xmm0
movups xmmword [r12 + 0x50], xmm0
movups xmmword [r12 + 0x40], xmm0
movups xmmword [r12 + 0x30], xmm0
movabs rax, 0x4000000070
mov qword [r12], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [r12 + 8], rax
lea rax, str.runas
mov qword [r12 + 0x10], rax
cmp byte [rsp + 0x127], 0
js 0x1401bd7b3
lea rax, [rsp + 0x110]
jmp 0x1401bd7bb
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.1400f4ba0
jmp 0x1401bd712
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x98], rax
cmp byte [rsp + 0x107], 0
jns 0x1401bd7d5
mov r15, qword [rsp + 0xf0]
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x20], r15
xor r14d, r14d
mov qword [rcx + 0x28], r14
xor dil, 1
movzx eax, dil
mov dword [rcx + 0x30], eax
mov qword [rcx + 0x38], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1401bd86b
test bl, bl
je 0x1401bd863
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.LaunchElevatedProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x9e
call fcn.1401063f0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400fcbc0
mov rcx, qword [rsp + 0xe8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call fcn.1400fcc40
mov r14, qword [rsp + 0xe8]
mov rcx, rsi
mov rdx, r14
call fcn.14005d430
cmp byte [rsp + 0x107], 0
jns 0x1401bd88d
mov rcx, qword [rsp + 0xf0]
call fcn.14014fcd8
cmp byte [rsp + 0x127], 0
jns 0x1401bd8a4
mov rcx, qword [rsp + 0x110]
call fcn.14014fcd8
mov qword [rsp + 0x40], 0xa
mov rax, qword [str.0p7_]
mov al, byte [rax + 0xa]
test al, al
jne 0x1401bd8e9
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.140151210
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x130]
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, al
lea r8, [rsp + 0x80]
mov qword [r8], 0
lea rdx, [rsp + 0x40]
mov r9d, 2
call fcn.1400f11f0
jmp 0x1401bd8bb
movzx ecx, al
lea rax, str.LaunchElevatedProcess
lea r8, [rsp + 0x80]
mov qword [r8], rax
lea rdx, [rsp + 0x40]
mov r9d, 1
call fcn.1400f0850
jmp 0x1401bd6b3
Function at 0x1401be910
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1402dffe0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x1cd
call fcn.1401063f0
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1400fcbc0
mov al, byte [rsi + 0x17]
test al, al
jns 0x1401be98e
cmp qword [rsi + 8], 0x103
ja 0x1401be9ac
test al, al
jns 0x1401be995
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.1400fcc40
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140151210
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401bee60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edx, 1
mov r8d, 0x80000000
jmp fcn.140060c20
Function at 0x1401bf1c0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm6, xmmword [0x1402dffe0]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x88
call fcn.1401063f0
xor ebp, ebp
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400fcbc0
mov rcx, rdi
call fcn.1401085f0
test al, al
jne 0x1401bf26c
mov rcx, rsi
call fcn.1401085f0
test al, al
jne 0x1401bf26a
cmp byte [rdi + 0x17], 0
jns 0x1401bf2ae
cmp qword [rdi + 8], 0x103
jbe 0x1401bf2ae
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.1400fcc40
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140151210
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebp, ebp
lea rcx, [rsp + 0x20]
call fcn.140090760
jmp 0x1401bf26c
cmp byte [rsi + 0x17], 0
jns 0x1401bf2be
cmp qword [rsi + 8], 0x103
ja 0x1401bf26a
lea r14, [rsp + 0x20]
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x95
call fcn.1401063f0
lea r8, [0x140377298]
mov rcx, r14
mov rdx, r15
call fcn.140090630
cmp byte [rsi + 0x17], 0
jns 0x1401bf303
mov rsi, qword [rsi]
movzx r8d, bl
cmp byte [rdi + 0x17], 0
jns 0x1401bf310
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1401bf2a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bpl
je 0x1401bf2a2
mov ecx, eax
and ecx, 1
je 0x1401bf2a2
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bpl, 1
jmp 0x1401bf2a2
Function at 0x1401bf880
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov qword [rsp + 0x48], r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx ebp, word [rcx + 0x28]
movzx esi, word [rcx + 0x2a]
mov r15, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r15
mov r14d, eax
movzx r13d, word [rdi + 0x2a]
movzx r12d, word [rdi + 0x28]
call r15
mov word [rsp + 0x46], ax
lea r15, [rsp + 0x60]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.140189d00
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.1400639b0
lea r8, [rsp + 0x58]
mov qword [r8], 0
lea r9, [rsp + 0x54]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401bf985
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1401bf985
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x1401bf985
dec r8d
mov rcx, qword [rsp + 0x48]
call fcn.1400fa5d0
mov sil, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140151210
mov eax, esi
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x60]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.140189d00
movzx eax, r14w
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.1400639b0
lea r8, [rsp + 0x58]
mov qword [r8], 0
lea r9, [rsp + 0x54]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401bfa06
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1401bfa06
mov r8d, dword [rsp + 0x54]
test r8d, r8d
jne 0x1401bf94f
lea r14, [rsp + 0x60]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140189d00
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.1400639b0
lea r8, [rsp + 0x58]
mov qword [r8], 0
lea r9, [rsp + 0x54]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401bfa87
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1401bfa87
mov r8d, dword [rsp + 0x54]
test r8d, r8d
jne 0x1401bf94f
lea r14, [rsp + 0x60]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140189d00
movzx eax, word [rsp + 0x46]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.1400639b0
lea r8, [rsp + 0x58]
mov qword [r8], 0
lea r9, [rsp + 0x54]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401bfb0c
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1401bfb0c
mov r8d, dword [rsp + 0x54]
test r8d, r8d
jne 0x1401bf94f
xor esi, esi
jmp 0x1401bf95f
Function at 0x1401bfdf0
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1402dffe0]
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.MoveUnsafe
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x4d3
call fcn.1401063f0
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400fcbc0
mov al, byte [rdi + 0x17]
test al, al
jns 0x1401bf3e8
cmp qword [rdi + 8], 0x103
ja 0x1401bf3fb
mov cl, byte [rsi + 0x17]
test cl, cl
jns 0x1401bf427
cmp qword [rsi + 8], 0x103
jbe 0x1401bf427
xor ebx, ebx
lea rcx, [rsp + 0x40]
call fcn.1400fcc40
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140151210
mov eax, ebx
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdx, rsi
test cl, cl
jns 0x1401bf431
mov rdx, qword [rsi]
mov rcx, rdi
test al, al
jns 0x1401bf43b
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x1401bf3fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
call fcn.140060d70
test al, al
jne 0x1401bf46b
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1401bf3f9
mov rcx, rdi
mov rdx, rsi
call fcn.1401bf480
test al, al
jne 0x1401bf3fb
jmp 0x1401bf461
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1401085f0
test al, al
jne 0x1401bfe11
mov rcx, rsi
call fcn.1401085f0
test al, al
je 0x1401bfe1a
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1401bf360
Function at 0x1401c0fa0
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x860
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x858], rax
cmp byte [0x1403659a8], 0
je 0x1401c11b7
mov rdx, qword [0x1403772c0]
test rdx, rdx
je 0x1401c11b7
cmp byte [rdx + 0x17], 0
jns 0x1401c0fec
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
je 0x1401c11e2
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140106410
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1402dffe0]
movaps xmmword [r14], xmm0
lea rbx, [rsp + 0x80]
mov rdx, rbx
call fcn.1400e6bf0
lea r15, [rsp + 0x48]
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1400e65b0
mov eax, dword [rsi + 8]
test eax, eax
je 0x1401c10d2
cmp eax, 1
je 0x1401c10d8
mov bp, 1
add eax, 0xfffffffe
cmp eax, 2
jae 0x1401c10dc
lea r12, [rsp + 0x80]
mov r8d, 0x7d8
mov rcx, r12
mov dl, 0xaa
call fcn.140189d00
mov rcx, r12
call fcn.1400a4020
mov rcx, r12
mov rdx, r15
call fcn.14023dbf0
movsx r8, byte [rsp + 0x5f]
test r8, r8
jns 0x1401c10b2
mov r8, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.1400f3dd0
cmp byte [rsp + 0x5f], 0
jns 0x1401c10dc
mov rcx, qword [rsp + 0x48]
call fcn.14014fcd8
jmp 0x1401c10dc
mov bp, 4
jmp 0x1401c10dc
mov bp, 2
cmp byte [rsp + 0x77], 0
jns 0x1401c10e8
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x48], 0
mov rcx, qword [0x1403772d0]
cmp byte [rcx + 0x17], 0
jns 0x1401c1109
mov rcx, qword [rcx]
lea rdx, [rsp + 0x48]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x1401c112d
lea rcx, [rsi + 0x10]
lea rdx, str.___ERROR_GETTING_USER_SID__
mov r8d, 0x1b
call fcn.1400e59c0
mov rax, qword [rsp + 0x48]
mov r9d, dword [0x1403772cc]
movzx r8d, word [0x1403772c8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x1401c1188
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1400e59c0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401c1198
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [rsp + 0x77], 0
jns 0x1401c11a9
mov rcx, qword [rsp + 0x60]
call fcn.14014fcd8
call fcn.140106410
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.14006fb80
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.140151210
nop
add rsp, 0x860
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1400e59c0
jmp 0x1401c11b7
Function at 0x1401c35d0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1403773f0], 0
je 0x1401c3616
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140151210
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1403773f8]
test rdi, rdi
je 0x1401c36b7
test byte [0x1403659ac], 1
je 0x1401c35f9
cmp byte [rdi + 0x17], 0
jns 0x1401c3638
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403773f0], rax
inc rax
cmp rax, 1
ja 0x1401c35f9
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140189d00
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401c377b
xor esi, esi
jmp 0x1401c35f9
mov ecx, 0x18
call fcn.14014fc9c
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140189d00
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1402dffe0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.14002c370
movsx rax, byte [rdi + 0x17]
mov rcx, rdi
test rax, rax
jns 0x1401c3721
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
jne 0x1401c3747
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.1400f4d70
mov qword [0x1403773f8], rdi
jmp 0x1401c3626
add rax, rax
test rax, rax
je 0x1401c3726
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x1401c374a
cmp rdx, 0xfffffffffffffffe
je 0x1401c3726
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.1400f1e80
jmp 0x1401c3726
mov rcx, qword [0x1403773f8]
lea rdx, [rsp + 0x40]
call fcn.140044250
mov rcx, qword [0x1403773f8]
call fcn.1401b9340
cmp word [rax], 0x5c
je 0x1401c37b7
mov rcx, qword [0x1403773f8]
lea rdx, [0x1402eb154]
mov r8d, 1
call fcn.1400f4d70
mov rcx, qword [0x1403773f8]
lea rdx, str.debug.log
mov r8d, 9
call fcn.1400f4d70
mov rcx, qword [0x1403773f8]
cmp byte [rcx + 0x17], 0
jns 0x1401c37e0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403773f0], rax
inc rax
cmp rax, 1
ja 0x1401c35f9
mov qword [0x1403773f0], 0
jmp 0x1401c36b0
Function at 0x1401cbf60
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rdi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0xc8], rax
call fcn.140077a20
test al, al
jne 0x1401cbfa7
xor esi, esi
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140151210
mov eax, esi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x90]
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.1401cc6e0
mov ebx, eax
cmp byte [rsi + 0x17], 0
jns 0x1401cbfe0
mov rcx, qword [rsp + 0x90]
call fcn.14014fcd8
test bl, bl
je 0x1401cbf88
call fcn.14007e6d0
mov ebx, eax
call fcn.14008edb0
cmp ebx, 2
je 0x1401cc01d
cmp eax, 0x16
jge 0x1401cc032
lea rax, str.http
lea rcx, [rsp + 0x38]
mov qword [rcx], rax
mov qword [rcx + 8], 4
call fcn.1402489a0
mov esi, eax
jmp 0x1401cbf8a
mov ecx, 1
mov rdx, rdi
call fcn.1401cb8d0
mov sil, 1
jmp 0x1401cbf8a
call fcn.14007fa80
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rcx
movaps xmm0, xmmword [0x1402dffe0]
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [0x140301518]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], 0x18
lea rcx, str.registeredAppUser
lea rdx, str.registeredAppMachine
test al, al
cmovne rdx, rcx
mov qword [rsp + 0xa0], rdx
xor al, 1
movzx eax, al
lea rax, [rax + rax*2]
add rax, 0x12
mov qword [rsp + 0xa8], rax
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov rdx, rdi
call fcn.1401cb7a0
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x1401cc0c2
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rax
test rax, rax
js 0x1401cc16f
je 0x1401cc0e6
test rbx, rbx
je 0x1401cc182
lea rdx, [rsp + 0x80]
mov qword [rdx], rsi
mov qword [rdx + 8], 3
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.14005d120
cmp byte [rsp + 0x5f], 0
jns 0x1401cc117
mov rcx, qword [rsp + 0x48]
call fcn.14014fcd8
cmp byte [rsp + 0x77], 0
jns 0x1401cc123
mov rsi, qword [rsp + 0x60]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
cmp byte [rsp + 0x77], 0
jns 0x1401cc15d
mov rcx, qword [rsp + 0x60]
call fcn.14014fcd8
mov sil, 1
cmp rdi, 0x20
jg 0x1401cbf8a
jmp 0x1401cbffa
lea rcx, [0x1402ea01c]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.14018e880
lea rcx, [0x1402ea01c]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.14018e880
int3
Function at 0x1401d5d90
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x1d0
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
lea r9, [rsp + 0x17c]
mov dword [r9], 0x44
xorps xmm0, xmm0
lea r8, [rsp + 0x180]
movaps xmmword [r8 + 0x30], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov dword [r8 + 0x40], 0
mov ecx, ntohl
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1401d5e1b
lea r8, [rsp + 0x34]
mov dword [r8], 0
lea rdx, [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1401d5e8e
cmp dword [rsp + 0x34], 0
setne sil
jmp 0x1401d5e73
mov ecx, 2
call fcn.140106140
test al, al
je 0x1401d5e71
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x159
mov r9d, 2
call fcn.1401c3e40
lea rcx, [rsp + 0x48]
lea rdx, str.Failed_to_create_well_known_SID
mov r8d, 0x1f
call fcn.1400e59c0
mov rcx, rsi
call fcn.1401c3ec0
xor esi, esi
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.140151210
mov eax, esi
add rsp, 0x1d0
pop rsi
ret
mov ecx, 2
call fcn.140106140
test al, al
je 0x1401d5e71
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x15f
mov r9d, 2
call fcn.1401c3e40
lea rcx, [rsp + 0x48]
lea rdx, str.Failed_to_check_token_membership_for_WinInteractiveSid
mov r8d, 0x36
jmp 0x1401d5e64