joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009f054
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov qword [rbp - 0x30], 7
lea rdx, [rbp - 0x48]
mov dword [rbp - 0x50], ebx
mov ecx, 0x3ea
mov qword [rbp - 0x38], rbx
mov edi, ebx
mov word [rbp - 0x48], bx
call fcn.140064a20
test al, al
je 0x14009f0ea
mov qword [rbp - 0x58], 9
lea rax, str.First_Run
mov qword [rbp - 0x60], rax
lea r8, [rbp - 0x60]
movaps xmm0, xmmword [rbp - 0x60]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x48]
movdqa xmmword [rbp - 0x60], xmm0
call fcn.14005add0
cmp qword [rax + 0x18], 8
jb 0x14009f0d7
mov rax, qword [rax]
mov rcx, rax
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009f0ec
mov bl, 1
test dil, 1
je 0x14009f0fb
lea rcx, [rbp - 0x28]
call fcn.1400599c0
lea rcx, [rbp - 0x48]
call fcn.1400599c0
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14009f2b8
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
xor ebx, ebx
mov rdi, r9
mov dword [rsp + 0x160], ebx
mov ebp, ebx
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], rbx
jb 0x14009f2f5
mov rdx, qword [rdx]
mov r8, rdx
mov r9d, 2
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14005d790
mov esi, eax
test eax, eax
jne 0x14009f335
cmp qword [rdi + 0x18], 8
jb 0x14009f31d
mov rdx, qword [rdi]
jmp 0x14009f320
mov rdx, rdi
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test eax, eax
je 0x14009f3b5
cmp esi, 2
je 0x14009f3b5
cmp dword [0x14017c080], 2
jg 0x14009f3a3
mov r9d, 2
lea rdx, str..._.._chrome_installer_util_install_util.cc
mov r8d, 0x147
lea rcx, [rsp + 0x38]
call fcn.1400681c0
lea rdx, str.Failed_to_delete_registry_value:
lea rcx, [rax + 8]
call fcn.14002bcb4
cmp qword [rdi + 0x18], 8
jb 0x14009f37a
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.140068e50
lea rdx, str._error:
mov rcx, rax
call fcn.14002bcb4
mov rcx, rax
mov edx, esi
call fcn.140028ef4
mov ebp, 1
test bpl, 1
je 0x14009f3b7
lea rcx, [rsp + 0x38]
call fcn.140068220
jmp 0x14009f3b7
mov bl, 1
lea rcx, [rsp + 0x20]
call fcn.14005d610
lea r11, [rsp + 0x140]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14009f4c0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov rdi, qword [rbp + 0xa0]
xor ebx, ebx
mov r8, rdx
mov dword [rsp + 0x38], ebx
mov rdx, rcx
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], ebx
lea r9d, [rbx + 3]
mov qword [rsp + 0x30], rbx
mov qword [rbp + 0x60], 7
mov qword [rbp + 0x58], rbx
mov word [rbp + 0x48], bx
call fcn.14005d790
test eax, eax
jne 0x14009f5e1
lea r8, [rbp + 0x48]
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14005db50
test eax, eax
jne 0x14009f5e1
mov rax, qword [rdi]
lea rdx, [rbp + 0x48]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test al, al
je 0x14009f5e1
mov rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test eax, eax
je 0x14009f5dc
lea r9d, [rbx + 2]
cmp dword [0x14017c080], r9d
jg 0x14009f5cd
mov r8d, 0x17a
lea rdx, str..._.._chrome_installer_util_install_util.cc
lea rcx, [rsp + 0x40]
call fcn.1400681c0
lea rdx, str.Failed_to_delete_registry_value:
lea rcx, [rax + 8]
call fcn.14002bcb4
mov rcx, rax
lea rdx, str._Default_
call fcn.140068e50
mov rcx, rax
lea rdx, str._error:
call fcn.14002bcb4
mov rcx, rax
mov edx, edi
call fcn.140028ef4
mov ebx, 1
test bl, 1
je 0x14009f5dc
lea rcx, [rsp + 0x40]
call fcn.140068220
mov ebx, 1
xor r8d, r8d
lea rcx, [rbp + 0x48]
mov dl, 1
call fcn.140029bc0
lea rcx, [rsp + 0x20]
call fcn.14005d610
mov eax, ebx
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400a0938
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor r15d, r15d
mov qword [rbp + 0x48], 0xf
and qword [rbp + 0x40], r15
mov rsi, rdx
cmp qword [rdx + 0x18], 8
mov r13, rcx
mov dword [rsp + 0x20], r15d
mov byte [rbp + 0x30], r15b
jb 0x1400a098c
mov rcx, qword [rdx]
jmp 0x1400a098f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a0aca
and qword [rbp + 0x40], r15
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
mov rcx, rsi
cmovae rax, qword [rbp + 0x30]
mov byte [rax], r15b
call fcn.14005b400
test al, al
jne 0x1400a0a69
mov rcx, rsi
call fcn.140050010
mov r14, rax
test rax, rax
je 0x1400a0a69
mov r12d, 0x10000
mov ecx, r12d
call fcn.140111e80
mov rbx, rax
xor edi, edi
mov r8d, r12d
mov rcx, rax
jmp 0x1400a0a21
not rdi
lea rcx, [rbp + 0x30]
cmp rdi, r12
mov r8, r12
mov rdx, rbx
cmovb r8, rdi
call fcn.14002a3b8
cmp rdi, r12
jb 0x1400a0a4c
mov rdi, qword [rsp + 0x20]
mov r8d, 0x10000
add rdi, r12
mov rcx, rbx
mov r9, r14
mov qword [rsp + 0x20], rdi
mov edx, 1
call fcn.14011d990
mov r12, rax
test rax, rax
jne 0x1400a09f2
mov rcx, r14
call fcn.14011c930
test eax, eax
jne 0x1400a0a4c
mov dil, 1
jmp 0x1400a0a4f
xor dil, dil
mov rcx, r14
call fcn.14011cd3c
test rbx, rbx
je 0x1400a0a64
mov rcx, rbx
call fcn.140111880
test dil, dil
jne 0x1400a0aca
mov r9d, 2
cmp dword [0x14017c080], r9d
jg 0x1400a0aba
mov r8d, 0xba
lea rdx, str..._.._chrome_installer_util_master_preferences.cc
lea rcx, [rsp + 0x28]
call fcn.1400681c0
lea rdx, str.Failed_to_read_preferences_from
lea rcx, [rax + 8]
call fcn.14002bcb4
cmp qword [rsi + 0x18], 8
jb 0x1400a0aa9
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rax
call fcn.140068e50
mov r15d, 1
test r15b, 1
je 0x1400a0aca
lea rcx, [rsp + 0x28]
call fcn.140068220
lea rdx, [rbp + 0x30]
mov rcx, r13
call fcn.1400a0b24
test al, al
je 0x1400a0adf
mov byte [r13 + 0x10], 1
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x1400a0afb
mov rcx, qword [rbp + 0x30]
inc rdx
mov r8d, 1
call fcn.1400223b0
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a40f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor edi, edi
mov rbx, rdx
cmp qword [rcx + 0x18], 8
mov rsi, rcx
mov dword [rsp + 0x20], edi
jb 0x1400a412c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a414d
cmp qword [rbx + 0x18], 8
mov qword [rbx + 0x10], rdi
jb 0x1400a4145
mov rbx, qword [rbx]
mov word [rbx], di
jmp 0x1400a4235
mov rdx, rsi
lea rcx, [rbp + 0x30]
call fcn.140059910
lea rax, [rbp + 0x30]
cmp rbx, rax
je 0x1400a4175
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x30]
xor r8d, r8d
mov rcx, rbx
call fcn.140029d5c
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.14005a6a0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140059a60
lea rcx, [rbp + 0x50]
call fcn.1400599c0
mov rdx, rbx
lea rcx, [rbp + 0x30]
call fcn.140059b90
test al, al
je 0x1400a41c0
cmp qword [rbp + 0x48], 8
lea rcx, [rbp + 0x30]
cmovae rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a4159
mov ebx, 1
mov ecx, ebx
call fcn.140067fc0
test al, al
je 0x1400a421d
lea rcx, [rbp + 0x30]
call fcn.14004ed50
test al, al
jne 0x1400a421d
mov r9d, ebx
lea r8d, [rbx + 0x20]
lea rdx, str..._.._chrome_installer_util_self_cleaning_temp_dir.cc
lea rcx, [rsp + 0x28]
call fcn.1400681c0
lea rdx, str.A_non_directory_is_at_the_base_of_the_path_leading_to_a_desired_temp_directory_location:
lea rcx, [rax + 8]
call fcn.14002bcb4
cmp qword [rbp + 0x48], 8
lea rdx, [rbp + 0x30]
mov rcx, rax
cmovae rdx, qword [rbp + 0x30]
call fcn.140068e50
mov edi, ebx
test bl, dil
je 0x1400a422c
lea rcx, [rsp + 0x28]
call fcn.140068220
lea rcx, [rbp + 0x30]
call fcn.1400599c0
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a46f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor esi, esi
lea rdx, [rbp - 0x49]
and qword [rbp - 0x49], rsi
xorps xmm0, xmm0
and qword [rbp - 0x29], rsi
mov rdi, rcx
mov word [rbp - 0x41], si
movdqu xmmword [rbp - 0x39], xmm0
call fcn.14004fec0
test al, al
je 0x1400a48e1
mov rbx, qword [rbp - 0x49]
cmp rbx, 0x100000
jle 0x1400a48e1
mov r8d, 0xa021
lea rcx, [rbp - 1]
mov rdx, rdi
call fcn.14006fc70
mov rax, qword [rbp - 1]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400a48c0
lea r8, str..tmp
mov rdx, rdi
lea rcx, [rbp - 0x49]
mov esi, 2
call fcn.1400313e4
cmp qword [rax + 0x18], 8
jb 0x1400a479a
mov rcx, qword [rax]
jmp 0x1400a479d
mov rcx, rax
mov rax, qword [rax + 0x10]
lea rdx, [rbp - 0x69]
mov qword [rbp - 0x69], rcx
lea rcx, [rbp - 0x21]
mov qword [rbp - 0x61], rax
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
call fcn.140059940
xor r8d, r8d
lea rcx, [rbp - 0x49]
mov dl, 1
call fcn.140029bc0
lea rdx, [rbp - 0x21]
mov rcx, rdi
call fcn.14004bdb0
test al, al
je 0x1400a48b5
and qword [rbp - 0x59], 0
lea rcx, [rbp - 0x69]
mov r14d, 0x80000
mov qword [rbp - 0x51], 0xf
mov edx, r14d
mov byte [rbp - 0x69], 0
xor r8d, r8d
call fcn.14002b8bc
cmp qword [rbp - 0x51], 0x10
lea rcx, [rbp - 0x69]
mov r8d, r14d
cmovae rcx, qword [rbp - 0x69]
xor edx, edx
call fcn.140113400
cmp qword [rbp - 0x51], 0x10
lea rax, [rbp - 0x69]
mov qword [rbp - 0x59], r14
lea r8, [rbp - 0x69]
cmovae rax, qword [rbp - 0x69]
lea rdx, [rbx - 0x80000]
mov r9d, r14d
lea rcx, [rbp - 1]
mov byte [rax + 0x80000], 0
cmp qword [rbp - 0x51], 0x10
cmovae r8, qword [rbp - 0x69]
call fcn.140078860
mov ebx, eax
test eax, eax
jle 0x1400a4899
cmp qword [rbp - 0x51], 0x10
lea rdx, [rbp - 0x69]
mov r8d, eax
mov rcx, rdi
cmovae rdx, qword [rbp - 0x69]
call fcn.140050140
cmp ebx, eax
je 0x1400a4894
cmp qword [rdi + 0x18], 8
jb 0x1400a4886
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a4899
mov esi, 1
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x1400a48b5
mov rcx, qword [rbp - 0x69]
inc rdx
mov r8d, 1
call fcn.1400223b0
lea rcx, [rbp - 0x21]
call fcn.1400599c0
jmp 0x1400a48d8
xor edx, edx
mov rcx, rdi
call fcn.14004e490
mov ecx, esi
test al, al
mov esi, 2
cmovne ecx, esi
mov esi, ecx
lea rcx, [rbp - 1]
call fcn.14006fd80
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400a4ecc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, edx
mov rdi, rcx
cmp edx, 0x675
je 0x1400a4f31
cmp edx, 0x749
je 0x1400a4f28
cmp edx, 0x81d
je 0x1400a4f1f
cmp edx, 0xb38
jne 0x1400a4f4f
lea r8, [0x140154bc8]
jmp 0x1400a4f38
lea r8, [0x140154ba8]
jmp 0x1400a4f38
lea r8, [0x140154b98]
jmp 0x1400a4f38
lea r8, [0x140154bb8]
mov rax, qword [0x14017c010]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
movsxd rcx, dword [rdx + 8]
mov ebx, dword [r8 + rcx*4]
mov rcx, qword [0x14017c288]
xor r12d, r12d
test rcx, rcx
je 0x1400a4f70
mov r9, qword [rcx]
mov r8d, ebx
mov rdx, rdi
call qword [r9 + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400a5081
mov r13d, 7
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r13
mov word [rbp - 0x50], r12w
call fcn.1400a4e6c
mov r14, qword [0x140177888]
lea r8d, [r13 - 1]
mov rcx, r14
mov esi, dword [rax + 0x20]
add esi, ebx
mov eax, esi
shr eax, 4
inc ax
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x1400a505b
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a505b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400a505b
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and esi, 0xf
jbe 0x1400a5009
cmp rbx, rcx
jae 0x1400a505b
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add esi, 0xffffffff
jne 0x1400a4ff4
cmp rbx, rcx
jae 0x1400a505b
cmp word [rbx], r12w
je 0x1400a505b
movzx r8d, word [rbx]
lea rdx, [rbx + 2]
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
call fcn.140029c40
xor r8d, r8d
lea rcx, [rbp - 0x50]
mov dl, 1
call fcn.140029bc0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140029ff0
xor r8d, r8d
lea rcx, [rbp - 0x30]
mov dl, 1
call fcn.140029bc0
mov qword [rdi + 0x18], r13
lea rdx, [rbp - 0x50]
mov qword [rdi + 0x10], r12
mov rcx, rdi
mov word [rdi], r12w
call fcn.140029ff0
xor r8d, r8d
lea rcx, [rbp - 0x50]
mov dl, 1
call fcn.140029bc0
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a5fc4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x140175d28]
xor r15d, r15d
mov r14b, dl
mov rsi, rcx
cmp eax, 0xffffffff
jne 0x1400a6176
mov rbx, qword [0x14017c038]
lea rdi, str.toast_results_key
mov rdx, rdi
mov rcx, rbx
call fcn.140060790
test al, al
je 0x1400a616d
lea r8, [rbp - 0x50]
mov qword [rbp - 0x50], rdi
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x48], 0x11
mov rcx, rbx
call fcn.140060b30
cmp qword [rax + 0x18], 8
jb 0x1400a6051
mov rbx, qword [rax]
jmp 0x1400a6054
mov rbx, rax
mov rax, qword [rax + 0x10]
lea rdi, [rbx + rax*2]
cmp rbx, rdi
je 0x1400a60fa
movzx ecx, word [rbx]
call fcn.14011eaf8
test eax, eax
je 0x1400a607a
add rbx, 2
cmp rbx, rdi
jne 0x1400a6065
cmp rbx, rdi
je 0x1400a60fa
cmp word [rbx], 0x2d
jne 0x1400a60f0
add rbx, 2
mov ecx, r15d
mov dword [0x140175d28], ecx
cmp rbx, rdi
je 0x1400a6157
mov r8, rbx
mov r9d, 0xf3333334
movzx edx, word [r8]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x1400a6157
sub dl, 0x30
cmp r8, rbx
je 0x1400a60ce
cmp ecx, r9d
jl 0x1400a60e4
jne 0x1400a60c9
cmp dl, 8
ja 0x1400a60e4
lea ecx, [rcx + rcx*4]
add ecx, ecx
movzx eax, dl
add r8, 2
sub ecx, eax
mov dword [0x140175d28], ecx
cmp r8, rdi
je 0x1400a6157
jmp 0x1400a60a4
mov dword [0x140175d28], 0x80000000
jmp 0x1400a6157
cmp word [rbx], 0x2b
jne 0x1400a60fa
add rbx, 2
mov ecx, r15d
mov dword [0x140175d28], ecx
cmp rbx, rdi
je 0x1400a6157
mov r8, rbx
mov r9d, 0xccccccc
movzx edx, word [r8]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x1400a6157
sub dl, 0x30
cmp r8, rbx
je 0x1400a6137
cmp ecx, r9d
jg 0x1400a614d
jne 0x1400a6132
cmp dl, 7
ja 0x1400a614d
lea ecx, [rcx + rcx*4]
add ecx, ecx
movzx eax, dl
add r8, 2
add ecx, eax
mov dword [0x140175d28], ecx
cmp r8, rdi
je 0x1400a6157
jmp 0x1400a6111
mov dword [0x140175d28], 0x7fffffff
xor r8d, r8d
lea rcx, [rbp - 0x30]
mov dl, 1
call fcn.140029bc0
mov eax, dword [0x140175d28]
jmp 0x1400a6176
mov eax, r15d
mov dword [0x140175d28], eax
test eax, eax
je 0x1400a6203
mov r8d, 6
mov qword [rbp - 0x38], 7
lea rdx, str.client
mov qword [rbp - 0x40], r15
lea rcx, [rbp - 0x50]
mov word [rbp - 0x50], r15w
call fcn.140029c40
mov eax, dword [rsi + 0x10]
movsxd rcx, dword [0x140175d28]
add eax, eax
cmp qword [rsi + 0x18], 8
jb 0x1400a61bb
mov rsi, qword [rsi]
cmp qword [rbp - 0x38], 8
lea rdx, [rbp - 0x50]
mov dword [rsp + 0x28], eax
mov r9d, 1
cmovae rdx, qword [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r8d, r8d
lea rcx, [rbp - 0x50]
mov dl, 1
call fcn.140029bc0
test r14b, r14b
je 0x1400a6214
movsxd rcx, dword [0x140175d28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a6214
call fcn.140093ed8
mov r8, rsi
mov rcx, qword [rax + 8]
call fcn.140094228
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400a7928
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r13d, r13d
mov rsi, rcx
mov r12, r8
mov dword [rsp + 0x30], r13d
mov rbx, rdx
lea ecx, [r13 + 0x58]
call fcn.140111b94
mov r15, rax
lea rdx, [rsp + 0x38]
lea rax, [0x140162cd0]
mov rcx, rbx
mov qword [r15], rax
lea rdi, [r15 + 8]
mov qword [rdi + 0x10], r13
lea eax, [r13 + 7]
mov qword [rdi + 0x18], rax
mov word [rdi], r13w
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x30], r13
mov word [rdi + 0x20], r13w
mov qword [rdi + 0x40], r13
mov qword [rdi + 0x48], r13
mov rax, qword [rbx]
call qword [rax + 0x10]
lea r14, [rdi + 0x48]
mov rbp, rax
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a79c1
mov qword [r14], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rbx, [rdi + 0x40]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400a79d6
mov qword [rbx], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r9, [0x140156598]
lea rcx, [0x14013be40]
lea r8d, [rdx + 0x17]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rbx]
test eax, eax
jns 0x1400a7a0f
test rcx, rcx
je 0x1400a7a0a
mov qword [rbx], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
mov bl, r13b
jmp 0x1400a7a5f
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 0x90]
test eax, eax
jns 0x1400a7a2c
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a7a0a
mov qword [r14], r13
jmp 0x1400a7a04
or rbx, 0xffffffffffffffff
cmp rdi, rbp
je 0x1400a7a46
mov r9, rbx
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call fcn.140029d5c
lea rcx, [rdi + 0x20]
cmp rcx, r12
je 0x1400a7a5d
mov r9, rbx
xor r8d, r8d
mov rdx, r12
call fcn.140029d5c
mov bl, 1
xor r8d, r8d
lea rcx, [rsp + 0x38]
mov dl, 1
call fcn.140029bc0
test bl, bl
je 0x1400a7a77
mov qword [rsi], r15
jmp 0x1400a7a87
mov qword [rsi], r13
mov edx, 1
mov rax, qword [r15]
mov rcx, r15
call qword [rax]
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a7c70
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x130
xor ebx, ebx
mov rax, rdx
mov dword [rsp + 0x140], ebx
cmp qword [rcx + 0x10], rbx
jne 0x1400a7ca1
mov rcx, qword [rax]
lea rdx, [0x140152954]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400a7cbd
cmp qword [rcx + 0x18], 8
jb 0x1400a7cab
mov rcx, qword [rcx]
mov r8, rcx
lea rdx, [0x140152954]
mov rcx, rax
call fcn.14005dd00
mov edi, eax
test eax, eax
je 0x1400a7d1b
mov r9d, 2
cmp dword [0x14017c080], r9d
jg 0x1400a7d08
mov r8d, 0xae
lea rdx, str..._.._chrome_installer_util_channel_info.cc
lea rcx, [rsp + 0x20]
call fcn.1400681c0
lea rdx, str.Failed_writing_channel_info__result:
lea rcx, [rax + 8]
call fcn.14002bcb4
mov rcx, rax
mov edx, edi
call fcn.140028ef4
mov ebx, 1
test bl, 1
je 0x1400a7d17
lea rcx, [rsp + 0x20]
call fcn.140068220
xor al, al
jmp 0x1400a7d1d
mov al, 1
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
Function at 0x1400a8da0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
and qword [rsp + 0x30], 0
lea r8, [rcx + 0x18]
and dword [rsp + 0x38], 0
mov rbx, rcx
and qword [rsp + 0x40], 0
cmp qword [r8 + 0x18], 8
jb 0x1400a8dc8
mov r8, qword [r8]
mov rdx, qword [rcx + 8]
mov r9d, 0x203
lea rcx, [rsp + 0x30]
call fcn.14005d650
test eax, eax
jne 0x1400a8e59
cmp dword [rbx], eax
jne 0x1400a8e13
lea rdx, [rbx + 0x38]
cmp qword [rdx + 0x18], 8
jb 0x1400a8df2
mov rdx, qword [rdx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400a8e59
lea rcx, [rsp + 0x68]
call fcn.140066980
lea rdx, [rbx + 0x38]
cmp qword [rdx + 0x18], 8
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
jb 0x1400a8e33
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 8
mov r9d, ntohl
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x30]
call fcn.14005d610
add rsp, 0x50
pop rbx
ret

Function at 0x1400a9154
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov edi, edx
lea rdx, [rax - 0x28]
mov qword [rax - 0x28], rbx
mov cl, 1
mov dword [rax - 0x20], ebx
mov qword [rax - 0x18], rbx
call fcn.1400a9028
test al, al
je 0x1400a91a8
lea rdx, str.RetentionStudy
test edi, edi
jne 0x1400a9196
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400a91a3
mov r8d, edi
lea rcx, [rsp + 0x20]
call fcn.14005dcc0
test eax, eax
sete bl
lea rcx, [rsp + 0x20]
call fcn.14005d610
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400aa6d8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor ebx, ebx
lea rdx, str.microsoft_edge:
mov r8, rcx
mov dword [rsp + 0x30], ebx
lea rcx, [rbp + 0xc0]
mov edi, ebx
call fcn.14002c140
xor edx, edx
mov dword [rsp + 0x40], 0x70
lea r8d, [rbx + 0x6c]
lea rcx, [rsp + 0x44]
call fcn.140113400
cmp qword [rbp + 0xd8], 8
lea rax, str.open
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x44], 0x500
cmovae rax, qword [rbp + 0xc0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400aa784
mov bl, 1
jmp 0x1400aa7d5
cmp dword [0x14017c080], 2
jg 0x1400aa7c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 2
lea rdx, str..._.._chrome_installer_util_google_chrome_distribution.cc
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 0x3f]
call fcn.140068d00
lea rdx, str.Failed_to_launch_Edge_for_uninstall_survey
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov edi, 1
test dil, 1
je 0x1400aa7d5
lea rcx, [rbp - 0x50]
call fcn.140068d80
xor r8d, r8d
lea rcx, [rbp + 0xc0]
mov dl, 1
call fcn.140029bc0
mov al, bl
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret