joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029030
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x338
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x330], rax
lea rbx, [rsp + 0x68]
mov r8d, 0x2c8
mov rcx, rbx
mov dl, 0xaa
call fcn.1401cdd90
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.14002ef00
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x14026f080]
movaps xmmword [rsi], xmm0
mov rcx, rbx
mov rdx, rsi
call fcn.1400293b0
movsx rax, byte [rsi + 0x17]
mov rcx, rax
test rax, rax
jns 0x1400290cd
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140029194
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, [rsp + 0x68]
lea rbx, [rsp + 0x38]
xor r13d, r13d
cmp byte [rsp + 0x68], 0
je 0x1400291d9
mov edx, dword [rsp + 0x6c]
test dl, 1
jne 0x1400291e3
test dl, 0x10
jne 0x1400291d2
cmp byte [rsp + 0x67], 0
mov rcx, rsi
jns 0x140029124
mov rcx, qword [rsp + 0x50]
call r15
test eax, eax
jne 0x1400291d2
call r12
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
cmove ebp, r14d
test r13d, r13d
cmovne ebp, r13d
mov rcx, rdi
mov rdx, rbx
call fcn.1400293b0
cmp byte [rsp + 0x67], 0
jns 0x140029161
mov rcx, qword [rsp + 0x50]
call fcn.14018f5b0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x50], xmm0
movsx rax, byte [rsp + 0x67]
mov rcx, rax
test rax, rax
jns 0x140029188
mov rcx, qword [rsp + 0x58]
mov r13d, ebp
test rcx, rcx
jne 0x1400290f4
test al, al
jns 0x1400291a2
mov rcx, qword [rsp + 0x50]
call fcn.14018f5b0
lea rcx, [rsp + 0x68]
call fcn.140029210
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.140191d80
mov eax, ebp
add rsp, 0x338
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x14002913e
call fcn.1401d1150
jmp 0x140029115
xor ebp, ebp
test dl, 0x10
jne 0x14002913e
test al, al
jns 0x1400291f9
mov rcx, qword [rsp + 0x50]
jmp 0x1400291fe
lea rcx, [rsp + 0x50]
and edx, 0xffffffee
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140029115
Function at 0x14002c870
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14002c89f
test r8d, r8d
jne 0x14002c898
lea rcx, [0x1402c86c8]
lea rdx, [0x1400a2f20]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.140178510

Function at 0x14002d420
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x14002d44c
call fcn.140118d70
mov qword [rsi], 0
test r15, r15
je 0x14002d482
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14002d4ad
cmp r12, 2
jb 0x14002d47a
mov qword [rsi], r15
call fcn.140118d70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14002d51f
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140118d70
mov r14, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x14002d4de
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402a3e88]
mov qword [rsi], 0
jmp 0x14002d46c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288eef]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002d52c
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14002d519
call qword [0x1402a3e88]
mov rcx, rax
xor edx, edx
call fcn.1400445d0
jmp 0x14002d4bf
xor ecx, ecx
mov dl, 1
jmp 0x14002d512
mov rcx, rdi
call fcn.140182cb0
jmp 0x14002d49c
xor ecx, ecx
jmp 0x14002d510
Function at 0x14002d530
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402c1858]
cmp ecx, 0xffffffff
je 0x14002d60a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14002d60a
mov eax, dword [0x1402cbbc0]
mov ecx, dword [0x1402c2670]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002d614
mov rbx, qword [0x1402cbbb8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14002d659
mov rax, qword [0x1402ca3a8]
inc rax
xor ecx, ecx
lea rdx, [0x1402ca3b0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14002d666
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x1402cbbb0]
inc ecx
mov dword [0x1402cbbb0], ecx
mov dword [rax + 0x14], ecx
mov qword [0x1402ca3a8], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14002d656
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400136a0
jmp 0x14002d55a
lea rcx, [0x1402cbbc0]
call fcn.14018f730
cmp dword [0x1402cbbc0], 0xffffffff
jne 0x14002d57f
mov ecx, 8
call fcn.14018f5b8
mov qword [rax], 0
mov qword [0x1402cbbb8], rax
lea rcx, [0x1402cbbc0]
call fcn.14018f6c4
jmp 0x14002d57f
int3
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x14002d597
inc rcx
cmp rcx, 0x100
jne 0x14002d5aa
jmp 0x14002d5f0
Function at 0x14002de60
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140191d20
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1401cdd90
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002df13
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14002df17
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.14002df70
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140191d80
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14002def4
cmp eax, 2
jne 0x14002df5f
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1401cdd90
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14002df66
lea rdx, [rsp + 0x40]
jmp 0x14002deea
mov edi, 0x3f4
jmp 0x14002def4
mov edi, 0xea
jmp 0x14002def4

Function at 0x140033150
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x10040
call fcn.140191d20
sub rsp, rax
mov rsi, rdx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x10038], rax
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rax
mov r8, rdi
call fcn.1401457c0
test rsi, rsi
je 0x14003321d
lea rbx, [rsp + 0x3a]
mov r8d, 0xfffe
mov rcx, rbx
mov dl, 0xaa
call fcn.1401cdd90
cmp byte [rsp + 0x37], 0
jns 0x1400331c0
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x1400331ef
cmp eax, 0x7fff
jae 0x140033242
mov edx, eax
lea rcx, [rsp + 0x3a]
mov r8, rsi
call fcn.14004a200
cmp byte [rsp + 0x37], 0
jns 0x140033200
mov rcx, qword [rsp + 0x20]
call fcn.14018f5b0
mov rcx, qword [rsp + 0x10038]
xor rcx, rsp
call fcn.140191d80
mov eax, ebx
add rsp, 0x10040
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsp + 0x37], 0
js 0x14003322b
lea rcx, [rsp + 0x20]
jmp 0x140033230
mov rcx, qword [rsp + 0x20]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x1400331ef
int3
Function at 0x140035590
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140035658
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140035620
cmp eax, 0xffffffff
je 0x140035631
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140191d80
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x140035634
mov eax, dword [rsp + 0x2c]
jmp 0x140035600
int3
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400355f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x140035602

Function at 0x1400360f0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x140036229
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x40]
mov qword [rbx], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov r14, rax
call r15
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne bl
je 0x140036230
mov r15, qword [rsp + 0x40]
cmp qword [rsi], r15
je 0x14003619c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400361b7
lea rax, [r15 + 1]
cmp rax, 2
jb 0x140036194
mov qword [rsi], r15
call fcn.140118d70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140191d80
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140118d70
mov r14, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x1400361e8
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402a3e88]
mov qword [rsi], 0
jmp 0x140036182
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288eef]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003623d
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140036223
call qword [0x1402a3e88]
mov rcx, rax
xor edx, edx
call fcn.1400445d0
jmp 0x1400361c9
xor ecx, ecx
mov dl, 1
jmp 0x14003621c
mov bl, 1
jmp 0x14003619c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140036194
xor ecx, ecx
jmp 0x14003621a
Function at 0x140036aa0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x140036ac8
call fcn.140118d70
cmp qword [rsi], r14
je 0x140036af7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140036b06
cmp r15, 2
jb 0x140036aef
mov qword [rsi], r14
call fcn.140118d70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140118d70
mov rbx, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x140036b37
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x1402a3e88]
mov qword [rsi], 0
jmp 0x140036ae1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288eef]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140036b78
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140036b72
call qword [0x1402a3e88]
mov rcx, rax
xor edx, edx
call fcn.1400445d0
jmp 0x140036b18
xor ecx, ecx
mov dl, 1
jmp 0x140036b6b
xor ecx, ecx
jmp 0x140036b69
Function at 0x140037ff0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x1400381ec
mov rbx, r9
mov edi, r8d
mov ebp, edx
mov rsi, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov r15, qword [rsi]
cmp r15, rax
je 0x14003807a
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140038166
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14003806e
mov qword [rsi], r14
call fcn.140118d70
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsi]
lea rax, [r15 + 1]
cmp rax, 1
jbe 0x1400381f6
xor r14d, r14d
lea rcx, [rsp + 0x28]
mov r8d, Ordinal_145
xor edx, edx
call fcn.1401cdd90
test ebp, ebp
jne 0x14003814d
mov ecx, 0xff
mov r14d, 0x408
mov dword [rsp + 0x50], 1
mov eax, r14d
mov dword [rsp + 0x24], ecx
mov r14d, ecx
test rbx, rbx
je 0x1400380d4
or eax, 0x100
mov qword [rsp + 0x98], rbx
or eax, 0x2000
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x28]
mov rcx, r15
mov edx, 9
mov r9d, Ordinal_145
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x1400381df
not edi
and r14d, edi
lea r8, [rsp + 0x24]
mov dword [r8], r14d
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor esi, esi
test eax, eax
je 0x1400381df
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140191d80
mov eax, esi
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp ebp, 1
jne 0x14003821f
mov ecx, reloc.WLDAP32.dll_Ordinal_216
mov r14d, 8
jmp 0x1400380b0
call fcn.140118d70
mov r12, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x14003819a
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r12
call qword [0x1402a3e88]
mov qword [rsi], 0
jmp 0x14003805c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288eef]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140038240
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400381d9
call qword [0x1402a3e88]
mov rcx, rax
xor edx, edx
call fcn.1400445d0
jmp 0x140038178
xor ecx, ecx
mov dl, 1
jmp 0x1400381d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140038129
mov esi, 0x4df
jmp 0x140038129
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140191d80
nop
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xc8
cmp ebp, 2
je 0x1400380b8
mov eax, 0
cmp ebp, 3
je 0x1400380c2
jmp 0x1400380dd
xor ecx, ecx
jmp 0x1400381d0
Function at 0x140039ec0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, r8d
mov rsi, rdx
mov rdx, qword [0x1402b3040]
xor rdx, rsp
mov qword [rsp + 0x40], rdx
mov rcx, qword [rcx]
movabs rdx, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x38]
mov qword [r8], rdx
or r9d, 8
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 2
mov edx, r9d
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140039f92
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140039f92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140039f8e
call fcn.140118d70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
mov bpl, 1
test rbx, rbx
je 0x140039f71
cmp rbx, 0xffffffffffffffff
je 0x140039f99
call fcn.140118d70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsi], rbx
call fcn.140118d70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140191d80
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x140039f37
mov byte [rsi], 0
xor ebp, ebp
jmp 0x140039f71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140039f69
Function at 0x14003c8e0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
or r8d, 8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x14003c9af
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14003c9af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14003c9ab
call fcn.140118d70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
mov bpl, 1
test rbx, rbx
je 0x14003c98e
cmp rbx, 0xffffffffffffffff
je 0x14003c9b6
call fcn.140118d70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsi], rbx
call fcn.140118d70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140191d80
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x14003c954
mov byte [rsi], 0
xor ebp, ebp
jmp 0x14003c98e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14003c986
Function at 0x140043870
Capabilities:
Check if file exists

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov al, byte [rcx + 8]
cmp al, byte [rdx + 8]
je 0x14004389b
test al, al
jne 0x1400438af
test rsi, rsi
je 0x1400438ac
mov rcx, rsi
call fcn.140036aa0
mov byte [rsi + 8], 1
add rsp, 0x20
pop rsi
ret
test al, al
je 0x140043895
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400438c0
int3
mov rcx, rsi
call fcn.14002d380
mov byte [rsi + 8], 0
jmp 0x140043895

Function at 0x1400438c0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400438e7
call fcn.140118d70
cmp qword [rsi], r14
je 0x140043916
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140043925
cmp r15, 2
jb 0x14004390e
mov qword [rsi], r14
call fcn.140118d70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140118d70
mov rbx, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x140043956
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x1402a3e88]
mov qword [rsi], 0
jmp 0x140043900
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288eef]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140043997
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140043991
call qword [0x1402a3e88]
mov rcx, rax
xor edx, edx
call fcn.1400445d0
jmp 0x140043937
xor ecx, ecx
mov dl, 1
jmp 0x14004398a
xor ecx, ecx
jmp 0x140043988
Function at 0x1400439a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140043b5c
cmp qword [rsi], 0
jne 0x140043b5c
cmp dword [rsi + 0x14], 0
jne 0x140043b5c
cmp qword [rsi + 8], 0
jne 0x140043b5c
xor eax, eax
mov r15, qword [rdi]
cmp rax, r15
je 0x140043a16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140043a9f
lea rax, [r15 + 1]
cmp rax, 2
jb 0x140043a0e
mov qword [rsi], r15
call fcn.140118d70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 8]
cmp qword [rsi + 8], r15
je 0x140043a50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140043a68
lea rax, [r15 + 1]
cmp rax, 2
jb 0x140043a48
mov qword [rsi + 8], r15
call fcn.140118d70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140118d70
mov r14, qword [rsi + 8]
cmp qword [0x1402c5c40], 0
je 0x140043b18
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402a3e88]
mov qword [rsi + 8], 0
jmp 0x140043a35
call fcn.140118d70
mov r14, qword [rsi]
cmp qword [0x1402c5c40], 0
je 0x140043ad3
mov rcx, qword [0x1402c5c40]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402a3e88]
mov qword [rsi], 0
jmp 0x1400439fc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288eef]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140043b7d
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140043b12
call qword [0x1402a3e88]
mov rcx, rax
xor edx, edx
call fcn.1400445d0
jmp 0x140043ab1
xor ecx, ecx
mov dl, 1
jmp 0x140043b0b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140288eef]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140043b81
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140043b56
call qword [0x1402a3e88]
mov rcx, rax
xor edx, edx
call fcn.1400445d0
jmp 0x140043a7f
xor ecx, ecx
mov dl, 1
jmp 0x140043b4c
mov rcx, rsi
call fcn.140182cb0
lea rcx, [rsi + 8]
call fcn.140182cb0
mov qword [rsi + 0x10], 0
mov rax, qword [rsi]
jmp 0x1400439dc
xor ecx, ecx
jmp 0x140043b09
xor ecx, ecx
jmp 0x140043b4a