joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012dd54
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14010a804
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14012ddde
cmp byte [rbp - 0x21], r15b
je 0x14012ddd9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14012de14
call fcn.140124a64
test eax, eax
jne 0x14012de00
cmp byte [rbp - 0x21], r15b
je 0x14012ddf8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14012de14
cmp byte [rbp - 0x21], r15b
je 0x14012de11
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14010fe1c
test eax, eax
jne 0x14012deb4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14010a804
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14012de53
cmp byte [rbp - 0x21], r15b
je 0x14012de88
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14012de88
call fcn.140124a64
test eax, eax
jne 0x14012de74
cmp byte [rbp - 0x21], r15b
je 0x14012de6d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14012de88
cmp byte [rbp - 0x21], r15b
je 0x14012de85
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14010fe1c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14012deb4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14012deb7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14012dec5
mov rcx, rdi
call fcn.1400e0a50
cmp byte [rbp + 0x3f], r15b
je 0x14012ded4
mov rcx, qword [rbp + 0x27]
call fcn.1400e0a50
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14012e078
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x14012e0c2
call fcn.140113374
mov dword [rax], 0xf
call fcn.140113354
mov dword [rax], ntohl
call fcn.14011647c
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400fd9d0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x14012e0cd
lea eax, [rbx + 1]
jmp 0x14012e0af
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x14012e0ad
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x14012e0af
Function at 0x14012e9ac
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14012e9c2
mov al, 1
jmp 0x14012ea22
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14012e9d3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14012ea20
mov ecx, dword [rcx + 0x18]
nop
call fcn.14011420c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14012ea20
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14012ea20
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14012ea20
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14012ea22
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401399c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x140139a06
mov r15, rbx
test r15, r15
je 0x140139b14
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x140139a62
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x140139a51
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1400ff470
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x1401399e2
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x140139b27
lea rcx, [r13*8]
call fcn.1400fc2cc
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x140139ac7
xor r15d, r15d
mov r8, rcx
add r8, r15
je 0x140139b14
mov r9, qword [r14 + r15]
mov qword [r8], r9
add r15, 8
cmp rdx, r15
jne 0x140139aac
add r15, rcx
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x140139ae7
add rbx, 0xfffffffffffffff8
jne 0x140139ada
jmp 0x140139b01
test r12, r12
je 0x1401399e2
mov rcx, r12
call fcn.1400fc308
mov r15, qword [rsi + 0x10]
jmp 0x1401399e2
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.140139400
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.140139400
call fcn.140136570
int3
Function at 0x14013aaf0
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x188], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x170], xmm0
movaps xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x180], 0
cmp byte [rcx + 0x17], 0
jns 0x14013ab36
mov rcx, qword [rsi]
lea r8, [rsp + 0x160]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14013abe2
mov rcx, rsi
call fcn.14005d440
movzx r8d, al
xor r8d, 5
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14013ab6a
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14013ac62
lea rcx, str.....chromeinstallerutildelete_after_reboot_helper.cc
mov edx, 0x3a
call fcn.1400dc110
mov dil, 1
test eax, eax
jle 0x14013ac45
lea rdx, str.....chromeinstallerutildelete_after_reboot_helper.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x5f
mov r9d, 0xffffffff
call fcn.140067850
lea rcx, [rsp + 0x38]
lea rdx, str.Scheduled_for_deletion:
mov r8d, 0x18
call fcn.1400be440
mov rcx, rax
mov rdx, rsi
call fcn.140063fd0
mov rcx, rbx
call fcn.140067e60
jmp 0x14013ac45
mov ecx, 1
call fcn.1400dc0e0
test al, al
je 0x14013ac43
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutildelete_after_reboot_helper.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x40
mov r9d, 1
call fcn.14016b430
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.140063fd0
lea rdx, str._does_not_exist.
mov r8d, 0x10
mov rcx, rax
call fcn.1400be440
mov rcx, rdi
call fcn.14016b4a0
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, edi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400dc0e0
test al, al
je 0x14013ac43
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutildelete_after_reboot_helper.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x4b
mov r9d, 2
call fcn.14016b430
lea rcx, [rsp + 0x38]
lea rdx, str.Could_not_schedule
mov r8d, 0x13
call fcn.1400be440
mov rcx, rax
mov rdx, rsi
call fcn.140063fd0
lea rdx, str._for_deletion.
mov r8d, reloc.WS2_32.dll_ntohl
jmp 0x14013ac33
Function at 0x14013b690
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rcx]
mov rdi, qword [rcx + 8]
jmp 0x14013b6c3
add rdi, 0xffffffffffffffd0
mov rcx, rdi
call fcn.14013c030
cmp rdi, rbx
jne 0x14013b6b7
mov qword [rsi + 8], rbx
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402103c0]
movaps xmmword [rdi], xmm0
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.1400578c0
mov rbx, qword [rdi]
test rbx, rbx
je 0x14013b81b
mov dword [rsp + 0x4c], 0
xorps xmm0, xmm0
lea rdi, [rsp + 0x30]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov edx, 1
mov rcx, rdi
call fcn.140037ae0
mov dword [rsp + 0x68], 0xaaaaaaaa
mov rax, qword [rdi]
cmp qword [rdi + 8], rax
je 0x14013b844
lea r15, [rsp + 0x4c]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x68]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x14013b822
cmp eax, 0xea
jne 0x14013b7da
mov ebp, 0x8000ffff
cmp dword [rsp + 0x68], 7
jne 0x14013b7e8
mov edx, dword [rsp + 0x4c]
test dl, 1
jne 0x14013b7e8
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.140037ae0
mov rax, qword [r14]
cmp qword [r14 + 8], rax
je 0x14013b844
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x68]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14013b829
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
lea rcx, [rsp + 0x68]
mov qword [rcx], rdi
call fcn.1400bf860
lea rcx, [rsp + 0x50]
call fcn.140057b60
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov ebp, 0x80070002
jmp 0x14013b7f5
mov ebp, 0x80070002
jmp 0x14013b7e8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
je 0x14013b844
mov r8, rsi
call fcn.14013b200
mov ebp, eax
jmp 0x14013b7e8
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_vector:1411:_assertion___n___size___failed:_vector___index_out_of_bounds_n
call fcn.140139400
int3
Function at 0x1401432c0
Capabilities:
Delete service

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rbx, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x140143357
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dil, 1
test eax, eax
jne 0x14014331b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, 1
call fcn.1400dc0e0
test al, al
jne 0x14014335b
cmp edi, 0x430
sete dil
cmp qword [rsi], 0
je 0x140143336
call fcn.1400dc3b0
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsi], 0
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
jmp 0x140143336
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_service_work_item_impl.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x25f
mov r9d, 1
call fcn.14016b430
lea rcx, [rsp + 0x50]
lea rdx, str.DeleteService_failed
mov r8d, 0x15
call fcn.1400be440
mov r14, rax
lea r15, [rsp + 0x28]
mov rcx, rbx
mov rdx, r15
call fcn.140142f40
cmp byte [r15 + 0x17], 0
jns 0x1401433b7
mov r15, qword [rsp + 0x28]
mov rcx, r14
mov rdx, r15
call fcn.140168d80
cmp byte [rsp + 0x3f], 0
jns 0x1401433d3
mov rcx, qword [rsp + 0x28]
call fcn.1400fc308
lea rcx, [rsp + 0x40]
call fcn.14016b4a0
jmp 0x140143311
Function at 0x14014b210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x50], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [0x1402103c0]
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdx]
lea r12, [rdx + 8]
test rax, rax
mov rcx, r12
cmove rcx, rax
mov edx, dword [rcx + 8]
xor r8d, r8d
test edx, edx
setne r8b
lea r9, [rsi + 0x28]
xor ecx, ecx
cmp rax, 2
cmovb r9, rcx
mov dword [rsp + 0x20], edx
mov edx, dword [r9 + 8]
mov dword [rsp + 0x24], edx
test edx, edx
mov edx, 2
cmove rdx, r8
lea r8, [rsi + 0x48]
cmp rax, 3
cmovb r8, rcx
mov r8d, dword [r8 + 8]
test r8d, r8d
mov r9d, 3
cmove r9, rdx
lea rdx, [rsi + 0x68]
cmp rax, 4
cmovb rdx, rcx
mov dword [rsp + 0x28], r8d
mov edx, dword [rdx + 8]
mov dword [rsp + 0x2c], edx
test edx, edx
mov edx, 4
cmove rdx, r9
lea r8, [rsi + 0x88]
cmp rax, 5
cmovb r8, rcx
mov r8d, dword [r8 + 8]
test r8d, r8d
mov r9d, 5
cmove r9, rdx
lea rdx, [rsi + 0xa8]
cmp rax, 6
cmovb rdx, rcx
mov dword [rsp + 0x30], r8d
mov edx, dword [rdx + 8]
mov dword [rsp + 0x34], edx
test edx, edx
mov edx, 6
cmove rdx, r9
lea r8, [rsi + 0xc8]
cmp rax, 7
cmovb r8, rcx
mov r8d, dword [r8 + 8]
test r8d, r8d
mov r9d, 7
cmove r9, rdx
lea rdx, [rsi + 0xe8]
cmp rax, 8
cmovb rdx, rcx
mov dword [rsp + 0x38], r8d
mov edx, dword [rdx + 8]
mov dword [rsp + 0x3c], edx
test edx, edx
mov edx, 8
cmove rdx, r9
lea r8, [rsi + 0x108]
cmp rax, 9
cmovb r8, rcx
mov r8d, dword [r8 + 8]
test r8d, r8d
mov r9d, 9
cmove r9, rdx
cmp rax, 0xa
lea rax, [rsi + 0x128]
cmovb rax, rcx
mov dword [rsp + 0x40], r8d
mov eax, dword [rax + 8]
mov dword [rsp + 0x44], eax
test eax, eax
mov ebx, 0xa
cmove rbx, r9
mov r15, qword [rdi]
lea r13, [rdi + 8]
test r15, r15
cmovne r15, r13
mov rcx, r15
mov rdx, rbx
call fcn.14014ab20
mov r14d, eax
xor al, 1
test rbx, rbx
sete cl
or cl, al
jne 0x14014b3f5
mov ebp, 1
mov edx, dword [rsp + rbp*4 + 0x1c]
mov rcx, r15
call fcn.14014ab20
mov r14d, eax
test al, al
je 0x14014b3f5
lea rax, [rbp + 1]
cmp rbp, rbx
mov rbp, rax
jb 0x14014b3d6
test rbx, rbx
sete al
mov ecx, r14d
xor cl, 1
or cl, al
jne 0x14014b44a
xor ebp, ebp
xor r14d, r14d
mov rcx, r13
cmp qword [rdi], rbp
ja 0x14014b414
xor ecx, ecx
mov r15, r12
cmp qword [rsi], rbp
ja 0x14014b41f
xor r15d, r15d
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
call fcn.14014a8e0
test al, al
je 0x14014b44a
mov rcx, r15
call fcn.14014a2e0
inc rbp
add r12, 0x20
add r13, 0x20
mov r14b, 1
cmp rbp, rbx
jb 0x14014b407
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, r14d
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140164a70
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
add rsp, 0x38
ret
Function at 0x140164b40
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x140165fb0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 1
je 0x140165fd9
mov rcx, qword [rsi]
jmp 0x140165fe2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14016602b
mov dil, 1
test bl, bl
je 0x140166014
cmp byte [rsi + 8], 1
je 0x140166000
mov rcx, qword [rsi]
jmp 0x140166009
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 1
jne 0x140166042
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140166045
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140166058
xor edi, edi
jmp 0x140166014
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 1
jne 0x140166071
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140166074
mov rcx, qword [rsi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x140166014
Function at 0x1401661e0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
movaps xmmword [rsp + 0x130], xmm6
mov ebx, r9d
mov edi, r8d
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x40], ntohl
mov rax, qword [0x140220770]
mov al, byte [rax + 0xb]
test al, al
jne 0x14016648d
movabs r13, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x120], r13
movaps xmm6, xmmword [0x1402103c0]
movaps xmmword [rsp + 0x110], xmm6
lea r15, [rsp + 0x80]
mov rcx, r14
mov rdx, r15
call fcn.14006c210
cmp byte [r15 + 0x17], 0
js 0x140166311
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x120], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x110], xmm0
lea r12, [rsp + 0x80]
mov rcx, r12
call fcn.1400dc710
lea r15, [rsp + 0xf0]
mov qword [r15 + 0x10], r13
movaps xmmword [r15], xmm6
mov rcx, r14
mov rdx, r15
call fcn.14016cc90
xorps xmm0, xmm0
movups xmmword [r12 + 0x60], xmm0
movups xmmword [r12 + 0x50], xmm0
movups xmmword [r12 + 0x40], xmm0
movups xmmword [r12 + 0x30], xmm0
movabs rax, 0x4000000070
mov qword [r12], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [r12 + 8], rax
lea rax, str.runas
mov qword [r12 + 0x10], rax
cmp byte [rsp + 0x127], 0
js 0x140166333
lea rax, [rsp + 0x110]
jmp 0x14016633b
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.1400cc5b0
jmp 0x140166292
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x98], rax
cmp byte [rsp + 0x107], 0
jns 0x140166355
mov r15, qword [rsp + 0xf0]
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x20], r15
xor r14d, r14d
mov qword [rcx + 0x28], r14
xor dil, 1
movzx eax, dil
mov dword [rcx + 0x30], eax
mov qword [rcx + 0x38], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1401663eb
test bl, bl
je 0x1401663e3
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.LaunchElevatedProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x9e
call fcn.1400dc390
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d1670
mov rcx, qword [rsp + 0xe8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call fcn.1400d16f0
mov r14, qword [rsp + 0xe8]
mov rcx, rsi
mov rdx, r14
call fcn.14005a810
cmp byte [rsp + 0x107], 0
jns 0x14016640d
mov rcx, qword [rsp + 0xf0]
call fcn.1400fc308
cmp byte [rsp + 0x127], 0
jns 0x140166424
mov rcx, qword [rsp + 0x110]
call fcn.1400fc308
mov qword [rsp + 0x40], ntohl
mov rax, qword [0x140220770]
mov al, byte [rax + 0xb]
test al, al
jne 0x140166469
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1400fd9d0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x130]
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, al
lea r8, [rsp + 0x80]
mov qword [r8], 0
lea rdx, [rsp + 0x40]
mov r9d, 2
call fcn.1400c8620
jmp 0x14016643b
movzx ecx, al
lea rax, str.LaunchElevatedProcess
lea r8, [rsp + 0x80]
mov qword [r8], rax
lea rdx, [rsp + 0x40]
mov r9d, 1
call fcn.1400c8620
jmp 0x140166233
Function at 0x140166860
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1402103c0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x1d2
call fcn.1400dc390
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1400d1670
mov al, byte [rsi + 0x17]
test al, al
jns 0x1401668de
cmp qword [rsi + 8], 0x103
ja 0x1401668fc
test al, al
jns 0x1401668e5
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.1400d16f0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140166db0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edx, 1
mov r8d, 0x80000000
jmp fcn.14005d2f0
Function at 0x140167130
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm6, xmmword [0x1402103c0]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x8d
call fcn.1400dc390
xor ebp, ebp
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400d1670
mov rcx, rdi
call fcn.1400de380
test al, al
jne 0x1401671dc
mov rcx, rsi
call fcn.1400de380
test al, al
jne 0x1401671da
cmp byte [rdi + 0x17], 0
jns 0x14016721e
cmp qword [rdi + 8], 0x103
jbe 0x14016721e
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.1400d16f0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebp, ebp
lea rcx, [rsp + 0x20]
call fcn.140092780
jmp 0x1401671dc
cmp byte [rsi + 0x17], 0
jns 0x14016722e
cmp qword [rsi + 8], 0x103
ja 0x1401671da
lea r14, [rsp + 0x20]
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, ILFree
call fcn.1400dc390
lea r8, [0x140261688]
mov rcx, r14
mov rdx, r15
call fcn.140092650
cmp byte [rsi + 0x17], 0
jns 0x140167273
mov rsi, qword [rsi]
movzx r8d, bl
cmp byte [rdi + 0x17], 0
jns 0x140167280
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140167210
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bpl
sete cl
test al, 1
sete dl
or dl, cl
jne 0x140167212
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bpl, 1
jmp 0x140167212