joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400792b0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14007939c
cmp qword [rsi], 0
jne 0x14007939c
cmp dword [rsi + 0x14], 0
jne 0x14007939c
cmp qword [rsi + 8], 0
jne 0x14007939c
xor eax, eax
mov rbx, qword [rdi]
cmp rax, rbx
je 0x14007931f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14007936e
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140079317
mov qword [rsi], rbx
call fcn.1400ed9a0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rdi + 8]
cmp qword [rsi + 8], rbp
je 0x140079359
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140079384
lea rax, [rbp + 1]
cmp rax, 2
jb 0x140079351
mov qword [rsi + 8], rbp
call fcn.1400ed9a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400ed9a0
mov rcx, qword [rsi]
call fcn.1400f1110
mov qword [rsi], 0
jmp 0x140079305
call fcn.1400ed9a0
mov rcx, qword [rsi + 8]
call fcn.1400f1110
mov qword [rsi + 8], 0
jmp 0x14007933e
mov rcx, rsi
call fcn.140174980
mov rax, qword [rsi]
jmp 0x1400792e9
Function at 0x14007e8d0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x1402170e8]
mov qword [rcx], rax
add rcx, 8
call fcn.1400f3dd0
lea rcx, [rsi + 0x10]
call fcn.1400f3dd0
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.1400f3dd0
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebp, 0x3f800000
mov dword [rsi + 0xd0], ebp
mov dword [rsi + 0xd8], ebx
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebp
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebp
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebp
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebp
mov qword [rsi + 0x198], rbx
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebx
mov eax, dword [0x140232a4c]
mov dword [rsi + 0x1a0], eax
lea rcx, [rsi + 0x1a8]
call fcn.1400a1120
lea rcx, [rsi + 0x2f0]
movups xmmword [rsi + 0x2d8], xmm6
mov qword [rsi + 0x2e8], rbx
xor edx, edx
call fcn.14009f4a0
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.14009f4a0
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.14009f4a0
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
mov dword [rsi + 0x328], ebp
movsxd rax, edi
movups xmmword [rsi + 0x330], xmm6
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
mov byte [rsi + 0x360], bl
mov qword [rsi + 0x368], rax
mov byte [rsi + 0x370], bl
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
call fcn.140019ac0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov rcx, rsi
call fcn.14007eaf0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14007eae1
call fcn.1400a09b0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400a0a60
mov qword [0x14025c680], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14007eaaf
Function at 0x140084a70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x140084ade
xor r11d, r11d
mov r14, qword [r8 + r11*8]
mov r15, qword [rcx + r11*8]
mov rbx, r15
xor rbx, r14
mov edi, eax
lea rax, [rbx - 1]
mov rsi, r15
sub rsi, r14
xor rsi, r15
or rsi, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor rsi, r15
sar rsi, 0x3f
mov rbx, rsi
not rsi
and esi, 1
or rsi, rbx
mov rbx, rax
and edi, ebx
not rax
and rax, rsi
or rax, rdi
inc r11
cmp r10, r11
jne 0x140084a8b
cmp rdx, r9
jb 0x140084af0
cmp r9, rdx
jb 0x140084b1c
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x140084af2
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
jmp 0x140084ae8
xor esi, esi
or rsi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x140084b1e
mov rcx, rsi
not rcx
dec rsi
and rsi, rcx
sar rsi, 0x3f
mov rcx, rsi
and ecx, eax
not rsi
and esi, 1
or esi, ecx
mov eax, esi
jmp 0x140084ae8
Function at 0x140085b80
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
movsxd rdx, dword [rdx + 8]
test rdx, rdx
je 0x140085cbd
mov r14, rcx
mov rax, qword [rdi]
cmp rdx, 2
mov ecx, 1
cmovae rcx, rdx
xor ebx, ebx
xor esi, esi
or rsi, qword [rax + rbx*8]
inc rbx
cmp rcx, rbx
jne 0x140085bb0
test rsi, rsi
je 0x140085cbd
test edx, edx
jle 0x140085ce2
mov rax, qword [rdi]
test byte [rax], 1
je 0x140085ce2
cmp dword [rdi + 0x10], 0
jne 0x140085d22
lea rbx, [r14 + 0x18]
cmp rbx, rdi
je 0x140085c29
mov rcx, rbx
call fcn.140084330
test eax, eax
je 0x140085d02
movsxd r8, dword [rdi + 8]
test r8, r8
je 0x140085d42
shl r8, 3
mov rcx, qword [rbx]
mov rdx, qword [rdi]
call fcn.140108e80
mov eax, dword [rdi + 8]
mov dword [r14 + 0x20], eax
mov eax, dword [rdi + 0x10]
mov dword [r14 + 0x28], eax
mov rdi, rbx
test rdi, rdi
je 0x140085d02
mov eax, dword [r14 + 0x20]
test eax, eax
jle 0x140085d49
mov rdx, qword [rbx]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
mov rax, rcx
je 0x140085c36
inc ecx
mov dword [r14 + 0x20], ecx
mov rax, qword [rbx]
mov r9, qword [rax]
mov esi, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov edi, esi
and edi, 1
neg rdi
mov rax, r9
and rax, rdi
mov rbx, rax
xor rbx, rsi
shr rbx, 1
and rax, rsi
add rax, rbx
and rdi, r8
shr rcx, 1
or rcx, rdi
mov rsi, rax
dec rdx
jne 0x140085c72
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov dword [rsp + 0x20], 0xa5
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1401bcb10
jmp 0x140085cb1
mov dword [rsp + 0x20], 0xa9
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x140085cdb
mov dword [rsp + 0x20], 0xb3
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x140085cdb
mov dword [rsp + 0x20], 0xad
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x140085cdb
xor eax, eax
jmp 0x140085c1b
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x140085c56
mov dword [r14 + 0x28], 0
jmp 0x140085c56
Function at 0x140088ff0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x140089024
mov rax, qword [r12 + 8]
test rax, rax
je 0x14008911c
mov eax, ebx
not eax
test eax, 0x300
je 0x14008911c
cmp edi, 2
lea rax, [0x14025e5c0]
lea rcx, [0x14025e7c0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14008911c
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14008911c
cmp byte [0x14025e5b0], 0
setne al
bt ebx, 8
jb 0x14008911c
shr ebx, 9
and ebx, 1
or bl, al
je 0x14008911c
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx r13d, byte [r12 + 0x17]
test r13b, r13b
jns 0x140089177
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rdi, qword [rsi + 8]
mov rbp, r13
sub rbp, rdi
jb 0x140089109
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rdi
call fcn.14011c548
test eax, eax
je 0x14008913b
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x1400890eb
cmp dword [rsp + 0x2c], 0
jne 0x14008917f
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140106490
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [rbx + rdi*2]
cmp cx, 0x5c
je 0x14008914a
test cx, cx
jne 0x140089109
lea rax, [rbx + rdi*2]
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x1400891a7
cmp dword [rsp + 0x2c], 2
jne 0x1400891b8
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400891b8
mov rbx, r12
jmp 0x1400890cc
cmp byte [r12 + 0x17], 0
js 0x1400891e7
mov rax, r12
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.140033400
jmp 0x14008911c
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
cmp cx, 0x5c
jne 0x1400891d1
lea rbx, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, rbx
je 0x1400891be
jmp 0x1400891d4
mov rbx, rax
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
xor r15d, r15d
mov r13, rbp
jmp 0x140089110
mov rax, qword [r12]
jmp 0x14008918a
Function at 0x140089a90
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.14004fe40
cmp byte [rdi + 0x17], 0
jns 0x140089ad1
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x140089af2
mov rcx, qword [rsp + 0x58]
call fcn.140105bb4
test edi, edi
je 0x140089b99
test r14, r14
je 0x140089b99
mov ecx, edi
add rcx, rcx
call fcn.140105bec
mov rbx, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.14004fe40
cmp byte [rsi + 0x17], 0
jns 0x140089b33
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x140089b53
mov rcx, qword [rsp + 0x58]
call fcn.140105bb4
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140089bb7
mov rcx, rbx
call fcn.140121344
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.1400f0680
cmp byte [r14 + 0x17], 0
js 0x140089bc3
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
mov rcx, rbx
call fcn.140105bf4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x28], 0
int3
mov rcx, qword [r14]
call fcn.140105bb4
jmp 0x140089b7f

Function at 0x1400946c0
Capabilities:
Delete service

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x190
mov rbx, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x1400947c6
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dil, 1
test eax, eax
jne 0x1400947a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov ecx, 1
call fcn.14004bc00
test al, al
je 0x14009479e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x48]
mov r8d, 0x299
mov r9d, 1
call fcn.140157100
lea rcx, [rsp + 0x58]
lea rdx, str.DeleteService_failed
mov r8d, 0x15
call fcn.1400e7690
mov rdi, rax
lea rbp, [rsp + 0x30]
mov rcx, rbx
mov rdx, rbp
call fcn.1400940a0
cmp byte [rbp + 0x17], 0
jns 0x140094778
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
mov rdx, rbp
call fcn.140157230
cmp byte [rsp + 0x47], 0
jns 0x140094794
mov rcx, qword [rsp + 0x30]
call fcn.140105bb4
lea rcx, [rsp + 0x48]
call fcn.140157180
cmp r14d, 0x430
sete dil
cmp qword [rsi], 0
je 0x1400947c8
call fcn.1400ed9a0
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsi], 0
jmp 0x1400947c8
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140106490
mov eax, edi
add rsp, 0x190
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140095570
Capabilities:
Modify service

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1c0
mov r15, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
movzx eax, byte [rdx + 0x57]
test al, al
jns 0x1400955a5
mov rax, qword [rdx + 0x48]
mov rbx, qword [rdx + 0x40]
jmp 0x1400955a9
lea rbx, [rdx + 0x40]
test rax, rax
cmove rbx, rax
mov rax, qword [rdx + 0x28]
xor edi, edi
cmp rax, qword [rdx + 0x30]
cmovne rdi, rax
movzx eax, byte [rdx + 0x27]
test al, al
jns 0x1400955d0
mov rax, qword [rdx + 0x18]
mov rsi, qword [rdx + 0x10]
jmp 0x1400955d4
lea rsi, [rdx + 0x10]
test rax, rax
cmove rsi, rax
mov r9d, dword [rdx + 0xc]
mov eax, dword [rdx + 4]
mov r8d, dword [rdx + 8]
mov rcx, qword [r15 + 0xd0]
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rdi
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rsi
mov edx, eax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, eax
test eax, eax
jne 0x1400956b1
mov ecx, 1
call fcn.14004bc00
test al, al
je 0x1400956b1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x78]
mov r8d, 0x1d1
mov r9d, 1
call fcn.140157100
lea rcx, [rsp + 0x88]
lea rdx, str.Failed_to_change_service_config
mov r8d, 0x20
call fcn.1400e7690
mov r14, rax
lea rbx, [rsp + 0x60]
mov rcx, r15
mov rdx, rbx
call fcn.1400940a0
cmp byte [rbx + 0x17], 0
jns 0x14009568b
mov rbx, qword [rsp + 0x60]
mov rcx, r14
mov rdx, rbx
call fcn.140157230
cmp byte [rsp + 0x77], 0
jns 0x1400956a7
mov rcx, qword [rsp + 0x60]
call fcn.140105bb4
lea rcx, [rsp + 0x78]
call fcn.140157180
test edi, edi
setne bl
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140095b20
Capabilities:
Create service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1c8
mov r15, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [rdx + 0x28]
xor esi, esi
cmp rax, qword [rdx + 0x30]
cmovne rsi, rax
cmp byte [rdx + 0x27], 0
jns 0x140095b62
mov r14, qword [rdx + 0x10]
jmp 0x140095b66
lea r14, [rdx + 0x10]
cmp byte [rdx + 0x57], 0
jns 0x140095b72
mov r12, qword [rdx + 0x40]
jmp 0x140095b76
lea r12, [rdx + 0x40]
mov edi, dword [rdx + 0xc]
mov r13d, dword [rdx + 4]
mov ebp, dword [rdx + 8]
lea rbx, [rsp + 0x80]
mov rcx, r15
mov rdx, rbx
call fcn.1400940a0
cmp byte [rbx + 0x17], 0
jns 0x140095ba1
mov rbx, qword [rsp + 0x80]
mov rcx, qword [r15 + 0xc8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x50], rsi
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r13d
mov rdx, rbx
mov r8, r12
mov r9d, 0x10003
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x140095bfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1400ed9a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rsp + 0x97], 0
jns 0x140095c12
mov rcx, qword [rsp + 0x80]
call fcn.140105bb4
test rdi, rdi
je 0x140095c66
call fcn.1400ed9a0
cmp qword [r15 + 0xd0], rdi
je 0x140095d02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp qword [r15 + 0xd0], 0
je 0x140095c4d
call fcn.1400ed9a0
mov rcx, qword [r15 + 0xd0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [r15 + 0xd0], rdi
call fcn.1400ed9a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140095d02
mov ecx, 1
call fcn.14004bc00
test al, al
je 0x140095d02
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_service_work_item_impl.cc
lea rcx, [rsp + 0x80]
mov r8d, 0x28a
mov r9d, 1
call fcn.140157100
lea rcx, [rsp + 0x90]
lea rdx, str.Failed_to_create_service
mov r8d, 0x19
call fcn.1400e7690
mov r14, rax
lea rbx, [rsp + 0x68]
mov rcx, r15
mov rdx, rbx
call fcn.1400940a0
cmp byte [rbx + 0x17], 0
jns 0x140095cd9
mov rbx, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rbx
call fcn.140157230
cmp byte [rsp + 0x7f], 0
jns 0x140095cf5
mov rcx, qword [rsp + 0x68]
call fcn.140105bb4
lea rcx, [rsp + 0x80]
call fcn.140157180
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
add rsp, 0x1c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140096b00
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14, rdx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [0x1402183e0]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov r8d, 6
call fcn.1400969e0
xor ebp, ebp
test eax, eax
je 0x140096b8b
lea rcx, [rsp + 0x20]
call fcn.140096760
movzx edi, byte [reloc.OLEAUT32.dll_VariantCopy]
cmp rax, rdi
jne 0x140096ba5
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140051e20
lea rsi, [0x140233a10]
test dil, dil
je 0x140096b81
lea rdx, [0x140233a14]
mov rcx, rax
mov r8, rbx
call fcn.140108d80
test eax, eax
jne 0x140096ba5
mov eax, dword [rsi]
mov dword [r14], eax
mov ebp, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140106490
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x20]
call fcn.140096760
movzx edi, byte [reloc.OLEAUT32.dll_VariantInit]
cmp rax, rdi
jne 0x140096bea
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140051e20
lea rsi, [0x140233ad8]
test dil, dil
je 0x140096b81
lea rdx, [0x140233adc]
mov rcx, rax
mov r8, rbx
call fcn.140108d80
test eax, eax
je 0x140096b81
lea rcx, [rsp + 0x20]
call fcn.140096760
movzx edi, byte [reloc.OLEAUT32.dll_VariantInit]
cmp rax, rdi
jne 0x140096c37
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140051e20
lea rsi, [0x140233ba0]
test dil, dil
je 0x140096b81
lea rdx, [0x140233ba4]
mov rcx, rax
mov r8, rbx
call fcn.140108d80
test eax, eax
je 0x140096b81
lea rcx, [rsp + 0x20]
call fcn.140096760
movzx edi, byte [0x140233c75]
cmp rax, rdi
jne 0x140096c84
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140051e20
lea rsi, [0x140233c68]
test dil, dil
je 0x140096b81
lea rdx, [0x140233c6c]
mov rcx, rax
mov r8, rbx
call fcn.140108d80
test eax, eax
je 0x140096b81
lea rcx, [rsp + 0x20]
call fcn.140096760
movzx edi, byte [0x140233d45]
cmp rax, rdi
jne 0x140096b8b
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140051e20
lea rsi, [0x140233d38]
test dil, dil
je 0x140096b81
lea rdx, [0x140233d3c]
mov rcx, rax
mov r8, rbx
call fcn.140108d80
test eax, eax
je 0x140096b81
jmp 0x140096b8b
Function at 0x140097b80
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x58], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1402183e0]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x140097bfa
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
mov edi, 0x80003
cmp eax, 6
jb 0x140097bff
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.1401aa9f0
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140097c01
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x140097c0a
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140106490
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x14009a480
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovb eax, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14009a4e8
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14009a4f1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140106490
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14009a4d1
int3
mov rcx, qword [rcx + 8]
jmp 0x14009a480

Function at 0x14009a500
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov ecx, 0xffffffff
cmp r8, rcx
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x14009a5a8
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14009a597
cmp eax, 0xffffffff
je 0x14009a5bc
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140106490
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x14009a546
mov eax, dword [rsp + 0x2c]
jmp 0x14009a577
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14009a579
int3