joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61a860
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
mov esi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xorps xmm0, xmm0
lea edi, [ebp - 0x2c]
movups xmmword [edi + 0x10], xmm0
movups xmmword [edi], xmm0
lea eax, [ebp - 0x30]
mov dword [eax], 0x10
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movsd qword [esi], xmm0
mov dword [esi + 8], 0
test eax, eax
je 0x61a8b2
push esi
push dword [ebp - 0x30]
push edi
call fcn.004b56c0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebp
ret

Function at 0x61aa40
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xcc
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x34], xmm0
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x61aa73
mov ecx, dword [edi]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x61ab0a
push edi
call fcn.004ad800
add esp, 4
movzx eax, al
xor eax, 5
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x61aaa0
mov ecx, dword [edi]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x61ab74
push 0x3a
push str.....chromeinstallerutildelete_after_reboot_helper.cc
call fcn.0055f480
add esp, 8
mov bl, 1
test eax, eax
jle 0x61ab5d
lea esi, [ebp - 0xd8]
mov ecx, esi
push 0xffffffffffffffff
push 0x64
push str.....chromeinstallerutildelete_after_reboot_helper.cc
call fcn.004ba430
lea eax, [ebp - 0xd0]
push 0x18
push str.Scheduled_for_deletion:
push eax
call fcn.00533f70
add esp, 0xc
push edi
push eax
call fcn.004b5750
add esp, 8
mov ecx, esi
call fcn.004ba910
jmp 0x61ab5d
push 1
call fcn.0055f440
add esp, 4
test al, al
je 0x61ab5b
call fcn.00642ea0
lea esi, [ebp - 0xd8]
mov ecx, esi
push eax
push 1
push 0x45
push str.....chromeinstallerutildelete_after_reboot_helper.cc
call fcn.00642eb0
lea eax, [ebp - 0xd0]
push edi
push eax
call fcn.004b5750
add esp, 8
push 0x10
push str._does_not_exist.
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, esi
call fcn.00642f10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xcc
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x61ab5b
call fcn.00642ea0
lea esi, [ebp - 0xd8]
mov ecx, esi
push eax
push 2
push 0x50
push str.....chromeinstallerutildelete_after_reboot_helper.cc
call fcn.00642eb0
lea eax, [ebp - 0xd0]
push 0x13
push str.Could_not_schedule
push eax
call fcn.00533f70
add esp, 0xc
push edi
push eax
call fcn.004b5750
add esp, 8
push 0xe
push str._for_deletion.
jmp 0x61ab4b
Function at 0x61f070
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x61f0e9
mov edi, ecx
lea esi, [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov bl, 1
test eax, eax
jne 0x61f0be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push 1
call fcn.0055f440
add esp, 4
test al, al
jne 0x61f0ed
cmp ebx, 0x430
sete bl
cmp dword [esi], 0
je 0x61f0d0
call fcn.0055fb70
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x61f0d0
call fcn.00642ea0
lea ecx, [ebp - 0xb4]
push eax
push 1
push 0x264
push str.....chromeinstallerutilinstall_service_work_item_impl.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x15
push str.DeleteService_failed
push eax
call fcn.00533f70
add esp, 0xc
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xc0]
mov ecx, edi
mov edi, eax
push eax
call fcn.0061eda0
mov eax, edi
cmp byte [edi + 0xb], 0
jns 0x61f144
mov eax, dword [ebp - 0xc0]
push eax
push dword [ebp - 0xc4]
call fcn.00641400
add esp, 8
cmp byte [ebp - 0xb5], 0
jns 0x61f16a
push dword [ebp - 0xc0]
call fcn.005c57c0
add esp, 4
lea ecx, [ebp - 0xb4]
call fcn.00642f10
jmp 0x61f0b5

Function at 0x61f910
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [ebp - 0xc4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x808040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movsx edx, byte [eax + 0x33]
test edx, edx
js 0x61f93d
lea ecx, [eax + 0x28]
jmp 0x61f943
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x28]
test edx, edx
cmove ecx, edx
mov edi, dword [eax + 0x1c]
xor edx, edx
cmp edi, dword [eax + 0x20]
cmove edi, edx
movsx esi, byte [eax + 0x1b]
test esi, esi
js 0x61f960
lea ebx, [eax + 0x10]
jmp 0x61f966
mov esi, dword [eax + 0x14]
mov ebx, dword [eax + 0x10]
test esi, esi
cmove ebx, esi
push ecx
push edx
push edx
push edi
push edx
push edx
push ebx
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
mov eax, dword [ebp - 0xc4]
push dword [eax + 0x98]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, eax
test eax, eax
jne 0x61f9a1
push 1
call fcn.0055f440
add esp, 4
test al, al
jne 0x61f9bf
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00642ea0
lea ecx, [ebp - 0xb4]
push eax
push 1
push 0x1a6
push str.....chromeinstallerutilinstall_service_work_item_impl.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x20
push str.Failed_to_change_service_config
push eax
call fcn.00533f70
add esp, 0xc
mov ebx, eax
lea esi, [ebp - 0xc0]
mov ecx, dword [ebp - 0xc4]
push esi
call fcn.0061eda0
cmp byte [esi + 0xb], 0
jns 0x61fa12
mov esi, dword [ebp - 0xc0]
push esi
push ebx
call fcn.00641400
add esp, 8
cmp byte [ebp - 0xb5], 0
jns 0x61fa33
push dword [ebp - 0xc0]
call fcn.005c57c0
add esp, 4
lea ecx, [ebp - 0xb4]
call fcn.00642f10
jmp 0x61f9a1
Function at 0x61fde0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xd0
mov dword [ebp - 0xc8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x808040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [eax + 0x1c]
xor ecx, ecx
cmp ebx, dword [eax + 0x20]
cmove ebx, ecx
cmp byte [eax + 0x1b], 0
js 0x61fe1d
lea ecx, [eax + 0x10]
jmp 0x61fe20
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0xd0], ecx
cmp byte [eax + 0x33], 0
js 0x61fe31
lea ecx, [eax + 0x28]
jmp 0x61fe34
mov ecx, dword [eax + 0x28]
mov dword [ebp - 0xcc], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xd8], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xdc], ecx
mov eax, dword [eax + 8]
mov dword [ebp - 0xd4], eax
lea edi, [ebp - 0xb8]
mov ecx, dword [ebp - 0xc8]
push edi
call fcn.0061eda0
cmp byte [edi + 0xb], 0
jns 0x61fe73
mov edi, dword [ebp - 0xb8]
xor esi, esi
push esi
push esi
push ebx
push esi
push esi
push dword [ebp - 0xd0]
push dword [ebp - 0xd8]
push dword [ebp - 0xd4]
push dword [ebp - 0xdc]
push 0x10003
push dword [ebp - 0xcc]
push edi
mov eax, dword [ebp - 0xc8]
push dword [eax + 0x94]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea ecx, [ebp - 0x14]
mov dword [ecx], esi
push eax
call fcn.00614cd0
cmp byte [ebp - 0xad], 0
jns 0x61fed2
push dword [ebp - 0xb8]
call fcn.005c57c0
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x61ff19
push 1
call fcn.0055f440
add esp, 4
test al, al
jne 0x61ff3b
cmp dword [ebp - 0x14], 0
je 0x61fefb
call fcn.0055fb70
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xd0
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebp - 0xc8]
add esi, 0x98
mov dword [ebp - 0x14], 0
call fcn.0055fb70
mov ecx, esi
push ebx
call fcn.00614cd0
jmp 0x61fee7
call fcn.00642ea0
lea ecx, [ebp - 0xb8]
push eax
push 1
push 0x255
push str.....chromeinstallerutilinstall_service_work_item_impl.cc
call fcn.00642eb0
lea eax, [ebp - 0xb0]
push 0x19
push str.Failed_to_create_service
push eax
call fcn.00533f70
add esp, 0xc
mov edi, eax
lea esi, [ebp - 0xc4]
mov ecx, dword [ebp - 0xc8]
push esi
call fcn.0061eda0
cmp byte [esi + 0xb], 0
jns 0x61ff8e
mov esi, dword [ebp - 0xc4]
push esi
push edi
call fcn.00641400
add esp, 8
cmp byte [ebp - 0xb9], 0
jns 0x61ffaf
push dword [ebp - 0xc4]
call fcn.005c57c0
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00642f10
jmp 0x61fee7
Function at 0x63d610
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 1
je 0x63d632
mov eax, dword [esi]
jmp 0x63d638
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x63d67e
mov bl, 1
cmp byte [ebp + 0xc], 0
je 0x63d668
cmp byte [esi + 4], 1
je 0x63d656
mov eax, dword [esi]
jmp 0x63d65c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 1
je 0x63d68e
mov eax, dword [esi]
jmp 0x63d694
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x63d6a8
xor ebx, ebx
jmp 0x63d668
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 1
je 0x63d6b9
mov eax, dword [esi]
jmp 0x63d6bf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
jmp 0x63d668

Function at 0x63d7e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.005c9b00
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
jne 0x63d819
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x63d822
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret
Function at 0x63d940
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xb
mov eax, dword [0x788e74]
mov al, byte [eax + 0xb]
test al, al
jne 0x63db69
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.004bd560
cmp byte [esi + 0xb], 0
mov dword [esp + 8], ebx
js 0x63da2f
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.0055ff40
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov edi, ebx
mov ecx, dword [esp + 8]
push esi
call fcn.00644de0
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], str.runas
cmp byte [esp + 0xa3], 0
js 0x63da45
lea ecx, [esp + 0x98]
jmp 0x63da4c
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.00534280
jmp 0x63d9c7
mov ecx, dword [esp + 0x98]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x63da64
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x63dae5
cmp byte [ebp + 0xc], 0
je 0x63dade
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9e
push str....._baseprocesslaunch_win.cc
push str.LaunchElevatedProcess
push esi
call fcn.0055fb40
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00552b00
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
call fcn.00552b70
mov esi, dword [esp + 0x88]
mov ecx, dword [esp + 0xc]
push esi
call fcn.004a95d0
cmp byte [esp + 0x97], 0
jns 0x63db08
push dword [esp + 0x8c]
call fcn.005c57c0
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x63db21
push dword [esp + 0x98]
call fcn.005c57c0
add esp, 4
mov dword [esp + 0x20], 0xb
mov eax, dword [0x788e74]
mov al, byte [eax + 0xb]
test al, al
jne 0x63db4b
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.005c6b46
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push edi
push ecx
push eax
call fcn.00543ca0
add esp, 0x10
jmp 0x63db35
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], str.LaunchElevatedProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.00543ca0
add esp, 0x10
jmp 0x63d97b
Function at 0x63f4f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 0xc]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x10]
push 0x3cb
push str....._base_files_file_util_win.cc
push 0x78bb32
push ebx
call fcn.0055fb40
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push ebx
call fcn.00552b00
mov dword [ebx], 0xffffffff
cmp byte [edi + 0xb], 0
jns 0x63f555
mov edi, dword [edi]
mov esi, dword [ebp + 8]
sub esp, 0x1c
xor ebx, ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x78ba10]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x8000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea edi, [esp + 0x10]
mov dword [edi], ebx
mov ecx, edi
push eax
call fcn.00536090
mov eax, dword [edi]
lea ecx, [eax + 1]
cmp ecx, 1
ja 0x63f5d2
xor ecx, ecx
mov byte [esi], cl
mov byte [esi + 8], cl
inc eax
cmp eax, 2
jb 0x63f5b4
call fcn.0055fb70
push dword [esp + 0x10]
call fcn.0054ae70
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00552b70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
test edx, edx
js 0x63f615
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
push 0
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x63f60e
mov eax, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], 0
mov al, 1
mov byte [esi + 8], al
mov eax, dword [esp + 0x10]
jmp 0x63f59d
mov byte [esi], 0
xor eax, eax
jmp 0x63f605
int3
Function at 0x63f640
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp], edx
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0x88
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push edi
call fcn.0055fb40
add esp, 0x10
mov ecx, ebx
push 0
mov ebx, edi
push edi
mov edi, esi
call fcn.00552b00
mov ecx, esi
call fcn.00562430
test al, al
jne 0x63f6c4
mov esi, dword [esp]
mov ecx, esi
call fcn.00562430
test al, al
jne 0x63f6c4
cmp byte [edi + 0xb], 0
jns 0x63f6f1
cmp dword [edi + 4], 0x103
jbe 0x63f6f1
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.00552b70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea ecx, [esp + 4]
call fcn.004d6da0
jmp 0x63f6c6
cmp byte [esi + 0xb], 0
jns 0x63f700
cmp dword [esi + 4], 0x103
ja 0x63f6c4
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi], eax
push 0x95
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, esi
mov esi, dword [esp]
push 0x80f3fc
push ebx
call fcn.004d6c90
cmp byte [esi + 0xb], 0
jns 0x63f73f
mov esi, dword [esi]
movzx eax, byte [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x63f74b
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x63f6e4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
sete cl
test al, 1
sete dl
or dl, cl
jne 0x63f6e6
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x63f6e6

Function at 0x63fce0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00562430
test al, al
jne 0x63fcfe
mov ecx, esi
call fcn.00562430
test al, al
je 0x63fd03
xor eax, eax
pop esi
pop ebp
ret
pop esi
pop ebp
jmp fcn.0063f790
Function at 0x642920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x80f4b0], 0
je 0x642958
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x80f4b4]
test esi, esi
jne 0x6429f8
push 0xc
call fcn.005c5789
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.005c9b00
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.00535d80
movsx eax, byte [esi + 0xb]
mov ecx, esi
test eax, eax
jns 0x6429bb
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
je 0x6429e4
add eax, eax
test eax, eax
je 0x6429e4
lea edx, [eax - 2]
cmp word [ecx + eax - 2], 0x5c
mov eax, edx
jne 0x6429c1
cmp edx, 0xfffffffe
je 0x6429e4
sar edx, 1
inc edx
mov ecx, esi
push 0xffffffffffffffff
push edx
call fcn.00535f10
mov ecx, esi
push 9
push str.debug.log
call fcn.0054a2f0
mov dword [0x80f4b4], esi
test byte [0x80a5bc], 1
je 0x642941
cmp byte [esi + 0xb], 0
jns 0x642a0d
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x78c710]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x80f4b0], eax
inc eax
cmp eax, 1
ja 0x642941
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.005c9b00
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x642b21
mov ecx, dword [0x80f4b4]
push esi
call fcn.004a50b0
mov ecx, dword [0x80f4b4]
movsx eax, byte [ecx + 0xb]
test eax, eax
js 0x642b28
test al, al
je 0x642b36
mov edx, ecx
cmp word [edx + eax*2 - 2], 0x5c
je 0x642ac7
push 1
push 0x77ac68
call fcn.0054a2f0
mov ecx, dword [0x80f4b4]
push 9
push str.debug.log
call fcn.0054a2f0
mov eax, dword [0x80f4b4]
cmp byte [eax + 0xb], 0
jns 0x642ae0
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x78c710]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x80f4b0], eax
inc eax
cmp eax, 1
ja 0x642941
mov dword [0x80f4b0], 0
xor ebx, ebx
jmp 0x642941
mov eax, dword [ecx + 4]
test eax, eax
je 0x642b36
mov edx, dword [ecx]
jmp 0x642aad
ud2
Function at 0x647860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp edx, eax
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebp - 0x14], edx
cmovb ebx, edx
xor eax, eax
test ebx, ebx
je 0x6478c5
xor esi, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov edx, dword [edi + esi*4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov ebx, ecx
xor ebx, edx
mov edi, ecx
sub edi, edx
lea edx, [ebx - 1]
xor edi, ecx
or edi, ebx
not ebx
and edx, ebx
mov ebx, dword [ebp - 0x1c]
xor edi, ecx
mov ecx, dword [ebp - 0x18]
sar edx, 0x1f
sar edi, 0x1f
or edi, 1
xor eax, edi
and eax, edx
xor eax, edi
mov edi, dword [ebp + 8]
inc esi
cmp ebx, esi
jne 0x64788a
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
cmp edx, esi
jb 0x6478d9
ja 0x6478f3
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
or ecx, dword [edi + edx*4]
inc edx
cmp esi, edx
jne 0x6478db
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
not ecx
or eax, ecx
jmp 0x6478d1
mov edx, ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
or esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], ecx
jne 0x6478f7
mov ecx, esi
not ecx
dec esi
and esi, ecx
sar esi, 0x1f
xor eax, 1
and eax, esi
xor eax, 1
jmp 0x6478d1

Function at 0x6479a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 4]
mov esi, dword [eax + 4]
xor edx, edx
cmp edi, esi
jge 0x6479c6
mov eax, dword [eax]
xor edx, edx
mov ebx, edi
or edx, dword [eax + ebx*4]
inc ebx
cmp esi, ebx
jne 0x6479be
cmp esi, edi
jge 0x6479d6
mov eax, dword [ecx]
mov ebx, esi
or edx, dword [eax + ebx*4]
inc ebx
cmp edi, ebx
jne 0x6479ce
cmp edi, esi
cmovl esi, edi
test esi, esi
jle 0x6479f5
mov edi, dword [ecx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
xor eax, eax
mov ecx, dword [ebx + eax*4]
xor ecx, dword [edi + eax*4]
or edx, ecx
inc eax
cmp esi, eax
jne 0x6479e8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x64ba10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x64bb26
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor esi, esi
xor eax, eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + ecx*4]
mov ecx, edx
shl ecx, 0x10
mov eax, ecx
not eax
dec ecx
and ecx, eax
sar ecx, 0x1f
mov dword [ebp - 0x24], ecx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, ecx
xor eax, edx
mov esi, eax
shl esi, 0x18
mov ecx, esi
dec esi
not ecx
and esi, ecx
mov ecx, eax
shr ecx, 8
sar esi, 0x1f
mov dword [ebp - 0x20], esi
xor ecx, eax
and ecx, esi
xor ecx, eax
mov eax, ecx
shl eax, 0x1c
mov esi, eax
not esi
dec eax
and eax, esi
sar eax, 0x1f
mov edi, ecx
shr edi, 4
mov esi, eax
xor edi, ecx
and edi, eax
xor edi, ecx
mov ecx, edi
shl ecx, 0x1e
mov eax, ecx
dec ecx
not eax
and ecx, eax
mov eax, edi
shr eax, 2
sar ecx, 0x1f
mov ebx, ecx
xor eax, edi
and eax, ecx
lea ecx, [edx - 1]
not edx
and ecx, edx
xor eax, edi
shl eax, 0x1f
mov edx, eax
not edx
dec eax
and eax, edx
mov edx, dword [ebp - 0x24]
and edx, 0x10
shr eax, 0x1f
or eax, edx
mov edx, dword [ebp - 0x20]
and edx, 8
or eax, edx
and esi, 4
or eax, esi
mov esi, dword [ebp - 0x28]
sar ecx, 0x1f
and ebx, 2
or eax, ebx
mov edx, ecx
not edx
mov edi, dword [ebp - 0x1c]
or ecx, edi
or edx, edi
add eax, esi
not ecx
and ecx, eax
mov eax, dword [ebp - 0x2c]
or eax, ecx
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 0x10]
add esi, 0x20
mov edi, edx
mov edx, dword [ebp - 0x10]
cmp ecx, edx
jne 0x64ba37
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x64bb1e