joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140184a60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x140184a92
call fcn.1401634ac
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140164b50
jmp 0x140184bb1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140184bb1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140184bb1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140184ac1
lock or dword [rcx + 0x14], 0x10
jmp 0x140184bb1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140184ad5
call fcn.1401868fc
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1401638a4
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140165848
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140184b9f
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x140184b6a
mov rcx, rsi
call fcn.1401638a4
cmp eax, edi
je 0x140184b55
mov rcx, rsi
call fcn.1401638a4
cmp eax, 0xfffffffe
je 0x140184b55
mov rcx, rsi
call fcn.1401638a4
movsxd rbx, eax
lea r14, [0x14023fc20]
mov rcx, rsi
sar rbx, 6
call fcn.1401638a4
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140184b5c
lea rdx, [0x14022f550]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140184b6a
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x140184b8e
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x140184b8e
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x140184b8e
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140184bb4
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x1401902e0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x28]
mov qword [rdi], rdx
mov rdx, rdi
call fcn.1400ef990
lea rdx, [rsi + 0xb0]
mov r8d, dword [rdi]
mov rcx, qword [rsi + 0x78]
mov qword [rsp + 0x20], rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140190338
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140190358
mov byte [rsi + 0xd1], 1
lock inc dword [rsi + 8]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014ced0
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
call fcn.1400490f0
jmp 0x140190343
Function at 0x1401915a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x458
mov rbx, r9
mov r14, r8
mov r15, rdx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x40], rcx
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rsi, [rsp + 0x50]
mov r8d, 0x400
mov rcx, rsi
mov dl, 0xaa
call fcn.14014fe30
mov qword [rsi - 8], rdi
mov rcx, r15
xor edx, edx
mov r8d, 0x60
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140191626
mov rcx, r15
xor edx, edx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1401916fb
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1401916ef
mov rbx, rax
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401916ef
mov r14, rax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, 0x8007000e
cmp eax, 0xffffffff
jne 0x1401916b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x48]
cmp rdi, rsi
jne 0x1401916a5
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebx
add rsp, 0x458
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x48]
call fcn.140191e30
jmp 0x140191682
mov r15d, eax
lea edx, [r15 + 1]
lea r12, [rsp + 0x48]
mov rcx, r12
call fcn.140191730
mov rax, qword [r12]
test rax, rax
je 0x14019166f
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 3
xor edx, edx
mov r8, r14
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140191709
call fcn.140191360
mov ebx, eax
jmp 0x14019166f
xor edi, edi
call fcn.140191360
mov ebx, eax
jmp 0x14019167d
mov r8d, dword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x48]
mov eax, eax
mov word [rcx + rax*2], 0
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140191770
jmp 0x1401916f4
Function at 0x140193ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140193c10
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x140193c6c
mov edi, dword [rsi + 0x5c]
test bl, bl
je 0x140193c4c
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014ced0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r14d, 1
cmovge r14d, eax
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
call fcn.14016e804
cmp eax, 0xffffffff
je 0x140193cee
mov byte [rsp + r15 + 0x58], al
inc r15
cmp r14, r15
jne 0x140193c8e
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x140193cf8
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test bl, bl
je 0x140193cca
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x140193c4c
mov edi, r14d
test rdi, rdi
jle 0x140193d9e
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.140175604
cmp eax, 0xffffffff
jne 0x140193ccd
mov edi, 0xffffffff
jmp 0x140193c4c
lea r15, [rsp + 0x48]
mov qword [r15], rdi
lea r12, [rsp + 0x40]
mov qword [r12], rdi
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx edi, word [rdx + 6]
lea r9, [rsp + r14 + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x57]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x58]
call qword [case.0x1401b58f0.0]
cmp eax, 1
jne 0x140193d87
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], di
cmp r14d, 8
je 0x140193cee
mov rcx, qword [rsi + 0x40]
call fcn.14016e804
cmp eax, 0xffffffff
je 0x140193cee
mov byte [rsp + r14 + 0x58], al
inc r14
jmp 0x140193d09
cmp eax, 2
je 0x140193cee
cmp eax, 3
je 0x140193cb4
jmp 0x140193cbc
movzx edi, byte [rsp + 0x57]
jmp 0x140193c4c
Function at 0x1401940c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1401941f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14019424c
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x14019422c
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014ced0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r14d, 1
cmovge r14d, eax
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
call fcn.14016e804
cmp eax, 0xffffffff
je 0x1401942d9
mov byte [rsp + r15 + 0x58], al
inc r15
cmp r14, r15
jne 0x14019426e
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1401942e2
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x1401942b2
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x14019422c
mov edi, r14d
test rdi, rdi
jle 0x140194388
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.140175604
cmp eax, 0xffffffff
jne 0x1401942b5
mov di, 0xffff
jmp 0x14019422c
lea r15, [rsp + 0x48]
mov qword [r15], rdi
lea r12, [rsp + 0x40]
mov qword [r12], rdi
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx edi, word [rdx + 6]
lea r9, [rsp + r14 + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x56]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x58]
call qword [case.0x1401b58f0.0]
cmp eax, 1
jne 0x140194371
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], di
cmp r14d, 8
je 0x1401942d9
mov rcx, qword [rsi + 0x40]
call fcn.14016e804
cmp eax, 0xffffffff
je 0x1401942d9
mov byte [rsp + r14 + 0x58], al
inc r14
jmp 0x1401942f3
cmp eax, 2
je 0x1401942d9
cmp eax, 3
je 0x140194296
jmp 0x1401942a0
movzx edi, word [rsp + 0x56]
jmp 0x14019422c

Function at 0x140194620
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140194657
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x140194631
ret

Function at 0x1401946c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1401946f8
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x1401946d1
ret
Function at 0x1401aa120
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.14014c3b0
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1401aa190]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140160004
mov qword [rbx], rax
test rax, rax
je 0x1401aa177
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1401ad600
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1400ffe70
test al, al
jne 0x1401ad621
mov rcx, rsi
call fcn.1400ffe70
test al, al
je 0x1401ad62a
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1401b3770
Function at 0x1401ad8c0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140242310], 0
je 0x1401ad906
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14014ced0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1402422e8]
test rdi, rdi
je 0x1401ad9a7
test byte [reloc.WS2_32.dll_accept], 1
je 0x1401ad8e9
cmp byte [rdi + 0x17], 0
jns 0x1401ad928
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140242310], rax
inc rax
cmp rax, 1
ja 0x1401ad8e9
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14014fe30
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401ada72
xor esi, esi
jmp 0x1401ad8e9
mov ecx, SafeArrayCopy
call fcn.14014c3b0
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.14014fe30
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x14020b860]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.140189970
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x1401ada0e
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
jmp 0x1401ada14
and eax, 0x7f
mov rcx, rdi
test rax, rax
jne 0x1401ada3a
lea rdx, [0x14021544c]
mov r8d, 9
mov rcx, rdi
call fcn.1400934a0
mov qword [0x1402422e8], rdi
jmp 0x1401ad916
lea r8, [rax + rax]
test r8, r8
je 0x1401ada19
lea rdx, [r8 - 2]
cmp word [rcx + r8 - 2], 0x5c
mov r8, rdx
jne 0x1401ada3e
cmp rdx, 0xfffffffffffffffe
je 0x1401ada19
sar rdx, 1
inc rdx
cmp rax, rdx
jb 0x1401adb39
mov rcx, rdi
call fcn.140192a70
jmp 0x1401ada19
mov rdi, qword [0x1402422e8]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140174394
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.1400930f0
mov rcx, qword [0x1402422e8]
call fcn.140091160
cmp word [rax], 0x5c
je 0x1401adabf
mov rcx, qword [0x1402422e8]
lea rdx, [0x14020ecb6]
mov r8d, 1
call fcn.1400934a0
mov rcx, qword [0x1402422e8]
lea rdx, [0x14021544c]
mov r8d, 9
call fcn.1400934a0
mov rcx, qword [0x1402422e8]
cmp byte [rcx + 0x17], 0
jns 0x1401adae8
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140242310], rax
inc rax
cmp rax, 1
ja 0x1401ad8e9
mov qword [0x140242310], 0
jmp 0x1401ad9a0
call fcn.1401663e0
int3
Function at 0x1401b2d50
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x50], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x18a
call fcn.140100410
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14010c8f0
mov al, byte [rsi + 0x17]
test al, al
jns 0x1401b2de0
cmp qword [rsi + 8], 0x103
ja 0x1401b2dfe
test al, al
jns 0x1401b2de7
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.14010c950
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14014ced0
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401b35c0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x50], r12
movaps xmm6, xmmword [0x14020b860]
movaps xmmword [r14 + 0x40], xmm6
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x7e
call fcn.140100410
xor ebp, ebp
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14010c8f0
mov rcx, rdi
call fcn.1400ffe70
test al, al
je 0x1401b3699
lea rcx, [rsp + 0x60]
call fcn.14010c950
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rsi
call fcn.1400ffe70
test al, al
je 0x1401b36a9
xor ebp, ebp
jmp 0x1401b3663
cmp byte [rdi + 0x17], 0
jns 0x1401b36b9
cmp qword [rdi + 8], 0x103
ja 0x1401b36a5
cmp byte [rsi + 0x17], 0
jns 0x1401b36c9
cmp qword [rsi + 8], 0x103
ja 0x1401b36a5
lea r14, [rsp + 0x40]
mov qword [r14 + 0x10], r12
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x8b
call fcn.140100410
lea r8, [0x140243d3c]
mov rcx, r14
mov rdx, r15
call fcn.1400cc790
cmp byte [rsi + 0x17], 0
jns 0x1401b3712
mov rsi, qword [rsi]
movzx r8d, bl
cmp byte [rdi + 0x17], 0
jns 0x1401b371f
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1401b376a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x1401b3754
mov eax, edi
and eax, 1
je 0x1401b3754
mov edx, edi
and edx, 0xfffffffe
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bpl
lea rcx, [rsp + 0x40]
call fcn.1400cc890
jmp 0x1401b3663
xor ebp, ebp
jmp 0x1401b375b
Function at 0x1401b3770
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.MoveUnsafe
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x438
call fcn.140100410
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14010c8f0
mov al, byte [rdi + 0x17]
test al, al
jns 0x1401b3837
cmp qword [rdi + 8], 0x103
jbe 0x1401b3837
lea rcx, [rsp + 0x40]
call fcn.14010c950
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov cl, byte [rsi + 0x17]
test cl, cl
jns 0x1401b384c
cmp qword [rsi + 8], 0x103
jbe 0x1401b384c
xor ebx, ebx
jmp 0x1401b380b
mov rdx, rsi
test cl, cl
jns 0x1401b3856
mov rdx, qword [rsi]
mov rcx, rdi
test al, al
jns 0x1401b3860
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x1401b380b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
call fcn.1400aa960
test al, al
jne 0x1401b3890
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1401b3848
mov rcx, rdi
mov rdx, rsi
call fcn.1401b38b0
test al, al
jne 0x1401b380b
jmp 0x1401b3886
Function at 0x1401b4920
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.14014fe30
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x1401b4962
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1401b4956

Function at 0x1401b4a40
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1401b4abf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1401b4ac4
test bl, bl
je 0x1401b4a9b
cmp byte [rdi + 8], 0
je 0x1401b4b20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
call fcn.1400ad1a0
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014ced0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x1401b4a6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x1401b4aec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1401b4af1
xor esi, esi
jmp 0x1401b4aa8
mov rcx, qword [rdi]
jmp 0x1401b4ad9
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x1401b4b28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1401b4a9b
mov esi, dword [rsp + 0x24]
jmp 0x1401b4a9b
mov rcx, qword [rdi]
jmp 0x1401b4a90
mov rcx, qword [rdi]
jmp 0x1401b4b08

Function at 0x1401b5a20
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
add rsp, 0x38
ret

Function at 0x1401b5a50
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret
Function at 0x1401bac80
Capabilities:
Create process on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x50], r14
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PinShortcutToTaskbar
lea r8, str.....operadesktopchrome_importschromeinstallerutil_taskbar_util.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x7f
call fcn.140100410
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14010c8f0
call fcn.140113180
cmp eax, 0xd
jl 0x1401bad90
lea rdi, [rsp + 0x30]
mov qword [rdi], r14
mov rcx, rdi
call fcn.1400bcf30
cmp qword [rdi], 0
je 0x1401badf0
cmp byte [rsi + 0x17], 0
jns 0x1401bad2e
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov rdi, rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
mov r8, rdi
mov r9d, 4
call qword [case.0x1401b58f0.0]
test eax, eax
setns sil
test rdi, rdi
je 0x1401bad6e
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ILFree]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401badc7
mov qword [rsp + 0x30], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1401b58f0.0]
jmp 0x1401badc7
cmp byte [rsi + 0x17], 0
jns 0x1401bad99
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x21
setge sil
lea rcx, [rsp + 0x50]
call fcn.14010c950
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14014ced0
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor esi, esi
jmp 0x1401badc7