joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400df3bc
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsx rax, byte [r8 + 0x17]
test rax, rax
jns 0x1400df3f0
mov rax, qword [rsi + 8]
test rax, rax
je 0x1400df404
bt ebx, 8
jae 0x1400df423
mov eax, ebx
and eax, 0x200
je 0x1400df423
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140092da0
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp edi, 2
lea rax, [0x140193f50]
lea rcx, [0x140194150]
cmove rcx, rax
cmp word [rcx], 0
jne 0x1400df404
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x1400df404
bt ebx, 8
jb 0x1400df404
shr ebx, 9
and ebx, 1
or bl, byte [0x140194550]
je 0x1400df404
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movsx rbp, byte [rsi + 0x17]
test rbp, rbp
js 0x1400df4be
mov rdi, rsi
mov ebx, 1
xor r14d, r14d
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 0
jmp 0x1400df505
mov rdi, qword [rsi]
mov rbp, qword [rsi + 8]
jmp 0x1400df49a
cmp dword [rsp + 0x2c], 0
je 0x1400df404
jmp 0x1400df58a
mov rdx, rcx
mov rbx, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
mov rbp, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rax
xor r14d, r14d
mov rdi, rdx
jmp 0x1400df500
add r12, 0x28
inc r14
cmp r14, rbx
jae 0x1400df4c7
mov r15, qword [r12 + 8]
mov r13, rbp
sub r13, r15
jb 0x1400df4f9
mov rdx, qword [r12]
mov rcx, rdi
mov r8, r15
call fcn.1400aa600
test eax, eax
jne 0x1400df4f9
movzx edx, word [rdi + r15*2]
cmp edx, 0x5c
je 0x1400df533
test edx, edx
jne 0x1400df4f9
lea rcx, [rdi + r15*2]
mov r8d, dword [r12 + 0x10]
lea rax, str.WOW6432Node_
cmp r8d, 1
je 0x1400df565
cmp r8d, 2
je 0x1400df55b
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x1400df565
mov rdi, rcx
lea rax, str.WOW6432Node
cmp dx, 0x5c
mov dword [rsp + 0x2c], r8d
jne 0x1400df4d7
lea rdx, [rcx + 2]
dec r13
cmp word [rcx + 2], 0x5c
mov rcx, rdx
je 0x1400df574
jmp 0x1400df4da
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x1400df596
mov rax, qword [rsi]
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1400df5c9
mov rbx, qword [rsp + 0x30]
sub rbx, rax
sar rbx, 1
mov rcx, rdi
call fcn.1400aef34
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
mov r9, rax
call fcn.14005ef92
jmp 0x1400df404
ud2
Function at 0x1400df5cb
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov r15, rdx
mov rbx, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x140193f40], 0
je 0x1400df655
xorps xmm0, xmm0
lea r14, [rsp + 0x50]
movaps xmmword [r14], xmm0
mov rcx, r14
mov rdx, r15
call sub.ntdll.dll_RtlInitUnicodeString
lea r13, [rsp + 0x4c]
mov dword [r13], 0x18
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x30]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x140152e90]
movaps xmmword [r15], xmm0
mov edx, 0x18
mov rcx, r15
call fcn.140035bf8
mov ebp, 5
jmp 0x1400df6a5
call fcn.14007b00a
test al, al
jne 0x1400df5ff
xor esi, esi
jmp 0x1400df73c
mov rcx, r15
call fcn.14002fe5e
mov r12, qword [rsp + 0x30]
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
mov rcx, rbx
mov rdx, r14
mov r8d, 1
mov r9, r12
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x1400df6a1
cmp eax, 0x80000005
jne 0x1400df6e0
dec ebp
je 0x1400df713
mov eax, dword [rsp + 0x4c]
mov r12, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8, rcx
sub r8, r12
mov rdx, rax
sub rdx, r8
ja 0x1400df665
jae 0x1400df676
lea rdx, [r12 + rax]
mov r8, rcx
sub r8, rdx
dec rcx
cmp r8, rcx
ja 0x1400df772
mov qword [rsp + 0x38], rdx
jmp 0x1400df676
test eax, eax
js 0x1400df713
mov eax, dword [r12 + 4]
mov dword [rdi], eax
mov r9d, dword [r12 + 0xc]
test r9, r9
jne 0x1400df75c
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, rcx
sub rdx, rax
dec rcx
cmp rdx, rcx
ja 0x1400df772
mov qword [rsi + 8], rax
mov sil, 1
jmp 0x1400df715
xor esi, esi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400df73c
mov rax, qword [rsp + 0x38]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x1400df772
mov qword [rsp + 0x38], rcx
call fcn.1400918bc
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140092da0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [r12 + 8]
add rdx, r12
lea r8, [rdx + r9]
mov rcx, rsi
call fcn.1400c67a8
jmp 0x1400df70e
ud2
Function at 0x1401057c0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 1
je 0x1401057e9
mov rcx, qword [rsi]
jmp 0x1401057f2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14010583b
mov dil, 1
test bl, bl
je 0x140105824
cmp byte [rsi + 8], 1
je 0x140105810
mov rcx, qword [rsi]
jmp 0x140105819
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140092da0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 1
jne 0x140105852
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140105855
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140105868
xor edi, edi
jmp 0x140105824
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 1
jne 0x140105881
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140105884
mov rcx, qword [rsi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x140105824
Function at 0x1401058d0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
movaps xmmword [rsp + 0x130], xmm6
mov ebx, r9d
mov edi, r8d
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x40], 0xd
mov rax, qword [0x140161200]
mov al, byte [rax + 0xd]
test al, al
jne 0x140105b7a
movabs r13, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x120], r13
movaps xmm6, xmmword [0x140152e90]
movaps xmmword [rsp + 0x110], xmm6
lea r15, [rsp + 0x80]
mov rcx, r14
mov rdx, r15
call fcn.140067e30
cmp byte [r15 + 0x17], 0
js 0x140105a01
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x120], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x110], xmm0
lea r12, [rsp + 0x80]
mov rcx, r12
call fcn.140048c00
lea r15, [rsp + 0xf0]
mov qword [r15 + 0x10], r13
movaps xmmword [r15], xmm6
mov rcx, r14
mov rdx, r15
call fcn.140109820
xorps xmm0, xmm0
movups xmmword [r12 + 0x60], xmm0
movups xmmword [r12 + 0x50], xmm0
movups xmmword [r12 + 0x40], xmm0
movups xmmword [r12 + 0x30], xmm0
movabs rax, 0x4000000070
mov qword [r12], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [r12 + 8], rax
lea rax, str.runas
mov qword [r12 + 0x10], rax
cmp byte [rsp + 0x127], 0
js 0x140105a23
lea rax, [rsp + 0x110]
jmp 0x140105a2b
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.140021762
jmp 0x140105982
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x98], rax
cmp byte [rsp + 0x107], 0
jns 0x140105a45
mov r15, qword [rsp + 0xf0]
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x20], r15
xor r14d, r14d
mov qword [rcx + 0x28], r14
xor dil, 1
movzx eax, dil
mov dword [rcx + 0x30], eax
mov qword [rcx + 0x38], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140105adb
test bl, bl
je 0x140105ad3
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.LaunchElevatedProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0xbc
call fcn.140048970
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14004c0e0
mov rcx, qword [rsp + 0xe8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call fcn.14004c160
mov r14, qword [rsp + 0xe8]
mov rcx, rsi
mov rdx, r14
call fcn.14008f720
cmp byte [rsp + 0x107], 0
jns 0x140105afd
mov rcx, qword [rsp + 0xf0]
call fcn.1400918bc
cmp byte [rsp + 0x127], 0
jns 0x140105b14
mov rcx, qword [rsp + 0x110]
call fcn.1400918bc
mov qword [rsp + 0x40], 0xd
mov rax, qword [0x140161200]
mov al, byte [rax + 0xd]
test al, al
jne 0x140105b56
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.140092da0
movaps xmm6, xmmword [rsp + 0x130]
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, al
lea r8, [rsp + 0x80]
mov qword [r8], 0
lea rdx, [rsp + 0x40]
mov r9d, 2
call fcn.140038e20
jmp 0x140105b2b
movzx ecx, al
lea rax, str.LaunchElevatedProcess
lea r8, [rsp + 0x80]
mov qword [r8], rax
lea rdx, [rsp + 0x40]
mov r9d, 1
call fcn.140038e20
jmp 0x140105923
Function at 0x140105eb0
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x140152e90]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x237
call fcn.140048970
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14004c0e0
mov al, byte [rsi + 0x17]
test al, al
jns 0x140105f2e
cmp qword [rsi + 8], 0x103
ja 0x140105f4c
test al, al
jns 0x140105f35
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.14004c160
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140092da0
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140106740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x140152e90]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x2ea
call fcn.140048970
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14004c0e0
cmp byte [rdi + 0x17], 0
jns 0x1401067c2
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14010684e
test al, 0x10
cmove esi, ebp
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, esi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.14002f1c8
mov rax, qword [rbx]
inc rax
test rax, 0xfffffffffffffffe
setne bl
cmp rax, 2
jb 0x14010684e
call fcn.140048990
mov rcx, qword [rsp + 0x40]
call fcn.14003f970
lea rcx, [rsp + 0x60]
call fcn.14004c160
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140092da0
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401077f0
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x860
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x858], rax
mov rdx, qword [0x140192ef8]
test rdx, rdx
setne al
and al, byte [0x1401834b8]
cmp al, 1
jne 0x1401079dd
cmp byte [rdx + 0x17], 0
jns 0x14010783a
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
je 0x140107a08
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140048990
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x140152e90]
movaps xmmword [r14], xmm0
lea rbx, [rsp + 0x80]
mov rdx, rbx
call fcn.14002fdbe
lea r15, [rsp + 0x48]
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.140042700
mov eax, dword [rsi + 8]
test eax, eax
je 0x140107920
cmp eax, 1
je 0x140107926
mov bp, 1
add eax, 0xfffffffe
cmp eax, 2
jae 0x14010792a
lea r12, [rsp + 0x80]
mov r8d, 0x7d8
mov rcx, r12
mov dl, 0xaa
call fcn.1400c5230
mov rcx, r12
call fcn.140079020
mov rcx, r12
mov rdx, r15
call fcn.140123300
movsx r8, byte [rsp + 0x5f]
test r8, r8
jns 0x140107900
mov r8, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.1401035f6
cmp byte [rsp + 0x5f], 0
jns 0x14010792a
mov rcx, qword [rsp + 0x48]
call fcn.1400918bc
jmp 0x14010792a
mov bp, 4
jmp 0x14010792a
mov bp, 2
cmp byte [rsp + 0x77], 0
jns 0x140107936
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x48], 0
mov rcx, qword [0x140192f08]
cmp byte [rcx + 0x17], 0
jns 0x140107957
mov rcx, qword [rcx]
lea rdx, [rsp + 0x48]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x140107a3b
mov rax, qword [rsp + 0x48]
mov r9d, dword [0x140192f04]
movzx r8d, word [0x140192f00]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x140107a20
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401079be
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [rsp + 0x77], 0
jns 0x1401079cf
mov rcx, qword [rsp + 0x60]
call fcn.1400918bc
call fcn.140048990
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140066910
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.140092da0
nop
add rsp, 0x860
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.14002ed31
jmp 0x1401079dd
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.14002ed31
jmp 0x1401079ae
lea rcx, [rsi + 0x10]
lea rdx, str.___ERROR_GETTING_USER_SID__
mov r8d, 0x1b
call fcn.14002ed31
jmp 0x140107969
Function at 0x14010ea30
Capabilities:
Get session information

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x178], rax
call fcn.14010ec96
test al, al
je 0x14010eb05
mov qword [rsi], 0
mov rcx, rsi
mov rdx, 0xfffffffffffffffc
call fcn.14002f1c8
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140092da0
mov rax, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.....chromeinstallerutilinstall_util.cc
mov edx, 0x2c
call fcn.140047cb0
test eax, eax
jle 0x14010eaec
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x1f5
mov r9d, 0xffffffff
call fcn.1400664d0
lea rcx, [rsp + 0x40]
lea rdx, str.GetActiveUserToken_found_no_active_sessions.
mov r8d, 0x2c
call fcn.14002ed31
mov rcx, rdi
call fcn.140066910
mov rcx, qword [rsp + 0x168]
call sub.WTSAPI32.dll_WTSFreeMemory
mov qword [rsi], 0
jmp 0x14010ea76
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov edi, eax
lea eax, [rdi + 1]
cmp eax, 2
jb 0x14010eb5b
lea r9, [rsp + 0x30]
mov qword [r9], 0
lea rax, [rsp + 0x168]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, edi
mov r8d, 8
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x14010eb5b
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rcx]
call sub.WTSAPI32.dll_WTSFreeMemory
test ebx, ebx
je 0x14010ec74
lea rax, [rsp + 0x174]
mov dword [rax], 0
lea r9, [rsp + 0x168]
mov qword [r9], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
xor edx, edx
mov r8d, 1
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x14010ebb8
mov eax, dword [rsp + 0x174]
test eax, eax
je 0x14010ea98
mov ebx, 0x10
movabs r14, 0xaaaaaaaaaaaaaaaa
xor r15d, r15d
lea rdi, [rsp + 0x30]
jmp 0x14010ec30
mov ecx, 1
call fcn.140047c80
test al, al
je 0x14010eaf9
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x1e4
mov r9d, 1
call fcn.140066c80
lea rcx, [rsp + 0x40]
lea rdx, str.GetActiveUserToken_failed_to_enumerate_sessions._Assume_no_active_sessions.
mov r8d, 0x4b
call fcn.14002ed31
mov rcx, rdi
call fcn.140066cf0
jmp 0x14010eaf9
mov eax, dword [rsp + 0x174]
inc r15
mov ecx, eax
add rbx, 0x18
cmp r15, rcx
jae 0x14010ea98
mov rcx, qword [rsp + 0x168]
cmp dword [rcx + rbx], 0
jne 0x14010ec1e
mov qword [rsp + 0x30], r14
mov ecx, dword [rcx + rbx - 0x10]
mov rdx, rdi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x14010ec17
mov rcx, qword [rsp + 0x168]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rdx, qword [rsp + 0x30]
mov qword [rsi], 0
mov rcx, rsi
jmp 0x14010ea71
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov ecx, edi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x14010ec60
jmp 0x14010eb5b
Function at 0x14010ec96
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x1c0
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
lea r9, [rsp + 0x16c]
mov dword [r9], 0x44
xorps xmm0, xmm0
lea r8, [rsp + 0x170]
movaps xmmword [r8 + 0x30], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov dword [r8 + 0x40], 0
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x14010ed21
lea r8, [rsp + 0x2c]
mov dword [r8], 0
lea rdx, [rsp + 0x170]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x14010ed94
cmp dword [rsp + 0x2c], 0
setne sil
jmp 0x14010ed79
mov ecx, 2
call fcn.140047c80
test al, al
je 0x14010ed77
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21a
mov r9d, 2
call fcn.140066c80
lea rcx, [rsp + 0x40]
lea rdx, str.Failed_to_create_well_known_SID
mov r8d, 0x1f
call fcn.14002ed31
mov rcx, rsi
call fcn.140066cf0
xor esi, esi
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140092da0
mov eax, esi
add rsp, 0x1c0
pop rsi
ret
mov ecx, 2
call fcn.140047c80
test al, al
je 0x14010ed77
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x220
mov r9d, 2
call fcn.140066c80
lea rcx, [rsp + 0x40]
lea rdx, str.Failed_to_check_token_membership_for_WinInteractiveSid
mov r8d, 0x36
jmp 0x14010ed6a
Function at 0x14010f580
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010f5b0
cmp rbx, 2
jb 0x14010f698
lea r14, [rdi + 0x80]
mov r15d, 1
movdqa xmm6, xmmword [0x140169550]
movdqa xmm7, xmmword [0x140169560]
movdqa xmm8, xmmword [0x140169570]
movdqa xmm9, xmmword [0x140169580]
mov rcx, rsi
call fcn.14011f500
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm0
pand xmm1, xmm6
pshufd xmm2, xmm0, 0x39
pand xmm2, xmm7
por xmm2, xmm1
pshufd xmm1, xmm0, 0x4e
pand xmm0, xmm8
movdqa xmm3, xmm0
pslldq xmm3, 4
psrldq xmm0, 0xc
por xmm0, xmm3
pand xmm1, xmm9
por xmm1, xmm0
por xmm1, xmm2
movdqa xmmword [rsi + rax], xmm1
add rax, 0x10
cmp rax, 0x80
jne 0x14010f60e
mov rcx, rsi
call fcn.14011f9e0
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010f66c
inc r15
sub r14, 0xffffffffffffff80
cmp r15, rbx
jne 0x14010f604
mov rcx, rsi
call fcn.14011f500
xor eax, eax
movdqa xmm0, xmmword [0x140169550]
movdqa xmm1, xmmword [0x140169560]
movdqa xmm2, xmmword [0x140169570]
movdqa xmm3, xmmword [0x140169580]
movdqa xmm4, xmmword [rsi + rax]
movdqa xmm5, xmm4
pand xmm5, xmm0
pshufd xmm6, xmm4, 0x39
pand xmm6, xmm1
por xmm6, xmm5
pshufd xmm5, xmm4, 0x4e
pand xmm4, xmm2
movdqa xmm7, xmm4
pslldq xmm7, 4
psrldq xmm4, 0xc
por xmm4, xmm7
pand xmm5, xmm3
por xmm5, xmm4
por xmm5, xmm6
movdqa xmmword [rsi + rax], xmm5
add rax, 0x10
cmp rax, 0x80
jne 0x14010f6c2
shl rbx, 7
add rdi, rbx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010f71d
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret