joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e35b0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov sil, 1
cmp qword [0x1401be0c0], 0
je 0x1400e35f4
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400a7ab0
mov eax, esi
add rsp, 0x258
pop rdi
pop rsi
ret
mov rcx, qword [0x1401be0c8]
test rcx, rcx
je 0x1400e3692
test byte [0x1401ae70c], 1
je 0x1400e35d8
cmp byte [rcx + 0x17], 0
jns 0x1400e3616
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401be0c0], rax
inc rax
cmp rax, 1
ja 0x1400e35d8
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400dd020
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1400e3772
xor esi, esi
jmp 0x1400e35d8
mov ecx, 0x18
call fcn.1400a6590
mov rsi, rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400dd020
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x140178510]
movups xmmword [rsi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
mov rcx, rsi
mov rdx, rdi
call fcn.140063800
movsx rcx, byte [rsi + 0x17]
test rcx, rcx
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
mov r9, rcx
cmovs r9, r8
mov r10, rsi
cmovs r10, rax
test r9, r9
jne 0x1400e372f
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rsi
call fcn.14003f5ee
mov qword [0x1401be0c8], 0
jmp 0x1400e368b
add r9, r9
test r9, r9
je 0x1400e370a
lea rdx, [r9 - 2]
cmp word [r10 + r9 - 2], 0x5c
mov r9, rdx
jne 0x1400e3732
cmp rdx, 0xfffffffffffffffe
je 0x1400e370a
sar rdx, 1
lea r9, [rdx + 1]
test cl, cl
jns 0x1400e383c
cmp r8, rdx
jbe 0x1400e3870
mov qword [rsi + 8], r9
mov word [rax + rdx*2 + 2], 0
jmp 0x1400e370a
mov rcx, qword [0x1401be0c8]
lea rdx, [rsp + 0x40]
call fcn.140067dcc
mov rcx, qword [0x1401be0c8]
movsx rax, byte [rcx + 0x17]
test rax, rax
jns 0x1400e3851
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400e385d
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1400e37c9
lea rdx, [0x14017fa20]
mov r8d, 1
call fcn.14003f5ee
mov rcx, qword [0x1401be0c8]
lea rdx, str.debug.log
mov r8d, 9
call fcn.14003f5ee
mov rcx, qword [0x1401be0c8]
cmp byte [rcx + 0x17], 0
jns 0x1400e37eb
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401be0c0], rax
inc rax
cmp rax, 1
ja 0x1400e35d8
mov qword [0x1401be0c0], 0
jmp 0x1400e368b
cmp rdx, rcx
jae 0x1400e3870
and r9b, 0x7f
mov byte [rsi + 0x17], r9b
mov rax, rsi
jmp 0x1400e3769
test al, al
je 0x1400e385d
mov rdx, rcx
jmp 0x1400e37a8
lea rcx, [0x14017b0a5]
lea rdx, str....._third_partylibc_srcinclude_string:1339:_assertion__empty___failed:_string::back__:_string_is_empty_n
call fcn.1400ef50b
mov rcx, rsi
call fcn.1400ec536
int3
Function at 0x1400e7d50
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x1400e7dc7
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x1401ae958], rax
jne 0x1400e7dca
mov rsi, rcx
call fcn.14005cb10
mov edx, 0x568
mov rcx, rax
xor r8d, r8d
call fcn.1400218a0
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.14008f340
mov ecx, dword [0x1401bf7dc]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1401bad70]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x168], rdi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
int3
int3
Function at 0x1400ef5dc
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 2
call sym.elevation_service.exe_OQS_CPU_has_extension
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
test eax, eax
je 0x1400ef619
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400f735b
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400efbcc
sub rsp, 0x28
mov rax, r8
mov r8, rdx
mov rdx, rcx
shr r8, 4
mov dword [rsp + 0x20], 0xe
mov rcx, r9
mov r9, rax
call fcn.1400efa99
nop
add rsp, 0x28
ret
cmp rdx, 0x10
jb 0x1400f73f1
shr rdx, 4
xor eax, eax
vmovdqa xmm0, xmmword [r8]
vpxor xmm0, xmm0, xmmword [rcx + rax]
vaesenc xmm0, xmm0, xmmword [r8 + 0x10]
vaesenc xmm0, xmm0, xmmword [r8 + 0x20]
vaesenc xmm0, xmm0, xmmword [r8 + 0x30]
vaesenc xmm0, xmm0, xmmword [r8 + 0x40]
vaesenc xmm0, xmm0, xmmword [r8 + 0x50]
vaesenc xmm0, xmm0, xmmword [r8 + 0x60]
vaesenc xmm0, xmm0, xmmword [r8 + 0x70]
vaesenc xmm0, xmm0, xmmword [r8 + 0x80]
vaesenc xmm0, xmm0, xmmword [r8 + 0x90]
vaesenc xmm0, xmm0, xmmword [r8 + 0xa0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xb0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xc0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xd0]
vaesenclast xmm0, xmm0, xmmword [r8 + 0xe0]
vmovdqu xmmword [r9 + rax], xmm0
add rax, 0x10
dec rdx
jne 0x1400f736b
ret
Function at 0x1400f0770
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400f079a
xor eax, eax
xor r9d, r9d
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1400f077a
movzx eax, r9b
neg eax
shr eax, 8
and eax, 1
ret
xor eax, eax
jmp 0x1400f0791

Function at 0x1400f0990
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0x50], rax
vmovups ymm0, ymmword [rcx]
vmovups ymm1, ymmword [rcx + 0x10]
vmovups ymmword [rsp + 0x30], ymm1
vmovups ymmword [rsp + 0x20], ymm0
test rdx, rdx
jne 0x1400f09fb
vxorps xmm0, xmm0, xmm0
vmovups ymmword [0x1401bc460], ymm0
vmovups ymmword [0x1401bc450], ymm0
lea rcx, [rsp + 0x20]
vzeroupper
call fcn.1400f0a0f
mov dword [0x1401bc480], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a7ab0
nop
add rsp, 0x58
ret
xor eax, eax
mov cl, byte [rdx + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x30
jne 0x1400f09fd
jmp 0x1400f09bd

Function at 0x1400f0a0f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0x60], rax
vpbroadcastb ymm0, byte [0x14017d221]
vmovdqu ymmword [rsp + 0x40], ymm0
vmovdqu ymmword [rsp + 0x30], ymm0
xor r12d, r12d
lea rdi, [0x1401bc450]
lea rbx, [rsp + 0x28]
lea r14, [0x1401bc470]
jmp 0x1400f0aad
inc cl
mov byte [rax + rdi + 0x20], cl
mov rax, r12
shl rax, 4
lea r15, [rsp + rax]
add r15, 0x30
mov qword [rsp + 0x28], 0
mov rcx, rdi
mov rdx, rbx
vzeroupper
call fcn.1400ef50e
mov edx, 0x10
mov rcx, r14
mov r8, rdi
mov r9, r15
call fcn.1400ef573
mov rcx, qword [rsp + 0x28]
call fcn.1400ef545
inc r12
cmp r12, 3
je 0x1400f0ac9
mov eax, 0xf
mov eax, eax
mov cl, byte [rax + rdi + 0x20]
cmp cl, 0xff
jne 0x1400f0a5b
mov byte [rax + rdi + 0x20], 0
add eax, 0xffffffff
jb 0x1400f0ab2
jmp 0x1400f0a61
test rsi, rsi
je 0x1400f0ae0
xor eax, eax
mov cl, byte [rsi + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x30
jne 0x1400f0ad0
vmovups ymm0, ymmword [rsp + 0x30]
vmovups ymmword [0x1401bc450], ymm0
vmovaps xmm0, xmmword [rsp + 0x50]
vmovups xmmword [0x1401bc470], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
vzeroupper
call fcn.1400a7ab0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400f8991
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400f89b7
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1400f899b
xor eax, eax
test r9b, r9b
setne al
ret
xor eax, eax
ret

Function at 0x1400f89ba
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400f89e1
neg r9b
xor eax, eax
mov r10b, byte [rcx + rax]
mov r11b, byte [rdx + rax]
xor r11b, r10b
and r11b, r9b
xor r11b, r10b
mov byte [rcx + rax], r11b
inc rax
cmp r8, rax
jne 0x1400f89c4
ret
Function at 0x14011bee0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14011bf51
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14011bf5b
mov dil, 1
test bl, bl
je 0x14011bf3a
cmp byte [rsi + 8], 0
je 0x14011bf56
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a7ab0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x14011bf0d
mov rcx, qword [rsi]
jmp 0x14011bf2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x14011bf83
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14011bf88
xor edi, edi
jmp 0x14011bf3a
mov rcx, qword [rsi]
jmp 0x14011bf70
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x14011bfaf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x14011bf3a
mov rcx, qword [rsi]
jmp 0x14011bf9f
Function at 0x14011c5a0
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x140178510]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x235
call fcn.14004aca0
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14004ee00
mov al, byte [rsi + 0x17]
test al, al
jns 0x14011c61e
cmp qword [rsi + 8], 0x103
ja 0x14011c63c
test al, al
jns 0x14011c625
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.14004ee60
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a7ab0
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14011ce00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x140178510]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x2e8
call fcn.14004aca0
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14004ee00
cmp byte [rdi + 0x17], 0
jns 0x14011ce82
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14011cf0e
test al, 0x10
cmove esi, ebp
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, esi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.140029f80
mov rax, qword [rbx]
inc rax
test rax, 0xfffffffffffffffe
setne bl
cmp rax, 2
jb 0x14011cf0e
call fcn.14004acc0
mov rcx, qword [rsp + 0x40]
call fcn.140041e90
lea rcx, [rsp + 0x60]
call fcn.14004ee60
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400a7ab0
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14011e240
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x860
mov rsi, rcx
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0x858], rax
cmp byte [0x1401ae708], 0
je 0x14011e433
mov rdx, qword [0x1401be048]
test rdx, rdx
je 0x14011e433
cmp byte [rdx + 0x17], 0
jns 0x14011e28c
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
je 0x14011e45e
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14004acc0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x140178510]
movaps xmmword [r14], xmm0
lea rbx, [rsp + 0x80]
mov rdx, rbx
call fcn.14002a936
lea r15, [rsp + 0x48]
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.140041790
mov eax, dword [rsi + 8]
test eax, eax
je 0x14011e372
cmp eax, 1
je 0x14011e378
mov bp, 1
add eax, 0xfffffffe
cmp eax, 2
jae 0x14011e37c
lea r12, [rsp + 0x80]
mov r8d, 0x7d8
mov rcx, r12
mov dl, 0xaa
call fcn.1400dd020
mov rcx, r12
call fcn.14008b4c0
mov rcx, r12
mov rdx, r15
call fcn.14013ef30
movsx r8, byte [rsp + 0x5f]
test r8, r8
jns 0x14011e352
mov r8, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.14003eb1e
cmp byte [rsp + 0x5f], 0
jns 0x14011e37c
mov rcx, qword [rsp + 0x48]
call fcn.1400a65cc
jmp 0x14011e37c
mov bp, 4
jmp 0x14011e37c
mov bp, 2
cmp byte [rsp + 0x77], 0
jns 0x14011e388
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x48], 0
mov rcx, qword [0x1401be058]
cmp byte [rcx + 0x17], 0
jns 0x14011e3a9
mov rcx, qword [rcx]
lea rdx, [rsp + 0x48]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x14011e476
mov rax, qword [rsp + 0x48]
mov r9d, dword [0x1401be054]
movzx r8d, word [0x1401be050]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x14011e491
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14011e414
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [rsp + 0x77], 0
jns 0x14011e425
mov rcx, qword [rsp + 0x60]
call fcn.1400a65cc
call fcn.14004acc0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.1400735b0
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.1400a7ab0
nop
add rsp, 0x860
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1400297b3
jmp 0x14011e433
lea rcx, [rsi + 0x10]
lea rdx, str.___ERROR_GETTING_USER_SID__
mov r8d, 0x1b
call fcn.1400297b3
jmp 0x14011e3bb
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1400297b3
jmp 0x14011e404
Function at 0x140125eb6
Capabilities:
Get session information

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0x178], rax
call fcn.14012611c
test al, al
je 0x140125f8b
mov qword [rsi], 0
mov rcx, rsi
mov rdx, 0xfffffffffffffffc
call fcn.140029f80
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400a7ab0
mov rax, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.....chromeinstallerutilinstall_util.cc
mov edx, 0x2c
call fcn.14004a010
test eax, eax
jle 0x140125f72
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x1f1
mov r9d, 0xffffffff
call fcn.140073170
lea rcx, [rsp + 0x38]
lea rdx, str.GetActiveUserToken_found_no_active_sessions.
mov r8d, 0x2c
call fcn.1400297b3
mov rcx, rdi
call fcn.1400735b0
mov rcx, qword [rsp + 0x168]
call sub.WTSAPI32.dll_WTSFreeMemory
mov qword [rsi], 0
jmp 0x140125efc
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov edi, eax
lea eax, [rdi + 1]
cmp eax, 2
jb 0x140125fe1
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [rsp + 0x168]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, edi
mov r8d, 8
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140125fe1
mov rcx, qword [rsp + 0x28]
mov ebx, dword [rcx]
call sub.WTSAPI32.dll_WTSFreeMemory
test ebx, ebx
je 0x1401260fa
lea rax, [rsp + 0x174]
mov dword [rax], 0
lea r9, [rsp + 0x168]
mov qword [r9], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
xor edx, edx
mov r8d, 1
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x14012603e
mov eax, dword [rsp + 0x174]
test eax, eax
je 0x140125f1e
mov ebx, 0x10
movabs r14, 0xaaaaaaaaaaaaaaaa
xor r15d, r15d
lea rdi, [rsp + 0x28]
jmp 0x1401260b6
mov ecx, 1
call fcn.140049fe0
test al, al
je 0x140125f7f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x1e0
mov r9d, 1
call fcn.14011f590
lea rcx, [rsp + 0x38]
lea rdx, str.GetActiveUserToken_failed_to_enumerate_sessions._Assume_no_active_sessions.
mov r8d, 0x4b
call fcn.1400297b3
mov rcx, rdi
call fcn.14011f610
jmp 0x140125f7f
mov eax, dword [rsp + 0x174]
inc r15
mov ecx, eax
add rbx, 0x18
cmp r15, rcx
jae 0x140125f1e
mov rcx, qword [rsp + 0x168]
cmp dword [rcx + rbx], 0
jne 0x1401260a4
mov qword [rsp + 0x28], r14
mov ecx, dword [rcx + rbx - 0x10]
mov rdx, rdi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x14012609d
mov rcx, qword [rsp + 0x168]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rdx, qword [rsp + 0x28]
mov qword [rsi], 0
mov rcx, rsi
jmp 0x140125ef7
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov ecx, edi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x1401260e6
jmp 0x140125fe1
Function at 0x14012611c
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x1d0
mov rax, qword [0x1401ab040]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
lea r9, [rsp + 0x17c]
mov dword [r9], 0x44
xorps xmm0, xmm0
lea r8, [rsp + 0x180]
movaps xmmword [r8 + 0x30], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov dword [r8 + 0x40], 0
mov ecx, 0xb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1401261a7
lea r8, [rsp + 0x34]
mov dword [r8], 0
lea rdx, [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x14012621a
cmp dword [rsp + 0x34], 0
setne sil
jmp 0x1401261ff
mov ecx, 2
call fcn.140049fe0
test al, al
je 0x1401261fd
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x216
mov r9d, 2
call fcn.14011f590
lea rcx, [rsp + 0x48]
lea rdx, str.Failed_to_create_well_known_SID
mov r8d, 0x1f
call fcn.1400297b3
mov rcx, rsi
call fcn.14011f610
xor esi, esi
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.1400a7ab0
mov eax, esi
add rsp, 0x1d0
pop rsi
ret
mov ecx, 2
call fcn.140049fe0
test al, al
je 0x1401261fd
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_util.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x21c
mov r9d, 2
call fcn.14011f590
lea rcx, [rsp + 0x48]
lea rdx, str.Failed_to_check_token_membership_for_WinInteractiveSid
mov r8d, 0x36
jmp 0x1401261f0
Function at 0x140129460
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x140129490
cmp rbx, 2
jb 0x140129578
lea r14, [rdi + 0x80]
mov r15d, 1
movdqa xmm6, xmmword [0x14018cf40]
movdqa xmm7, xmmword [0x14018cf50]
movdqa xmm8, xmmword [0x14018cf60]
movdqa xmm9, xmmword [0x14018cf70]
mov rcx, rsi
call fcn.14013a350
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm0
pand xmm1, xmm6
pshufd xmm2, xmm0, 0x39
pand xmm2, xmm7
por xmm2, xmm1
pshufd xmm1, xmm0, 0x4e
pand xmm0, xmm8
movdqa xmm3, xmm0
pslldq xmm3, 4
psrldq xmm0, 0xc
por xmm0, xmm3
pand xmm1, xmm9
por xmm1, xmm0
por xmm1, xmm2
movdqa xmmword [rsi + rax], xmm1
add rax, 0x10
cmp rax, 0x80
jne 0x1401294ee
mov rcx, rsi
call fcn.14013a830
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14012954c
inc r15
sub r14, 0xffffffffffffff80
cmp r15, rbx
jne 0x1401294e4
mov rcx, rsi
call fcn.14013a350
xor eax, eax
movdqa xmm0, xmmword [0x14018cf40]
movdqa xmm1, xmmword [0x14018cf50]
movdqa xmm2, xmmword [0x14018cf60]
movdqa xmm3, xmmword [0x14018cf70]
movdqa xmm4, xmmword [rsi + rax]
movdqa xmm5, xmm4
pand xmm5, xmm0
pshufd xmm6, xmm4, 0x39
pand xmm6, xmm1
por xmm6, xmm5
pshufd xmm5, xmm4, 0x4e
pand xmm4, xmm2
movdqa xmm7, xmm4
pslldq xmm7, 4
psrldq xmm4, 0xc
por xmm4, xmm7
pand xmm5, xmm3
por xmm5, xmm4
por xmm5, xmm6
movdqa xmmword [rsi + rax], xmm5
add rax, 0x10
cmp rax, 0x80
jne 0x1401295a2
shl rbx, 7
add rdi, rbx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x1401295fd
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret