joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058ae0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov esi, r9d
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rdx, str.Read
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x3d
call fcn.140047ce0
lea rcx, [rsp + 0x60]
mov rdx, rbx
xor r8d, r8d
call fcn.14008c5b0
test esi, esi
js 0x140058ba7
lea rcx, [rsp + 0x30]
call fcn.14008b0a0
call fcn.14008bd50
test al, al
je 0x140058b68
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.14008bdf0
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], eax
mov rcx, qword [r15]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140058bae
mov esi, dword [rsp + 0x2c]
jmp 0x140058bbf
mov esi, 0xffffffff
jmp 0x140058bc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x30]
call fcn.14008bdc0
lea rcx, [rsp + 0x60]
call fcn.14008c6e0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140058c00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rdx, str.Write
lea r8, str..._.._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x72
call fcn.140047ce0
lea rcx, [rsp + 0x68]
xor esi, esi
mov rdx, r15
xor r8d, r8d
call fcn.14008c5b0
lea rcx, [rsp + 0x30]
call fcn.14008b0a0
call fcn.14008bd50
test al, al
je 0x140058c8a
movsxd r9, ebp
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.14008bdf0
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], eax
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.14008bdc0
lea rcx, [rsp + 0x68]
call fcn.14008c6e0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140058d00
Capabilities:
Get file size

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x9b
call fcn.140047ce0
lea rcx, [rsp + 0x48]
mov rdx, rdi
xor r8d, r8d
call fcn.14008c5b0
lea rcx, [rsp + 0x28]
call fcn.14008b0a0
call fcn.14008bd50
test al, al
je 0x140058d73
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x28]
mov r8, rsi
xor r9d, r9d
call fcn.14008bdf0
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14008bdc0
lea rcx, [rsp + 0x48]
call fcn.14008c6e0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140147fd0
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x140058dc0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.SetLength
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xa8
call fcn.140047ce0
lea rcx, [rsp + 0x50]
mov rdx, rbx
xor r8d, r8d
call fcn.14008c5b0
lea rcx, [rsp + 0x30]
call fcn.14008b0a0
call fcn.14008bd50
test al, al
je 0x140058e37
lea rdx, str.File::SetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
mov r9, rdi
call fcn.14008bdf0
mov rcx, qword [rsi]
xor ebx, ebx
lea r8, [rsp + 0x28]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140058e95
mov rcx, qword [rsi]
xor ebx, ebx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140058e95
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140058e93
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsi]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
jmp 0x140058e95
xor ebx, ebx
lea rcx, [rsp + 0x30]
call fcn.14008bdc0
lea rcx, [rsp + 0x50]
call fcn.14008c6e0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140147fd0
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400595c0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.MapImageToMemory
lea r8, str..._.._base_files_memory_mapped_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x1a
call fcn.140047ce0
lea rcx, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.14008c5b0
mov rcx, rsi
call fcn.1400589e0
test al, al
je 0x1400596b2
lea rbx, [rsi + 0x40]
mov rcx, rsi
call fcn.14000c3a0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rbx
mov rdx, rax
call fcn.14000ad56
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400596b2
mov qword [rsp + 0x20], 0
xor edi, edi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x1400596b2
lea rcx, [0x14017cb60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.14009fea8
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.14008c6e0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005a740
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14005a76f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14005a772
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14005a793
test bl, bl
je 0x14005a7e2
cmp byte [rdi + 8], 0
je 0x14005a7d4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14005a7d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14005a7aa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14005a7ad
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14005a7c3
xor edi, edi
jmp 0x14005a85e
cmp byte [rdi + 8], 0
je 0x14005a816
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14005a819
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
je 0x14005a7f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14005a7f6
mov rcx, qword [rdi]
call fcn.14009d350
mov rcx, qword [0x1401bc948]
mov dil, 1
test rcx, rcx
je 0x14005a85e
mov edx, eax
mov r8d, esi
call fcn.14008ed50
jmp 0x14005a85e
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14005a82c
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
je 0x14005a83d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14005a840
mov rcx, qword [rdi]
call fcn.14009d350
mov rcx, qword [0x1401bc948]
test rcx, rcx
je 0x14005a85b
mov edx, eax
mov r8d, esi
call fcn.14008ed50
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005b390
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x14005b7a0
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0
mov r9d, 0x20019
or r9d, dword [rcx + 8]
mov rcx, qword [rcx]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14005b860
mov dword [rsp + 0x6c], 0
mov rcx, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005b860
mov ebx, 0x91
cmp dword [rsp + 0x6c], 0
jne 0x14005b860
mov r8d, dword [rdi + 8]
mov rcx, qword [rdi]
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebx, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140147fd0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005b890
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14005b90b
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14005b90b
cmp dword [rsp + 0x38], 4
jne 0x14005b90b
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14005b930
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
add rsp, 0x38
ret

Function at 0x14005b960
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, r8
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], ntohl
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 8
mov rcx, qword [rcx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14005b9de
mov eax, dword [rsp + 0x4c]
or eax, 8
mov edi, 0x3f4
cmp eax, 0xb
jne 0x14005b9de
cmp dword [rsp + 0x3c], 8
jne 0x14005b9de
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
xor edi, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14005ba00
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rsi
push rdi
mov eax, 0x1048
call fcn.140147f60
sub rsp, rax
mov rsi, r8
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14005baba
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x14005ba7f
mov edi, 0x3f4
cmp eax, 1
jne 0x14005baba
lea rdx, [rsp + 0x840]
jmp 0x14005bab0
lea rcx, [rsp + 0x840]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x14005baba
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002b1bc
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x1048
pop rdi
pop rsi
ret

Function at 0x14005bae0
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], r8d
mov rcx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x14005bb40
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x14005bb70
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.140162584
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005bda0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx], 0
je 0x14005bee0
cmp dword [rsi + 8], 0
js 0x14005bee0
lea r15, [rsi + 0x10]
mov ebp, 0xa
cmp byte [rsi + 0x27], 0
jns 0x14005bde9
mov ebp, dword [rsi + 0x20]
add ebp, 0xffffffff
mov dword [rsp + 0x44], ebp
lea r14, [rsi + 0x28]
mov eax, dword [rsi + 0x30]
mov rdi, qword [rsi + 0x28]
sub eax, edi
add eax, 0xfffffffe
and eax, 0xfffffffe
lea r12, [rsi + 0x40]
mov dword [rsi + 0x40], eax
lea rbx, [rsi + 0x44]
mov edx, ebp
mov rcx, r15
call fcn.1400509a0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x14005bedc
mov edx, dword [rsi + 0x40]
add rdx, 1
shr rdx, 1
mov rdi, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, rdi
mov rcx, rax
sar rcx, 1
sub rdx, rcx
jb 0x14005be8f
mov word [rsp + 0x42], 0
add rdx, 1
lea r8, [rsp + 0x42]
mov rcx, r14
call fcn.14005c200
mov rdi, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, rdi
add eax, 0xfffffffe
and eax, 0xfffffffe
mov dword [rsi + 0x40], eax
cmp dword [rsp + 0x44], ebp
mov edx, 0x4000
cmovne edx, ebp
mov dword [rsp + 0x44], edx
mov rcx, r15
call fcn.1400509a0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14005bf22
lea rax, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x14005beed
mov rax, qword [rax]
mov word [rax], 0
mov rax, qword [rsi + 0x28]
mov word [rax], 0
mov dword [rsi + 0x40], 0
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [r12]
add rax, 1
and rax, 0xfffffffffffffffe
mov rcx, qword [r14]
mov word [rcx + rax], 0
mov sil, 1
jmp 0x14005bf04

Function at 0x14005bfb0
Capabilities:
Query or enumerate registry value

Disassembly:
add dword [rcx + 8], 0xffffffff
jmp fcn.14005bda0
Function at 0x14005bfe0
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x70], rax
or r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005c062
mov dword [rsp + 0x60], 0
mov rcx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14005c084
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi], 0
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140147fd0
nop
add rsp, 0x78
pop rdi
pop rsi
ret
mov edx, dword [rsp + 0x60]
add edx, 0xffffffff
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x14005c069
test edx, edx
js 0x14005c069
mov dword [rsp + 0x6c], 0x104
lea r8, [rsi + 0xc]
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x6c]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14005c069
jmp 0x14005c06f

Function at 0x14005c180
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 8]
lea edx, [rax - 1]
mov dword [rcx + 8], edx
test eax, eax
jle 0x14005c1e2
mov rcx, qword [rsi]
test rcx, rcx
je 0x14005c1e2
mov dword [rsp + 0x54], 0x104
lea r8, [rsi + 0xc]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x54]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14005c1e8
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140147fd0
nop
add rsp, 0x60
pop rsi
ret
Function at 0x140062da0
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x198], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x170], xmm0
mov dword [rsp + 0x190], 0
cmp byte [rcx + 0x17], 0
jns 0x140062de6
mov rcx, qword [rsi]
lea r8, [rsp + 0x170]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x140062e9e
mov rcx, rsi
call fcn.1400572f0
movzx r8d, al
xor r8d, 5
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140062e1a
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140062efe
lea rcx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
mov edx, 0x3a
call fcn.140048210
mov dil, 1
test eax, eax
jle 0x140062f7f
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x5d
mov r9d, 0xffffffff
call fcn.140048290
lea rcx, [rsp + 0x38]
lea rdx, str.Scheduled_for_deletion:
mov r8d, 0x18
call fcn.140006489
cmp byte [rsi + 0x17], 0
jns 0x140062e86
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400490b0
mov rcx, rbx
call fcn.1400486f0
jmp 0x140062f7f
mov ecx, 1
call fcn.1400481e0
test al, al
je 0x140062f7d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x3e
mov r9d, 1
call fcn.140048f30
lea rcx, [rsp + 0x40]
cmp byte [rsi + 0x17], 0
jns 0x140062ee7
mov rsi, qword [rsi]
mov rdx, rsi
call fcn.1400490b0
lea rdx, str._does_not_exist.
mov r8d, 0x10
jmp 0x140062f6d
mov ecx, 2
call fcn.1400481e0
test al, al
je 0x140062f7d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x49
mov r9d, 2
call fcn.140048f30
lea rcx, [rsp + 0x40]
lea rdx, str.Could_not_schedule
mov r8d, 0x13
call fcn.140006489
cmp byte [rsi + 0x17], 0
jns 0x140062f55
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400490b0
lea rdx, str._for_deletion.
mov r8d, reloc.WS2_32.dll_ntohl
mov rcx, rax
call fcn.140006489
mov rcx, rdi
call fcn.140049000
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140063a59
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov r15, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, qword [rcx]
mov rdi, qword [rcx + 8]
cmp rdi, rsi
je 0x140063a9d
lea rbx, [r15 + 0x18]
add rdi, 0xffffffffffffffd0
mov rcx, rbx
mov rdx, rdi
call fcn.140064428
cmp rsi, rdi
jne 0x140063a89
mov qword [r15 + 8], rsi
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
lea rdi, [rsp + 0x60]
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.14005af60
mov rdi, qword [rdi]
test rdi, rdi
je 0x140063b67
lea r14, [rsp + 0x5c]
mov dword [r14], 0
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.140064458
mov rax, qword [rbx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x140063b6e
cmp eax, 0xea
jne 0x140063ba5
mov ebx, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x140063bb3
mov edx, dword [rsp + 0x5c]
test dl, 1
jne 0x140063bb3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
cmp rcx, rdx
jae 0x140063b75
sub rdx, rcx
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140064458
mov rax, qword [rbx]
jmp 0x140063b7f
mov ebx, 0x80070002
jmp 0x140063bc7
mov ebx, 0x80070002
jmp 0x140063bb3
jbe 0x140063b7f
add rdx, rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140063bef
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140063bc7
mov qword [rsp + 0x48], rcx
call fcn.140147c5c
lea rcx, [rsp + 0x60]
call fcn.14005b1a0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140147fd0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
mov r8, r15
call fcn.14006347c
mov ebx, eax
jmp 0x140063bb3
Function at 0x140068a8e
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor edi, edi
test eax, eax
je 0x140068b02
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x140068b02
mov rcx, rsi
call fcn.14002abe0
mov edx, 1
mov rcx, rsi
mov r8w, 0x2e
call fcn.14002b1e4
mov r8d, dword [rsp + 0x2c]
dec r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002adc0
mov dil, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x238
pop rdi
pop rsi
ret