joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082432
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14008245f
xor eax, eax
jmp 0x140082464
call fcn.140033bce
nop
add rsp, 0x38
ret

Function at 0x140083160
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140112ca8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400831d1
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1400831fe
test eax, eax
js 0x1400831dd
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1400831f4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140112d10]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.1400829c0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call case.0x14006e562.201
mov ecx, 7
int 0x29
ud2

Function at 0x1400856c0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140085760
jmp 0x14008574f

Function at 0x140087970
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.140087da0
mov rax, qword [rbp - 0x60]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x1400879c6
lea rcx, [rbp - 0x58]
call fcn.140082aa0
mov qword [rsi], rdi
jmp 0x140087c08
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x410], 2
mov dword [rbp + 0x410], 2

Function at 0x140088ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi

Function at 0x14008ab90
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
test cl, cl
je 0x14008aba4
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14008ac70
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14008abb0
Function at 0x14008abb0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.140087da0
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x14008ac10
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
lea edx, [rbp - 0x28]
mov r8b, 1
call fcn.140089890
invalid
in al, dx
invalid
dec dword [rax - 0x75]
jge 0x14008abc7
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x14008ac1c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14008ac41
invalid
Function at 0x14008d540
Capabilities:
Create process on windows
Encode data using base64
Encrypt data using speck
Get common file path
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x668
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x5d0], xmm6
mov qword [rbp + 0x5c8], 0xfffffffffffffffe
mov qword [rbp + 0x560], r8
mov rsi, rdx
mov qword [rbp + 0x540], rcx
movzx eax, byte [rdx + 0xa0]
mov r14, qword [rdx + 0x98]
test al, al
mov qword [rbp + 0x548], rdx
jne 0x14008d5b0
test r14, r14
jne 0x14008d5b0
mov qword [rbp + 0x3e0], 0
xor r12d, r12d
jmp 0x14008e1bb
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4c0], 0
test al, al
jne 0x14008d7ec
mov qword [rbp + 0x568], r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x1400903de
lea r14, [rbp - 0x10]
lea rsi, [rbp + 0x4d0]
lea rdi, [rbp - 0x30]
mov qword [rbp + 0x590], rax
mov rbx, rax
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x430], rax
lea rax, [rbp + 0x430]
mov qword [rbp + 0x4d0], rax
lea rax, [fcn.1400886b0]
mov qword [rbp + 0x4d8], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x4d0]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x30]
call fcn.1400d5c10
jmp 0x140090499

Function at 0x140093780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.140087da0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x1400937be
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x1400937e4
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.1400936a0
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x1400937fd
lea rcx, [rbp - 8]
call fcn.140082aa0
mov qword [rsi], rbx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140093820
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x1400937f0
mov qword [rsi], rbx
test r14, r14
je 0x1400937f0
mov edx, 2
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp fcn.140007ce0
Function at 0x140095b30
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x68], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x64], ecx
xor eax, eax
mov qword [rbp - 8], rax
mov r12d, 8
mov sil, 1
xorps xmm6, xmm6
lea r13, [rbp + 0x20]
mov rbx, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor edi, edi
xor eax, eax
mov qword [rbp - 0x10], rax
nop dword [rax]

Function at 0x140096790
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14014c048]
mov edx, 0x10
xor ecx, ecx
call fcn.140099360
test rax, rax
je 0x140096870
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140096960]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140096862
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x140096827
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x14009683f
mov rdx, qword [rax + 0x10]
call fcn.140007ce0
mov edx, 8
mov rcx, qword [rbp - 0x20]
call fcn.140007ce0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400d58a0
ud2

Function at 0x1400a0450
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400a0457
test al, 1
je 0x1400a0476
test al, 2
jne 0x1400a048e
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140115ad8]
mov edx, 0x23
call fcn.1400d5da0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140115b18]
mov edx, 0x25
call fcn.1400d5da0
int3

Function at 0x1400a0d7e
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.1400a02c3
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400a0dba
xor eax, eax
jmp 0x1400a0dc8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x1400d4f9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d4fe6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d4fe6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d4fe6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d4fe6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d4fe6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d4fe8
xor al, al
add rsp, 0x28
ret

Function at 0x1400d8120
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r8
inc r14
sete r13b
je 0x1400d8291
js 0x1400d829d
mov rdi, r9
mov rbx, r8
mov r12, rdx
mov rsi, rcx
movzx eax, byte [0x14014c048]
xor ecx, ecx
mov rdx, r14
call fcn.140099360
test rax, rax
je 0x1400d82a2
mov r15, rax
mov rcx, rax
mov rdx, r12
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 0xf
ja 0x1400d81a1
test rbx, rbx
je 0x1400d81eb
xor eax, eax
nop
cmp byte [r12 + rax], 0
je 0x1400d81b3
inc rax
cmp rbx, rax
jne 0x1400d8190
jmp 0x1400d81eb
xor ecx, ecx
mov rdx, r12
mov r8, rbx
call fcn.14000fad0
test rax, rax
je 0x1400d81eb
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r13b, r13b
jne 0x1400d827f
mov edx, 1
mov rcx, r15
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.140007ce0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x30]
call fcn.140007f30
mov rbx, rax
mov r14, rdx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x28], 1
mov qword [rbp], 0
lea r8, [rbp - 0x30]
mov r9, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400d824f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400d8263
mov rcx, qword [rdi]
mov rax, qword [rbp]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x1400d827f
mov edx, 1
mov rcx, rbx
call fcn.140007ce0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.1400d6180
call fcn.140007e00
mov ecx, 1
mov rdx, r14
call fcn.1400d5880
int3
Function at 0x140065160
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x490], rax
movaps xmm0, xmmword [0x1402faf80]
lea r14, [rsp + 0x30]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x1403157ad]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x280]
mov rcx, r15
mov r9d, 0x1db
call fcn.140125120
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14011a200
lea r14, [rsp + 0x280]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401a5320
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400651ff
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, r14
call fcn.14011d9c0
mov rcx, r14
call fcn.1400fd2b0
lea r14, [rsp + 0x70]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401a5320
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x140065236
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, r14
call fcn.14011d9c0
mov rcx, r14
call fcn.1400fd2b0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140065258
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140065264
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x1400652bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140064880
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x140065297
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400652a0
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x1400652c0
test eax, eax
jne 0x1400652c0
jmp 0x1400652ec
mov dil, 1
lea rcx, [rsp + 0x30]
call fcn.14011a280
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14016c920
mov eax, edi
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp ebp, 0xfffffffc
jne 0x1400652f8
call fcn.1401d8250
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x1400652c0

Function at 0x140065300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1402faf80]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x20e
call fcn.140125120
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14011a200
cmp byte [rdi + 0x17], 0
jns 0x140065372
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.14011a280
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14016c920
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x14016be64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14016beae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14016beae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14016beae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14016beae
cmp dword [rcx + 0x84], 0xe
jbe 0x14016beae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14016beb0
xor al, al
add rsp, 0x28
ret

Function at 0x14016c12c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14016c1a4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14016c1a4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14016c1a4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14016c198
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14016c1b6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14016c186
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14016c1a6

Function at 0x14017e460
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14017e460
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14017e4cf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14017e4cf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14017e4cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14017e4cf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14017e4cf
cmp dword [rcx + 0x84], 0xe
jbe 0x14017e4cf
cmp dword [rcx + 0xf8], 0
je 0x14017e4cf
mov ecx, ebx
call fcn.14017e398
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14017e5f4
nop
cmp dword [rbp + 0x20], 0
je 0x14017e51d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14017e42c
int3
Function at 0x1401b4570
Capabilities:
Delete service

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rbx, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x1401b4607
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dil, 1
test eax, eax
jne 0x1401b45cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, 1
call fcn.140124e30
test al, al
jne 0x1401b460b
cmp edi, 0x430
sete dil
cmp qword [rsi], 0
je 0x1401b45e6
call fcn.140125140
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsi], 0
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14016c920
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
jmp 0x1401b45e6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_service_work_item_impl.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x25f
mov r9d, 1
call fcn.1401dd8a0
lea rcx, [rsp + 0x50]
lea rdx, str.DeleteService_failed
mov r8d, 0x15
call fcn.1400fe0b0
mov r14, rax
lea r15, [rsp + 0x28]
mov rcx, rbx
mov rdx, r15
call fcn.1401b41f0
cmp byte [r15 + 0x17], 0
jns 0x1401b4667
mov r15, qword [rsp + 0x28]
mov rcx, r14
mov rdx, r15
call fcn.1401db080
cmp byte [rsp + 0x3f], 0
jns 0x1401b4683
mov rcx, qword [rsp + 0x28]
call fcn.14016b3e8
lea rcx, [rsp + 0x40]
call fcn.1401dd910
jmp 0x1401b45c1

Function at 0x1401d5d30
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
add rsp, 0x38
ret

Function at 0x1401d5e00
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret
Function at 0x1401d6f50
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 1
je 0x1401d6f79
mov rcx, qword [rsi]
jmp 0x1401d6f82
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1401d6fcb
mov dil, 1
test bl, bl
je 0x1401d6fb4
cmp byte [rsi + 8], 1
je 0x1401d6fa0
mov rcx, qword [rsi]
jmp 0x1401d6fa9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14016c920
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 1
jne 0x1401d6fe2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1401d6fe5
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1401d6ff8
xor edi, edi
jmp 0x1401d6fb4
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 1
jne 0x1401d7011
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1401d7014
mov rcx, qword [rsi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x1401d6fb4
Function at 0x140243270
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x1402432cf
xor r11d, r11d
mov rsi, qword [r8 + r11*8]
mov rdi, qword [rcx + r11*8]
mov rbx, rdi
xor rbx, rsi
lea r14, [rbx - 1]
mov r15, rdi
sub r15, rsi
xor r15, rdi
or r15, rbx
not rbx
and r14, rbx
sar r14, 0x3f
xor r15, rdi
sar r15, 0x3f
or r15, 1
xor rax, r15
and rax, r14
xor rax, r15
inc r11
cmp r10, r11
jne 0x14024328b
cmp rdx, r9
jb 0x1402432de
ja 0x140243302
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x1402432e0
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
not ecx
or eax, ecx
jmp 0x1402432d6
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x140243305
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
xor eax, 1
and eax, r8d
xor eax, 1
jmp 0x1402432d6