joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019fce0
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x14019ff1b
mov eax, dword [rsp + 0x5c]
or eax, dword [rsp + 0x54]
or eax, dword [rsp + 0x58]
or eax, dword [rsp + 0x50]
je 0x14019ff1b
cmp dword [rbx + 0x244], 0
mov qword [rsp + 0xe0], rsi
jg 0x14019fdb4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetUpdateRgn]
mov rcx, qword [rbx + 0x248]
test rcx, rcx
jne 0x14019fd7b
mov qword [rbx + 0x248], rsi
jmp 0x14019fd96
mov r9d, 2
mov r8, rsi
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
test rax, rax
je 0x14019ff13
jmp 0x14019ff05
test dword ds:[rbx + 0x40], 0x200000
je 0x14019fe73
cmp qword [rbx + 0x1f8], 0
jne 0x14019fe73
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
test rax, rax
je 0x14019fe73
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbx + 0x1f8], rax
test rax, rax
je 0x14019fe73
movups xmm0, xmmword ds:[rbx + 0x60]
mov rcx, rsi
movups xmmword [rbx + 0x210], xmm0
mov edx, dword [rbx + 0x218]
mov r8d, dword [rbx + 0x21c]
inc edx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbx + 0x208], rax
test rax, rax
jne 0x14019fe4c
mov rcx, qword [rbx + 0x1f8]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov qword [rbx + 0x1f8], 0
jmp 0x14019fe73
mov rcx, qword [rbx]
mov rdx, rsi
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rdx, qword [rbx + 0x208]
mov rcx, qword [rbx + 0x1f8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbx + 0x200], rax
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
mov rsi, rax
test rax, rax
je 0x14019ff13
movups xmm0, xmmword [rsp + 0x6c]
mov r8, qword [rbx + 0x1f8]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
movups xmmword [rsp + 0x50], xmm0
test r8, r8
je 0x14019fefc
call fcn.1401a5c20
mov ecx, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x54]
sub ecx, r8d
mov edx, dword [rsp + 0x50]
mov rax, qword [rbx + 0x1f8]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x40], 0xcc0020
sub r9d, edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
jmp 0x14019ff05
mov r8, rsi
call fcn.1401a5c20
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndPaint]
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401e4160
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x1401a9e80
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
test byte [0x1402c6d18], 1
jne 0x1401aa140
lock bts qword [0x1402c6d18], 0x1f
setb al
test al, al
je 0x1401a9ecb
test byte [0x1402c6d18], 1
jne 0x1401aa140
xor edx, edx
lea rcx, [0x1402c6d18]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [0x1402ceb48]
add rsp, 0x48
ret
cmp dword [0x1402bff40], 0x3e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
lea rbx, str.appresolver.dll
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0x1e
jae 0x1401aa005
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401a9f69
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a9f69
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a9f69
cmp dword [0x1402bff40], 0x3e
nop
jae 0x1401aa12f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401aa12f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401aa12f
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401aa12f
cmp dword [rdx + rcx], 0x4550
jne 0x1401aa12f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401aa12f
cmp dword [rdx + 4], 0
je 0x1401aa12f
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.14017dc40
test rax, rax
je 0x1401aa12f
lea r8, [rsp + 0x50]
lea rdx, [0x14020fc00]
lea rcx, [0x14028e6f0]
call qword [case.0x14013d64a.0]
test eax, eax
js 0x1401aa12f
lea r8, [0x14028e728]
nop
jmp 0x1401aa102
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401aa072
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aa072
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aa072
cmp dword [0x1402bff40], 0x3e
jae 0x1401aa12f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401aa12f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401aa12f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401aa12f
cmp dword [rdx + rcx], 0x4550
jne 0x1401aa12f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401aa12f
cmp dword ds:[rdx + 4], 0
je 0x1401aa12f
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.14017dc40
test rax, rax
je 0x1401aa12f
lea r8, [rsp + 0x50]
lea rdx, [0x14020fc00]
lea rcx, [0x14028e6f0]
call qword [case.0x14013d64a.0]
test eax, eax
js 0x1401aa12f
lea r8, [0x14028e688]
mov rcx, qword [rsp + 0x50]
lea r9, [0x1402ceb48]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14013d64a.0]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
lea rcx, [0x1402c6d18]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
mov rax, qword [0x1402ceb48]
add rsp, 0x48
ret
Function at 0x1401aa160
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
test byte [0x1402c6d08], 1
jne 0x1401aa420
lock bts qword [0x1402c6d08], 0x1f
setb al
test al, al
je 0x1401aa1ab
test byte [0x1402c6d08], 1
jne 0x1401aa420
xor edx, edx
lea rcx, [0x1402c6d08]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [0x1402ceb40]
add rsp, 0x48
ret
cmp dword [0x1402bff40], 0x3e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
lea rbx, str.appresolver.dll
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0x1e
jae 0x1401aa2e5
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401aa249
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aa249
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aa249
cmp dword [0x1402bff40], 0x3e
nop
jae 0x1401aa40f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401aa40f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401aa40f
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401aa40f
cmp dword [rdx + rcx], 0x4550
jne 0x1401aa40f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401aa40f
cmp dword [rdx + 4], 0
je 0x1401aa40f
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.14017dc40
test rax, rax
je 0x1401aa40f
lea r8, [rsp + 0x50]
lea rdx, [0x14020fc00]
lea rcx, [0x14028e6f0]
call qword [case.0x14013d64a.0]
test eax, eax
js 0x1401aa40f
lea r8, [0x14028e6e0]
nop
jmp 0x1401aa3e2
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401aa352
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aa352
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aa352
cmp dword [0x1402bff40], 0x3e
jae 0x1401aa40f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401aa40f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401aa40f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401aa40f
cmp dword [rdx + rcx], 0x4550
jne 0x1401aa40f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401aa40f
cmp dword ds:[rdx + 4], 0
je 0x1401aa40f
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.14017dc40
test rax, rax
je 0x1401aa40f
lea r8, [rsp + 0x50]
lea rdx, [0x14020fc00]
lea rcx, [0x14028e6f0]
call qword [case.0x14013d64a.0]
test eax, eax
js 0x1401aa40f
lea r8, [0x14028e758]
mov rcx, qword [rsp + 0x50]
lea r9, [0x1402ceb40]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14013d64a.0]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
lea rcx, [0x1402c6d08]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
mov rax, qword [0x1402ceb40]
add rsp, 0x48
ret
Function at 0x1401aaf00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov qword [rsp + 0x30], 0x26
lea rbx, str.twinapi.appcore.dll
mov rsi, rcx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401aafcb
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aafcb
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aafcb
cmp dword [0x1402bff40], 0x3e
jae 0x1401aaf9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aafcb
mov ebx, 0x8007007e
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401aafb9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401ab088
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ab088
cmp dword [rdx + rcx], 0x4550
jne 0x1401ab088
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ab088
cmp dword [rdx + 4], 0
je 0x1401ab088
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.14017dc40
test rax, rax
je 0x1401ab088
lea r8, [rsp + 0x68]
lea rdx, [0x14020fc00]
lea rcx, [0x14028e678]
call qword [case.0x14013d64a.0]
mov ebx, eax
test eax, eax
js 0x1401ab08d
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
lea r8, [0x14028e768]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14013d64a.0]
mov rcx, qword ds:[rsp + 0x68]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
jmp 0x1401ab08d
mov ebx, 0x8007007f
test ebx, ebx
jne 0x1401aafa2
mov rcx, qword [rsp + 0x60]
mov r8d, 0x10000
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14013d64a.0]
mov ebx, eax
test eax, eax
jne 0x1401aafa2
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov qword [rdi], rcx
add rsp, 0x40
pop rdi
ret
Function at 0x1401ab0e0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov qword [rax - 0x30], 0x18
mov rbp, rdx
mov qword [rax + 0x20], r14
lea rbx, str.mrmcorer.dll
mov qword [rax - 0x38], r14
lea rdx, [rax - 0x30]
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], rbx
mov rdi, r8
mov rsi, rcx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401ab190
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ab190
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ab190
cmp dword [0x1402bff40], 0x3e
jae 0x1401ab186
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ab190
mov ebx, 0x8007007e
jmp 0x1401ab2b2
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401ab248
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ab248
cmp dword [rdx + rcx], 0x4550
jne 0x1401ab248
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ab248
cmp dword [rdx + 4], r14d
je 0x1401ab248
lea r8, [rcx + rax]
mov word [rsp + 0x20], r14w
lea r9, str.DllGetClassObject
call fcn.14017dc40
test rax, rax
je 0x1401ab248
lea r8, [rsp + 0x38]
lea rdx, [0x14020fc00]
lea rcx, [0x14028e6c0]
call qword [case.0x14013d64a.0]
mov ebx, eax
test eax, eax
js 0x1401ab24d
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x88]
lea r8, [0x14028e738]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14013d64a.0]
mov rcx, qword ds:[rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
jmp 0x1401ab24d
mov ebx, 0x8007007f
test ebx, ebx
jne 0x1401ab2b2
mov rcx, qword [rsp + 0x88]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x14013d64a.0]
mov ebx, eax
test eax, eax
jne 0x1401ab2b2
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x30]
lea rdx, [0x14028e748]
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14013d64a.0]
mov ebx, eax
test eax, eax
jne 0x1401ab2b2
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14013d64a.0]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401ab2c9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1401ab2e6
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
test ebx, ebx
jne 0x1401ab2f2
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1401c6900
Capabilities:
Parse pe header

Disassembly:
mov qword ss:[rsp + 8], rbx
push rdi
sub rsp, 0x90
test byte [0x1402c6ee0], 1
mov rbx, rdx
mov rdi, rcx
jne 0x1401c6a1f
lock bts qword [0x1402c6ee0], 0x1f
setb al
test al, al
je 0x1401c6959
test byte [0x1402c6ee0], 1
nop
jne 0x1401c6a1f
xor edx, edx
lea rcx, [0x1402c6ee0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401c6a1f
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401c69b6
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401c69b6
cmp dword [0x1402bff40], 0x3e
jae 0x1401c6a13
xor r8d, r8d
lea rcx, str.cryptui.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401c6a13
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401c6a0a
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6a0a
cmp dword [rdx + rcx], 0x4550
jne 0x1401c6a0a
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6a0a
cmp dword [rdx + 4], 0
je 0x1401c6a0a
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.CryptUIDlgViewSignerInfoW
mov word [rsp + 0x20], ax
call fcn.14017dc40
jmp 0x1401c6a0c
xor eax, eax
mov qword [0x1402ceb78], rax
lea rcx, [0x1402c6ee0]
call sym.SystemInformer.exe_PhfSetEvent
mov rax, qword [0x1402ceb78]
test rax, rax
je 0x1401c6aa8
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x60
xor ecx, ecx
mov qword [rsp + 0x88], rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
test rbx, rbx
je 0x1401c6aa8
cmp dword [rbx + 0x78], ecx
jbe 0x1401c6aa8
mov rdx, qword [rbx + 0x80]
test rdx, rdx
je 0x1401c6aa8
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x58], rcx
lea rcx, str.1.3.6.1.5.5.7.3.3
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x30]
call qword [case.0x14013d64a.0]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x1401c9d80
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x1402caad0]
mov ebp, 4
mov edx, ebp
mov r8d, 0x18
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
xorps xmm0, xmm0
mov rdi, rax
mov rcx, rbx
xor eax, eax
cmp dword [0x1402bff40], 0x3f
mov dword [rsp + 0x20], eax
cmovae edx, ebp
xor r9d, r9d
movups xmmword [rdi], xmm0
xor r8d, r8d
mov qword [rdi + 0x10], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword ds:[rdi], rax
test rax, rax
jne 0x1401c9e06
mov rcx, qword [0x1402caad0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x1402bff40], 0x3f
lea r8, [rsp + 0x70]
mov r9d, ebp
mov edx, 0x54
mov rcx, rax
jae 0x1401c9e2c
mov dword [rsp + 0x70], 0xa00
jmp 0x1401c9ea9
mov dword [rsp + 0x70], 0x2800
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
mov r9d, ebp
mov dword [rsp + 0x78], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402bff40]
nop
cmp eax, 0x64
jb 0x1401c9e8c
mov rcx, qword ds:[rdi]
lea r8, [rsp + 0x30]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov edx, 0x85
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402bff40]
cmp eax, 0x72
jb 0x1401c9eaf
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov r9d, ebp
mov edx, 0xc3
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rbx, qword [rsp + 0x60]
mov al, 1
mov qword [rsi], rdi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401ca020
Capabilities:
Prepare http request

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov eax, ecx
test r9b, 1
je 0x1401ca03b
lfence
mov eax, 0x800000
nop dword [rax + rax]
test r9b, 2
je 0x1401ca04d
lfence
bts eax, 8
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401ca077
add rsp, 0x40
pop rbx
ret
mov r9d, 4
mov dword [rsp + 0x50], 8
lea r8, [rsp + 0x50]
mov edx, 0x3f
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x1401ca100
Capabilities:
Receive http response

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1401ca160
Capabilities:
Set http header

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
mov eax, r8d
test eax, eax
mov r8d, 0xffffffff
mov r9d, 0xa0000000
cmovne r8d, eax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1401ca1a0
Capabilities:
Read http header

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
lea rax, [rsp + 0x50]
mov rsi, rcx
mov qword [rsp + 0x28], rbp
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x16
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1401ca1e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp eax, 0x7a
jne 0x1401ca256
mov rdx, qword [0x1402ca978]
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov edx, 0x16
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], bp
mov r9, qword [rdi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x1401ca261
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401ca256
call fcn.140141ca0
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rax, rdi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401ca280
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
lea rax, [rsp + 0x50]
mov rsi, rdx
mov qword [rsp + 0x28], r14
mov rbp, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
mov r8, rdx
xor r9d, r9d
mov dword [rsp + 0x50], r14d
mov edx, 0xffff
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop
test eax, eax
jne 0x1401ca2cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401ca34a
mov rdx, qword [0x1402ca978]
mov qword [rsp + 0x58], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov qword [rsp + 0x28], r14
mov r8, rsi
mov edx, 0xffff
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], r14w
mov r9, qword [rdi + 8]
mov rcx, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x1401ca35a
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401ca34a
call fcn.140141ca0
xor eax, eax
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov r8, qword [rdi + 8]
xorps xmm1, xmm1
mov rax, r8
mov ecx, r8d
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401ca38d
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x1401ca389
mov eax, ecx
shr rax, 1
jmp 0x1401ca3c3
add rax, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x1401ca3b5
nop dword [rax]
add rax, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x1401ca3a0
sub rax, r8
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rbp, qword [rsp + 0x68]
add rax, rax
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401ca420
Capabilities:
Read http header

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, edx
mov dword [rsp + 0x30], 0x100
xor ebx, ebx
mov rsi, r8
mov edx, ebx
test al, 1
je 0x1401ca459
lfence
mov edx, 5
test al, 2
je 0x1401ca463
lfence
or edx, 0x13
mov rcx, qword ds:[rcx + 0x10]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1401ca53d
mov eax, dword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov qword [rsp + 0x278], rdi
mov r9d, eax
xor dil, dil
test rax, rax
je 0x1401ca4cc
movzx ecx, word [rsp + 0x40]
cmp cx, 0x2d
je 0x1401ca4bb
cmp cx, 0x2b
jne 0x1401ca4cc
cmp cx, 0x2d
lea r11, [rsp + 0x42]
lea r9, [rax - 2]
sete dil
shr r9, 1
mov r10b, 1
mov rdx, rbx
je 0x1401ca51c
mov qword [rsp + 0x250], r14
lea r14, [0x14028b270]
nop word [rax + rax]
movzx eax, byte [r11 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x1401ca509
lea rcx, [rbx + rbx*4]
lea rbx, [r8 + rcx*2]
jmp 0x1401ca50c
xor r10b, r10b
inc rdx
cmp rdx, r9
jb 0x1401ca4f0
mov r14, qword [rsp + 0x250]
mov rax, rbx
neg rax
test dil, dil
mov rdi, qword [rsp + 0x278]
cmove rax, rbx
test r10b, r10b
je 0x1401ca53d
mov qword [rsi], rax
mov al, 1
jmp 0x1401ca53f
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0x258
pop rsi
pop rbx
ret