joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140171180
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c60f0], 1
jne 0x1401712fc
lock bts qword [0x1402c60f0], 0x1f
setb al
test al, al
je 0x1401711ca
test byte [0x1402c60f0], 1
jne 0x1401712fc
xor edx, edx
lea rcx, [0x1402c60f0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401712fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140171255
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171255
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171255
cmp dword [0x1402bff40], 0x3e
jae 0x1401712eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401712eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401712eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401712eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401712eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401712eb
cmp dword [rdx + 4], edi
je 0x1401712eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetTokenNamedObjectPath
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x1401712eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0c8], rax
xor rax, r9
mov qword [0x1402ce030], rax
lea rcx, [0x1402c60f0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce030]
test rax, rax
je 0x14017131d
mov rcx, qword [0x1402ce0c8]
test rcx, rcx
je 0x14017131d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171340
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6120], 1
jne 0x1401714bc
lock bts qword [0x1402c6120], 0x1f
setb al
test al, al
je 0x14017138a
test byte [0x1402c6120], 1
jne 0x1401714bc
xor edx, edx
lea rcx, [0x1402c6120]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401714bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140171415
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171415
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171415
cmp dword [0x1402bff40], 0x3e
jae 0x1401714ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401714ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401714ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401714ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401714ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401714ab
cmp dword [rdx + 4], edi
je 0x1401714ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerNamedObjectPath
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x1401714ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce060], rax
xor rax, r9
mov qword [0x1402ce018], rax
lea rcx, [0x1402c6120]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce018]
test rax, rax
je 0x1401714dd
mov rcx, qword [0x1402ce060]
test rcx, rcx
je 0x1401714dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171500
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6140], 1
jne 0x14017167c
lock bts qword [0x1402c6140], 0x1f
setb al
test al, al
je 0x14017154a
test byte [0x1402c6140], 1
jne 0x14017167c
xor edx, edx
lea rcx, [0x1402c6140]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017167c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401715d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401715d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401715d5
cmp dword [0x1402bff40], 0x3e
jae 0x14017166b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017166b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017166b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017166b
cmp dword [rdx + rcx], 0x4550
jne 0x14017166b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017166b
cmp dword [rdx + 4], edi
je 0x14017166b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerSidType
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x14017166b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cdff0], rax
xor rax, r9
mov qword [0x1402ce100], rax
lea rcx, [0x1402c6140]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce100]
test rax, rax
je 0x14017169d
mov rcx, qword [0x1402cdff0]
test rcx, rcx
je 0x14017169d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401716c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6150], 1
jne 0x14017183c
lock bts qword [0x1402c6150], 0x1f
setb al
test al, al
je 0x14017170a
test byte [0x1402c6150], 1
jne 0x14017183c
xor edx, edx
lea rcx, [0x1402c6150]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017183c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140171795
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171795
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171795
cmp dword [0x1402bff40], 0x3e
jae 0x14017182b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017182b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017182b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017182b
cmp dword [rdx + rcx], 0x4550
jne 0x14017182b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017182b
cmp dword [rdx + 4], edi
je 0x14017182b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerParent
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x14017182b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce098], rax
xor rax, r9
mov qword [0x1402ce0e0], rax
lea rcx, [0x1402c6150]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0e0]
test rax, rax
je 0x14017185d
mov rcx, qword [0x1402ce098]
test rcx, rcx
je 0x14017185d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171880
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6180], 1
jne 0x1401719fc
lock bts qword [0x1402c6180], 0x1f
setb al
test al, al
je 0x1401718ca
test byte [0x1402c6180], 1
jne 0x1401719fc
xor edx, edx
lea rcx, [0x1402c6180]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401719fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023ec90]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140171955
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171955
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171955
cmp dword [0x1402bff40], 0x3e
jae 0x1401719eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401719eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401719eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401719eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401719eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401719eb
cmp dword [rdx + 4], edi
je 0x1401719eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDeriveCapabilitySidsFromName
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x1401719eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0f0], rax
xor rax, r9
mov qword [0x1402ce0c0], rax
lea rcx, [0x1402c6180]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0c0]
test rax, rax
je 0x140171a1d
mov rcx, qword [0x1402ce0f0]
test rcx, rcx
je 0x140171a1d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171a40
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6100], 1
jne 0x140171bbc
lock bts qword [0x1402c6100], 0x1f
setb al
test al, al
je 0x140171a8a
test byte [0x1402c6100], 1
jne 0x140171bbc
xor edx, edx
lea rcx, [0x1402c6100]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171bbc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140171b15
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171b15
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171b15
cmp dword [0x1402bff40], 0x3e
jae 0x140171bab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171bab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171bab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171bab
cmp dword [rdx + rcx], 0x4550
jne 0x140171bab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171bab
cmp dword [rdx + 4], edi
je 0x140171bab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertSecurityDescriptorToStringSecurityDescriptorW
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x140171bab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce040], rax
xor rax, r9
mov qword [0x1402cdfd0], rax
lea rcx, [0x1402c6100]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfd0]
test rax, rax
je 0x140171bdd
mov rcx, qword [0x1402ce040]
test rcx, rcx
je 0x140171bdd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171c00
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6210], 1
jne 0x140171d7c
lock bts qword [0x1402c6210], 0x1f
setb al
test al, al
je 0x140171c4a
test byte [0x1402c6210], 1
jne 0x140171d7c
xor edx, edx
lea rcx, [0x1402c6210]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171d7c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140171cd5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171cd5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171cd5
cmp dword [0x1402bff40], 0x3e
jae 0x140171d6b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171d6b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171d6b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171d6b
cmp dword [rdx + rcx], 0x4550
jne 0x140171d6b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171d6b
cmp dword [rdx + 4], edi
je 0x140171d6b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x140171d6b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce090], rax
xor rax, r9
mov qword [0x1402ce058], rax
lea rcx, [0x1402c6210]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce058]
test rax, rax
je 0x140171d9d
mov rcx, qword [0x1402ce090]
test rcx, rcx
je 0x140171d9d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171dc0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6190], 1
jne 0x140171f3c
lock bts qword [0x1402c6190], 0x1f
setb al
test al, al
je 0x140171e0a
test byte [0x1402c6190], 1
jne 0x140171f3c
xor edx, edx
lea rcx, [0x1402c6190]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140171f3c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.shlwapi.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140171e95
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171e95
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140171e95
cmp dword [0x1402bff40], 0x3e
jae 0x140171f2b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140171f2b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140171f2b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140171f2b
cmp dword [rdx + rcx], 0x4550
jne 0x140171f2b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140171f2b
cmp dword [rdx + 4], edi
je 0x140171f2b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.SHAutoComplete
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x140171f2b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce000], rax
xor rax, r9
mov qword [0x1402ce080], rax
lea rcx, [0x1402c6190]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce080]
test rax, rax
je 0x140171f5d
mov rcx, qword [0x1402ce000]
test rcx, rcx
je 0x140171f5d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171f80
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c61b0], 1
jne 0x1401720fc
lock bts qword [0x1402c61b0], 0x1f
setb al
test al, al
je 0x140171fca
test byte [0x1402c61b0], 1
jne 0x1401720fc
xor edx, edx
lea rcx, [0x1402c61b0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401720fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140172055
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172055
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172055
cmp dword [0x1402bff40], 0x3e
jae 0x1401720eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401720eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401720eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401720eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401720eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401720eb
cmp dword [rdx + 4], edi
je 0x1401720eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssCaptureSnapshot
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x1401720eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce108], rax
xor rax, r9
mov qword [0x1402cdfe8], rax
lea rcx, [0x1402c61b0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfe8]
test rax, rax
je 0x14017211d
mov rcx, qword [0x1402ce108]
test rcx, rcx
je 0x14017211d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172140
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6230], 1
jne 0x1401722bc
lock bts qword [0x1402c6230], 0x1f
setb al
test al, al
je 0x14017218a
test byte [0x1402c6230], 1
jne 0x1401722bc
xor edx, edx
lea rcx, [0x1402c6230]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401722bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140172215
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172215
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172215
cmp dword [0x1402bff40], 0x3e
jae 0x1401722ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401722ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401722ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401722ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401722ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401722ab
cmp dword [rdx + 4], edi
je 0x1401722ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssQuerySnapshot
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x1401722ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cdff8], rax
xor rax, r9
mov qword [0x1402cdfc8], rax
lea rcx, [0x1402c6230]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cdfc8]
test rax, rax
je 0x1401722dd
mov rcx, qword [0x1402cdff8]
test rcx, rcx
je 0x1401722dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172300
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6250], 1
jne 0x14017247c
lock bts qword [0x1402c6250], 0x1f
setb al
test al, al
je 0x14017234a
test byte [0x1402c6250], 1
jne 0x14017247c
xor edx, edx
lea rcx, [0x1402c6250]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017247c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401723d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401723d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401723d5
cmp dword [0x1402bff40], 0x3e
jae 0x14017246b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017246b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017246b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017246b
cmp dword [rdx + rcx], 0x4550
jne 0x14017246b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017246b
cmp dword [rdx + 4], edi
je 0x14017246b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssFreeSnapshot
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x14017246b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce0b8], rax
xor rax, r9
mov qword [0x1402ce010], rax
lea rcx, [0x1402c6250]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce010]
test rax, rax
je 0x14017249d
mov rcx, qword [0x1402ce0b8]
test rcx, rcx
je 0x14017249d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401724c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c6200], 1
jne 0x14017263c
lock bts qword [0x1402c6200], 0x1f
setb al
test al, al
je 0x14017250a
test byte [0x1402c6200], 1
jne 0x14017263c
xor edx, edx
lea rcx, [0x1402c6200]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017263c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140172595
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172595
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172595
cmp dword [0x1402bff40], 0x3e
jae 0x14017262b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017262b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017262b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017262b
cmp dword [rdx + rcx], 0x4550
jne 0x14017262b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017262b
cmp dword [rdx + 4], edi
je 0x14017262b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.CreateEnvironmentBlock
call fcn.14017dc40
mov r9, rax
test rax, rax
je 0x14017262b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce038], rax
xor rax, r9
mov qword [0x1402ce0d8], rax
lea rcx, [0x1402c6200]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ce0d8]
test rax, rax
je 0x14017265d
mov rcx, qword [0x1402ce038]
test rcx, rcx
je 0x14017265d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret