joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140195600
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
push r15
sub rsp, 0x28
mov rdi, rdx
mov r15, rcx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140195771
lea rcx, str.BinaryData
mov qword [rsp + 0x48], rbp
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
jne 0x140195653
lea ecx, [rax + 1]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x140195766
mov qword [rsp + 0x40], rbx
mov rcx, rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rbp
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [rdi + 0x1c]
mov rsi, rax
mov r9d, dword [rdi + 0x20]
mov ebx, ecx
mov r14d, dword [rdi + 0x14]
cmp ecx, r9d
jle 0x14019569d
mov ebx, r9d
mov dword [rdi + 0x20], ecx
mov dword [rdi + 0x1c], ebx
mov r9d, ecx
test byte [rdi + 0x2c], 0x10
je 0x140195702
cmp ebx, 0xffffffff
jne 0x1401956cb
cmp dword [rdi + 0x18], 3
mov ebx, r14d
jne 0x1401956b8
lea ebx, [r14 + 1]
mov dword [rdi + 0x14], ebx
mov r9d, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.140195880
jmp 0x140195721
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.140195780
mov r9d, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.140195880
mov r9d, 0xffffffff
mov rdx, rdi
mov r8d, r9d
mov rcx, r15
call fcn.1401951e0
nop
jmp 0x140195721
cmp ebx, 0xffffffff
jne 0x140195717
cmp dword [rdi + 0x18], 3
mov ebx, r14d
jne 0x140195717
lea ebx, [r14 + 1]
mov dword [rdi + 0x14], ebx
mov eax, dword [rdi + 8]
sub eax, ebx
cmp esi, eax
cmova esi, eax
mov ecx, ebx
mov rdx, r12
add rcx, qword [rdi]
mov r8d, esi
call fcn.1401e3aa0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r9d, 0x105
mov dword [rdi + 0x14], r14d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_RedrawWindow]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x48]
add rsp, 0x28
pop r15
pop rdi
ret
Function at 0x140198f40
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x14019917b
mov eax, dword [rsp + 0x5c]
or eax, dword [rsp + 0x54]
or eax, dword [rsp + 0x58]
or eax, dword [rsp + 0x50]
je 0x14019917b
cmp dword [rbx + 0x244], 0
mov qword [rsp + 0xe0], rsi
jg 0x140199014
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetUpdateRgn]
mov rcx, qword [rbx + 0x248]
test rcx, rcx
jne 0x140198fdb
mov qword [rbx + 0x248], rsi
jmp 0x140198ff6
mov r9d, 2
mov r8, rsi
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
test rax, rax
je 0x140199173
jmp 0x140199165
test dword ds:[rbx + 0x40], 0x200000
je 0x1401990d3
cmp qword [rbx + 0x1f8], 0
jne 0x1401990d3
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
test rax, rax
je 0x1401990d3
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbx + 0x1f8], rax
test rax, rax
je 0x1401990d3
movups xmm0, xmmword ds:[rbx + 0x60]
mov rcx, rsi
movups xmmword [rbx + 0x210], xmm0
mov edx, dword [rbx + 0x218]
mov r8d, dword [rbx + 0x21c]
inc edx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbx + 0x208], rax
test rax, rax
jne 0x1401990ac
mov rcx, qword [rbx + 0x1f8]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov qword [rbx + 0x1f8], 0
jmp 0x1401990d3
mov rcx, qword [rbx]
mov rdx, rsi
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rdx, qword [rbx + 0x208]
mov rcx, qword [rbx + 0x1f8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbx + 0x200], rax
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
mov rsi, rax
test rax, rax
je 0x140199173
movups xmm0, xmmword [rsp + 0x6c]
mov r8, qword [rbx + 0x1f8]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
movups xmmword [rsp + 0x50], xmm0
test r8, r8
je 0x14019915c
call fcn.14019efc0
mov ecx, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x54]
sub ecx, r8d
mov edx, dword [rsp + 0x50]
mov rax, qword [rbx + 0x1f8]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x40], 0xcc0020
sub r9d, edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
jmp 0x140199165
mov r8, rsi
call fcn.14019efc0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndPaint]
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401dd6a0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x1401a2fe0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
test byte [0x1402bc9c8], 1
jne 0x1401a328f
lock bts qword [0x1402bc9c8], 0x1f
jae 0x1401a3024
test byte [0x1402bc9c8], 1
jne 0x1401a328f
xor edx, edx
lea rcx, [0x1402bc9c8]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [0x1402c3e20]
add rsp, 0x48
ret
cmp dword [0x1402b5e88], 0x3e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
lea rbx, str.appresolver.dll
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0x1e
jae 0x1401a315a
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401a30b6
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a30b6
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a30b6
cmp dword [0x1402b5e88], 0x3e
jae 0x1401a327e
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401a327e
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401a327e
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401a327e
cmp dword [rdx + rcx], 0x4550
jne 0x1401a327e
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401a327e
cmp dword ds:[rdx + 4], 0
je 0x1401a327e
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.140174840
nop dword [rax]
test rax, rax
je 0x1401a327e
lea r8, ds:[rsp + 0x50]
lea rdx, [0x140208ae0]
lea rcx, [0x140286a50]
call qword [str.PB__]
test eax, eax
js 0x1401a327e
lea r8, [0x140286a88]
jmp 0x1401a3251
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401a31c9
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a31c9
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a31c9
cmp dword [0x1402b5e88], 0x3e
jae 0x1401a327e
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401a327e
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401a327e
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401a327e
cmp dword [rdx + rcx], 0x4550
jne 0x1401a327e
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401a327e
cmp dword [rdx + 4], 0
je 0x1401a327e
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.140174840
test rax, rax
je 0x1401a327e
lea r8, ds:[rsp + 0x50]
lea rdx, [0x140208ae0]
lea rcx, [0x140286a50]
call qword [str.PB__]
test eax, eax
js 0x1401a327e
lea r8, [0x1402869e8]
mov rcx, qword [rsp + 0x50]
lea r9, [0x1402c3e20]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [str.PB__]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PB__]
lea rcx, [0x1402bc9c8]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
mov rax, qword [0x1402c3e20]
add rsp, 0x48
ret
Function at 0x1401a32a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
test byte [0x1402bc9b8], 1
jne 0x1401a354f
lock bts qword [0x1402bc9b8], 0x1f
jae 0x1401a32e4
test byte [0x1402bc9b8], 1
jne 0x1401a354f
xor edx, edx
lea rcx, [0x1402bc9b8]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [0x1402c3e18]
add rsp, 0x48
ret
cmp dword [0x1402b5e88], 0x3e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
lea rbx, str.appresolver.dll
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0x1e
jae 0x1401a341a
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401a3376
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a3376
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a3376
cmp dword [0x1402b5e88], 0x3e
jae 0x1401a353e
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401a353e
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401a353e
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401a353e
cmp dword [rdx + rcx], 0x4550
jne 0x1401a353e
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401a353e
cmp dword ds:[rdx + 4], 0
je 0x1401a353e
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.140174840
nop dword [rax]
test rax, rax
je 0x1401a353e
lea r8, ds:[rsp + 0x50]
lea rdx, [0x140208ae0]
lea rcx, [0x140286a50]
call qword [str.PB__]
test eax, eax
js 0x1401a353e
lea r8, [0x140286a40]
jmp 0x1401a3511
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401a3489
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a3489
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a3489
cmp dword [0x1402b5e88], 0x3e
jae 0x1401a353e
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401a353e
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401a353e
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401a353e
cmp dword [rdx + rcx], 0x4550
jne 0x1401a353e
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401a353e
cmp dword [rdx + 4], 0
je 0x1401a353e
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.140174840
test rax, rax
je 0x1401a353e
lea r8, ds:[rsp + 0x50]
lea rdx, [0x140208ae0]
lea rcx, [0x140286a50]
call qword [str.PB__]
test eax, eax
js 0x1401a353e
lea r8, [0x140286ab8]
mov rcx, qword [rsp + 0x50]
lea r9, [0x1402c3e18]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [str.PB__]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PB__]
lea rcx, [0x1402bc9b8]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
mov rax, qword [0x1402c3e18]
add rsp, 0x48
ret
Function at 0x1401a4040
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov qword [rsp + 0x30], 0x26
lea rbx, str.twinapi.appcore.dll
mov rsi, rcx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401a40d8
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a40d8
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a40d8
cmp dword [0x1402b5e88], 0x3e
jae 0x1401a40ce
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a40d8
mov ebx, 0x8007007e
jmp 0x1401a41e9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401a41e4
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401a41e4
cmp dword [rdx + rcx], 0x4550
jne 0x1401a41e4
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401a41e4
cmp dword ds:[rdx + 4], 0
je 0x1401a41e4
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.140174840
nop dword [rax]
test rax, rax
je 0x1401a41e4
lea r8, ds:[rsp + 0x68]
lea rdx, [0x140208ae0]
lea rcx, [0x1402869d8]
call qword [str.PB__]
mov ebx, eax
test eax, eax
js 0x1401a41a6
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
lea r8, [0x140286ac8]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [str.PB__]
mov rcx, qword ds:[rsp + 0x68]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PB__]
test ebx, ebx
jne 0x1401a41e9
mov rcx, qword ds:[rsp + 0x60]
mov r8d, 0x10000
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [str.PB__]
mov ebx, eax
test eax, eax
jne 0x1401a41e9
mov rcx, qword [rsp + 0x60]
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov ebx, 0x8007007f
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401a4206
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [str.PB__]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1401a4220
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov qword [rax - 0x30], 0x18
mov rbp, rdx
mov qword [rax + 0x20], r14
lea rbx, str.mrmcorer.dll
mov qword [rax - 0x38], r14
lea rdx, [rax - 0x30]
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], rbx
mov rdi, r8
mov rsi, rcx
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x1401a42d0
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a42d0
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a42d0
cmp dword [0x1402b5e88], 0x3e
jae 0x1401a42c6
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401a42d0
mov ebx, 0x8007007e
jmp 0x1401a43fb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401a43f6
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401a43f6
cmp dword [rdx + rcx], 0x4550
jne 0x1401a43f6
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401a43f6
cmp dword [rdx + 4], r14d
je 0x1401a43f6
lea r8, [rcx + rax]
mov word [rsp + 0x20], r14w
lea r9, str.DllGetClassObject
call fcn.140174840
test rax, rax
je 0x1401a43f6
lea r8, [rsp + 0x38]
lea rdx, [0x140208ae0]
lea rcx, [0x140286a20]
call qword [str.PB__]
mov ebx, eax
test eax, eax
js 0x1401a438f
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x88]
lea r8, [0x140286a98]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [str.PB__]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PB__]
test ebx, ebx
jne 0x1401a43fb
mov rcx, qword [rsp + 0x88]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [str.PB__]
mov ebx, eax
test eax, eax
jne 0x1401a43fb
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x30]
lea rdx, [0x140286aa8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [str.PB__]
mov ebx, eax
test eax, eax
jne 0x1401a43fb
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [str.PB__]
mov ebx, eax
jmp 0x1401a43fb
mov ebx, 0x8007007f
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401a4412
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PB__]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1401a442c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PB__]
test ebx, ebx
jne 0x1401a4438
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1401c0360
Capabilities:
Parse pe header

Disassembly:
mov qword ss:[rsp + 8], rbx
push rdi
sub rsp, 0x90
test byte [0x1402bcb90], 1
mov rbx, rdx
mov rdi, rcx
jne 0x1401c047c
lock bts qword [0x1402bcb90], 0x1f
jae 0x1401c03b2
test byte [0x1402bcb90], 1
jne 0x1401c047c
xor edx, edx
lea rcx, [0x1402bcb90]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401c047c
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401c0411
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401c0411
cmp dword [0x1402b5e88], 0x3e
jae 0x1401c0470
xor r8d, r8d
lea rcx, str.cryptui.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401c0470
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401c0467
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c0467
cmp dword [rdx + rcx], 0x4550
jne 0x1401c0467
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c0467
cmp dword [rdx + 4], 0
je 0x1401c0467
lea r8, ds:[rcx + rax]
xor eax, eax
lea r9, str.CryptUIDlgViewSignerInfoW
mov word [rsp + 0x20], ax
call fcn.140174840
jmp 0x1401c0469
xor eax, eax
mov qword [0x1402c3e50], rax
lea rcx, [0x1402bcb90]
call sym.SystemInformer.exe_PhfSetEvent
mov rax, qword [0x1402c3e50]
test rax, rax
je 0x1401c0506
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x60
xor ecx, ecx
mov qword [rsp + 0x88], rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
test rbx, rbx
je 0x1401c0506
nop
cmp dword [rbx + 0x78], ecx
jbe 0x1401c0506
mov rdx, qword [rbx + 0x80]
test rdx, rdx
je 0x1401c0506
mov rcx, qword ds:[rdi + 0x20]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x58], rcx
lea rcx, str.1.3.6.1.5.5.7.3.3
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x30]
call qword [str.PB__]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x1401c3560
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov ebp, 4
mov rbx, rdx
mov rsi, rcx
mov edx, ebp
mov rcx, qword [0x1402bfe50]
lea r8d, [rbp + 0x14]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
xorps xmm0, xmm0
mov rdi, rax
mov rcx, rbx
xor eax, eax
cmp dword [0x1402b5e88], 0x3f
mov dword [rsp + 0x20], eax
cmovae edx, ebp
xor r9d, r9d
movups xmmword [rdi], xmm0
xor r8d, r8d
mov qword [rdi + 0x10], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword ds:[rdi], rax
test rax, rax
jne 0x1401c35e6
mov rcx, qword [0x1402bfe50]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x1402b5e88], 0x3f
lea r8, [rsp + 0x70]
mov r9d, ebp
mov edx, 0x54
mov rcx, rax
jae 0x1401c360c
mov dword [rsp + 0x70], 0xa00
jmp 0x1401c3689
mov dword [rsp + 0x70], 0x2800
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
mov r9d, ebp
mov dword [rsp + 0x78], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402b5e88]
nop
cmp eax, 0x64
jb 0x1401c366c
mov rcx, qword ds:[rdi]
lea r8, [rsp + 0x30]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov edx, 0x85
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402b5e88]
cmp eax, 0x72
jb 0x1401c368f
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov r9d, ebp
mov edx, 0xc3
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rbx, qword [rsp + 0x60]
mov al, 1
mov qword [rsi], rdi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401c3800
Capabilities:
Prepare http request

Disassembly:
push rbx
sub rsp, 0x40
mov r10d, r9d
mov rbx, rcx
mov rcx, qword [rcx + 8]
and r10d, 1
shl r10d, 0x17
mov eax, r10d
bts eax, 8
test r9b, 2
cmove eax, r10d
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401c3860
add rsp, 0x40
pop rbx
ret
mov r9d, 4
mov dword [rsp + 0x50], 8
lea r8, [rsp + 0x50]
mov rcx, rax
lea edx, [r9 + 0x3b]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x1401c38e0
Capabilities:
Receive http response

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1401c3940
Capabilities:
Set http header

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
mov eax, r8d
test eax, eax
mov r8d, 0xffffffff
mov r9d, 0xa0000000
cmovne r8d, eax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
setne al
add rsp, 0x28
ret