joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140172bc0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c70b0], 1
jne 0x140172d3c
lock bts qword [0x1402c70b0], 0x1f
setb al
test al, al
je 0x140172c0a
test byte [0x1402c70b0], 1
jne 0x140172d3c
xor edx, edx
lea rcx, [0x1402c70b0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140172d3c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140172c95
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172c95
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172c95
cmp dword [0x1402c0f40], 0x3e
jae 0x140172d2b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140172d2b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140172d2b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140172d2b
cmp dword [rdx + rcx], 0x4550
jne 0x140172d2b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140172d2b
cmp dword [rdx + 4], edi
je 0x140172d2b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerParent
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140172d2b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cefe8], rax
xor rax, r9
mov qword [0x1402cf030], rax
lea rcx, [0x1402c70b0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cf030]
test rax, rax
je 0x140172d5d
mov rcx, qword [0x1402cefe8]
test rcx, rcx
je 0x140172d5d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172d80
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c70e0], 1
jne 0x140172efc
lock bts qword [0x1402c70e0], 0x1f
setb al
test al, al
je 0x140172dca
test byte [0x1402c70e0], 1
jne 0x140172efc
xor edx, edx
lea rcx, [0x1402c70e0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140172efc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023fe60]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140172e55
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172e55
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140172e55
cmp dword [0x1402c0f40], 0x3e
jae 0x140172eeb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140172eeb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140172eeb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140172eeb
cmp dword [rdx + rcx], 0x4550
jne 0x140172eeb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140172eeb
cmp dword [rdx + 4], edi
je 0x140172eeb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDeriveCapabilitySidsFromName
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140172eeb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cf040], rax
xor rax, r9
mov qword [0x1402cf010], rax
lea rcx, [0x1402c70e0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cf010]
test rax, rax
je 0x140172f1d
mov rcx, qword [0x1402cf040]
test rcx, rcx
je 0x140172f1d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140172f40
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7060], 1
jne 0x1401730bc
lock bts qword [0x1402c7060], 0x1f
setb al
test al, al
je 0x140172f8a
test byte [0x1402c7060], 1
jne 0x1401730bc
xor edx, edx
lea rcx, [0x1402c7060]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401730bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140173015
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173015
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173015
cmp dword [0x1402c0f40], 0x3e
jae 0x1401730ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401730ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401730ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401730ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401730ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401730ab
cmp dword [rdx + 4], edi
je 0x1401730ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertSecurityDescriptorToStringSecurityDescriptorW
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x1401730ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef90], rax
xor rax, r9
mov qword [0x1402cef20], rax
lea rcx, [0x1402c7060]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef20]
test rax, rax
je 0x1401730dd
mov rcx, qword [0x1402cef90]
test rcx, rcx
je 0x1401730dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140173100
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7170], 1
jne 0x14017327c
lock bts qword [0x1402c7170], 0x1f
setb al
test al, al
je 0x14017314a
test byte [0x1402c7170], 1
jne 0x14017327c
xor edx, edx
lea rcx, [0x1402c7170]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017327c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401731d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401731d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401731d5
cmp dword [0x1402c0f40], 0x3e
jae 0x14017326b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017326b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017326b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017326b
cmp dword [rdx + rcx], 0x4550
jne 0x14017326b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017326b
cmp dword [rdx + 4], edi
je 0x14017326b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x14017326b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cefe0], rax
xor rax, r9
mov qword [0x1402cefa8], rax
lea rcx, [0x1402c7170]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cefa8]
test rax, rax
je 0x14017329d
mov rcx, qword [0x1402cefe0]
test rcx, rcx
je 0x14017329d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401732c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c70f0], 1
jne 0x14017343c
lock bts qword [0x1402c70f0], 0x1f
setb al
test al, al
je 0x14017330a
test byte [0x1402c70f0], 1
jne 0x14017343c
xor edx, edx
lea rcx, [0x1402c70f0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017343c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.shlwapi.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140173395
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173395
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173395
cmp dword [0x1402c0f40], 0x3e
jae 0x14017342b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017342b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017342b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017342b
cmp dword [rdx + rcx], 0x4550
jne 0x14017342b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017342b
cmp dword [rdx + 4], edi
je 0x14017342b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.SHAutoComplete
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x14017342b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef50], rax
xor rax, r9
mov qword [0x1402cefd0], rax
lea rcx, [0x1402c70f0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cefd0]
test rax, rax
je 0x14017345d
mov rcx, qword [0x1402cef50]
test rcx, rcx
je 0x14017345d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140173480
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7110], 1
jne 0x1401735fc
lock bts qword [0x1402c7110], 0x1f
setb al
test al, al
je 0x1401734ca
test byte [0x1402c7110], 1
jne 0x1401735fc
xor edx, edx
lea rcx, [0x1402c7110]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401735fc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140173555
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173555
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173555
cmp dword [0x1402c0f40], 0x3e
jae 0x1401735eb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401735eb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401735eb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401735eb
cmp dword [rdx + rcx], 0x4550
jne 0x1401735eb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401735eb
cmp dword [rdx + 4], edi
je 0x1401735eb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssCaptureSnapshot
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x1401735eb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cf058], rax
xor rax, r9
mov qword [0x1402cef38], rax
lea rcx, [0x1402c7110]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef38]
test rax, rax
je 0x14017361d
mov rcx, qword [0x1402cf058]
test rcx, rcx
je 0x14017361d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140173640
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7190], 1
jne 0x1401737bc
lock bts qword [0x1402c7190], 0x1f
setb al
test al, al
je 0x14017368a
test byte [0x1402c7190], 1
jne 0x1401737bc
xor edx, edx
lea rcx, [0x1402c7190]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401737bc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140173715
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173715
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173715
cmp dword [0x1402c0f40], 0x3e
jae 0x1401737ab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401737ab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401737ab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401737ab
cmp dword [rdx + rcx], 0x4550
jne 0x1401737ab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401737ab
cmp dword [rdx + 4], edi
je 0x1401737ab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssQuerySnapshot
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x1401737ab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef48], rax
xor rax, r9
mov qword [0x1402cef18], rax
lea rcx, [0x1402c7190]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef18]
test rax, rax
je 0x1401737dd
mov rcx, qword [0x1402cef48]
test rcx, rcx
je 0x1401737dd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140173800
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c71b0], 1
jne 0x14017397c
lock bts qword [0x1402c71b0], 0x1f
setb al
test al, al
je 0x14017384a
test byte [0x1402c71b0], 1
jne 0x14017397c
xor edx, edx
lea rcx, [0x1402c71b0]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017397c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401738d5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401738d5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401738d5
cmp dword [0x1402c0f40], 0x3e
jae 0x14017396b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017396b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017396b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017396b
cmp dword [rdx + rcx], 0x4550
jne 0x14017396b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017396b
cmp dword [rdx + 4], edi
je 0x14017396b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssFreeSnapshot
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x14017396b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cf008], rax
xor rax, r9
mov qword [0x1402cef60], rax
lea rcx, [0x1402c71b0]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cef60]
test rax, rax
je 0x14017399d
mov rcx, qword [0x1402cf008]
test rcx, rcx
je 0x14017399d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401739c0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7160], 1
jne 0x140173b3c
lock bts qword [0x1402c7160], 0x1f
setb al
test al, al
je 0x140173a0a
test byte [0x1402c7160], 1
jne 0x140173b3c
xor edx, edx
lea rcx, [0x1402c7160]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140173b3c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140173a95
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173a95
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173a95
cmp dword [0x1402c0f40], 0x3e
jae 0x140173b2b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140173b2b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140173b2b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140173b2b
cmp dword [rdx + rcx], 0x4550
jne 0x140173b2b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140173b2b
cmp dword [rdx + 4], edi
je 0x140173b2b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.CreateEnvironmentBlock
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140173b2b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef88], rax
xor rax, r9
mov qword [0x1402cf028], rax
lea rcx, [0x1402c7160]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cf028]
test rax, rax
je 0x140173b5d
mov rcx, qword [0x1402cef88]
test rcx, rcx
je 0x140173b5d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140173b80
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7090], 1
jne 0x140173cfc
lock bts qword [0x1402c7090], 0x1f
setb al
test al, al
je 0x140173bca
test byte [0x1402c7090], 1
jne 0x140173cfc
xor edx, edx
lea rcx, [0x1402c7090]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140173cfc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140173c55
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173c55
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173c55
cmp dword [0x1402c0f40], 0x3e
jae 0x140173ceb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140173ceb
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140173ceb
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140173ceb
cmp dword [rdx + rcx], 0x4550
jne 0x140173ceb
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140173ceb
cmp dword [rdx + 4], edi
je 0x140173ceb
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.DestroyEnvironmentBlock
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140173ceb
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef58], rax
xor rax, r9
mov qword [0x1402cefc0], rax
lea rcx, [0x1402c7090]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cefc0]
test rax, rax
je 0x140173d1d
mov rcx, qword [0x1402cef58]
test rcx, rcx
je 0x140173d1d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140173d40
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7180], 1
jne 0x140173ebc
lock bts qword [0x1402c7180], 0x1f
setb al
test al, al
je 0x140173d8a
test byte [0x1402c7180], 1
jne 0x140173ebc
xor edx, edx
lea rcx, [0x1402c7180]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x140173ebc
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140173e15
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173e15
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173e15
cmp dword [0x1402c0f40], 0x3e
jae 0x140173eab
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140173eab
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140173eab
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140173eab
cmp dword [rdx + rcx], 0x4550
jne 0x140173eab
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140173eab
cmp dword [rdx + 4], edi
je 0x140173eab
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetAppContainerRegistryLocation
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x140173eab
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cf000], rax
xor rax, r9
mov qword [0x1402cefb8], rax
lea rcx, [0x1402c7180]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402cefb8]
test rax, rax
je 0x140173edd
mov rcx, qword [0x1402cf000]
test rcx, rcx
je 0x140173edd
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140173f00
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c7070], 1
jne 0x14017407c
lock bts qword [0x1402c7070], 0x1f
setb al
test al, al
je 0x140173f4a
test byte [0x1402c7070], 1
jne 0x14017407c
xor edx, edx
lea rcx, [0x1402c7070]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x14017407c
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x140268980]
mov qword [rsp + 0x30], 0x14
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x140173fd5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173fd5
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140173fd5
cmp dword [0x1402c0f40], 0x3e
jae 0x14017406b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017406b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017406b
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017406b
cmp dword [rdx + rcx], 0x4550
jne 0x14017406b
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017406b
cmp dword [rdx + 4], edi
je 0x14017406b
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.SetWindowDisplayAffinity
call fcn.14017f180
mov r9, rax
test rax, rax
je 0x14017406b
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402cef08], rax
xor rax, r9
mov qword [0x1402ceff8], rax
lea rcx, [0x1402c7070]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402ceff8]
test rax, rax
je 0x14017409d
mov rcx, qword [0x1402cef08]
test rcx, rcx
je 0x14017409d
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret