joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c2a20
Capabilities:
Parse pe header

Disassembly:
mov qword ss:[rsp + 8], rbx
push rdi
sub rsp, 0x90
test byte [0x1402c1e30], 1
mov rbx, rdx
mov rdi, rcx
jne 0x1401c2b3c
lock bts qword [0x1402c1e30], 0x1f
jae 0x1401c2a72
test byte [0x1402c1e30], 1
jne 0x1401c2b3c
xor edx, edx
lea rcx, [0x1402c1e30]
call sym.SystemInformer.exe_QifWaitForEvent
jmp 0x1401c2b3c
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401c2ad1
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401c2ad1
cmp dword [0x1402baf40], 0x3e
jae 0x1401c2b30
xor r8d, r8d
lea rcx, str.cryptui.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401c2b30
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401c2b27
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c2b27
cmp dword [rdx + rcx], 0x4550
jne 0x1401c2b27
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c2b27
cmp dword [rdx + 4], 0
je 0x1401c2b27
lea r8, ds:[rcx + rax]
xor eax, eax
lea r9, str.CryptUIDlgViewSignerInfoW
mov word [rsp + 0x20], ax
call fcn.140177a80
jmp 0x1401c2b29
xor eax, eax
mov qword [0x1402c9118], rax
lea rcx, [0x1402c1e30]
call sym.SystemInformer.exe_QifSetEvent
mov rax, qword [0x1402c9118]
test rax, rax
je 0x1401c2bc6
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x60
xor ecx, ecx
mov qword [rsp + 0x88], rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
test rbx, rbx
je 0x1401c2bc6
nop
cmp dword [rbx + 0x78], ecx
jbe 0x1401c2bc6
mov rdx, qword [rbx + 0x80]
test rdx, rdx
je 0x1401c2bc6
mov rcx, qword ds:[rdi + 0x20]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x58], rcx
lea rcx, str.1.3.6.1.5.5.7.3.3
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x30]
call qword [case.0x14013b5a0.0]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x1401c5ce0
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov ebp, 4
mov rbx, rdx
mov rsi, rcx
mov edx, ebp
mov rcx, qword [0x1402c5110]
lea r8d, [rbp + 0x14]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
xorps xmm0, xmm0
mov rdi, rax
mov rcx, rbx
xor eax, eax
cmp dword [0x1402baf40], 0x3f
mov dword [rsp + 0x20], eax
cmovae edx, ebp
xor r9d, r9d
movups xmmword [rdi], xmm0
xor r8d, r8d
mov qword [rdi + 0x10], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword ds:[rdi], rax
test rax, rax
jne 0x1401c5d66
mov rcx, qword [0x1402c5110]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x1402baf40], 0x3f
lea r8, [rsp + 0x70]
mov r9d, ebp
mov edx, 0x54
mov rcx, rax
jae 0x1401c5d8c
mov dword [rsp + 0x70], 0xa00
jmp 0x1401c5e09
mov dword [rsp + 0x70], 0x2800
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
mov r9d, ebp
mov dword [rsp + 0x78], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402baf40]
nop
cmp eax, 0x64
jb 0x1401c5dec
mov rcx, qword ds:[rdi]
lea r8, [rsp + 0x30]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov edx, 0x85
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402baf40]
cmp eax, 0x72
jb 0x1401c5e0f
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov r9d, ebp
mov edx, 0xc3
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rbx, qword [rsp + 0x60]
mov al, 1
mov qword [rsi], rdi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401c5f80
Capabilities:
Prepare http request

Disassembly:
push rbx
sub rsp, 0x40
mov r10d, r9d
mov rbx, rcx
mov rcx, qword [rcx + 8]
and r10d, 1
shl r10d, 0x17
mov eax, r10d
bts eax, 8
test r9b, 2
cmove eax, r10d
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401c5fe0
add rsp, 0x40
pop rbx
ret
mov r9d, 4
mov dword [rsp + 0x50], 8
lea r8, [rsp + 0x50]
mov rcx, rax
lea edx, [r9 + 0x3b]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x1401c6060
Capabilities:
Receive http response

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1401c60c0
Capabilities:
Set http header

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
mov eax, r8d
test eax, eax
mov r8d, 0xffffffff
mov r9d, 0xa0000000
cmovne r8d, eax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1401c6100
Capabilities:
Read http header

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
lea rax, [rsp + 0x50]
mov rsi, rcx
mov qword [rsp + 0x28], rbp
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], ebp
lea edx, [rbp + 0x16]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1401c6145
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
cmp eax, 0x7a
jne 0x1401c61b5
mov rdx, qword [0x1402c4fb8]
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rdi, rax
mov qword [rsp + 0x28], rbp
xor r8d, r8d
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], bp
lea edx, [r8 + 0x16]
mov r9, qword [rdi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x1401c61bf
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401c61b5
call fcn.14013fb00
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rax, rdi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401c61e0
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
lea rax, [rsp + 0x50]
mov rsi, rdx
mov qword [rsp + 0x28], r14
mov rbp, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
mov r8, rdx
xor r9d, r9d
mov dword [rsp + 0x50], r14d
mov edx, 0xffff
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop
test eax, eax
jne 0x1401c622f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401c62aa
mov rdx, qword [0x1402c4fb8]
mov qword [rsp + 0x58], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rdi, rax
mov qword [rsp + 0x28], r14
mov r8, rsi
mov edx, 0xffff
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], r14w
mov r9, qword [rdi + 8]
mov rcx, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x1401c62ba
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401c62aa
call fcn.14013fb00
xor eax, eax
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov r8, qword [rdi + 8]
xorps xmm1, xmm1
mov rax, r8
mov ecx, r8d
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401c62ed
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x1401c62e9
mov eax, ecx
shr rax, 1
jmp 0x1401c6323
add rax, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x1401c6315
nop dword [rax]
add rax, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x1401c6300
sub rax, r8
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rbp, qword [rsp + 0x68]
add rax, rax
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401c6380
Capabilities:
Read http header

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rcx, qword [rcx + 0x10]
mov eax, edx
mov r10d, edx
mov dword [rsp + 0x30], 0x100
and al, 1
mov rsi, r8
neg al
lea rax, [rsp + 0x30]
sbb r9d, r9d
and r9d, 5
mov edx, r9d
or edx, 0x13
test r10b, 2
cmove edx, r9d
xor ebx, ebx
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1401c649d
mov eax, dword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov qword [rsp + 0x278], rdi
mov r9d, eax
xor dil, dil
test rax, rax
je 0x1401c642e
movzx ecx, word [rsp + 0x40]
cmp cx, 0x2d
je 0x1401c641d
cmp cx, 0x2b
jne 0x1401c642e
cmp cx, 0x2d
lea r11, [rsp + 0x42]
lea r9, [rax - 2]
sete dil
shr r9, 1
mov r10b, 1
mov rax, rbx
je 0x1401c647c
mov qword [rsp + 0x250], r14
lea r14, [0x140287de0]
nop dword [rax + rax]
movzx ecx, byte [r11 + rax*2]
mov r8d, dword [r14 + rcx*4]
cmp r8d, 0xa
jae 0x1401c6469
lea rdx, [rbx + rbx*4]
lea rbx, [r8 + rdx*2]
jmp 0x1401c646c
xor r10b, r10b
inc rax
cmp rax, r9
jb 0x1401c6450
mov r14, qword [rsp + 0x250]
mov rax, rbx
neg rax
test dil, dil
mov rdi, qword [rsp + 0x278]
cmove rax, rbx
test r10b, r10b
je 0x1401c649d
mov qword [rsi], rax
mov al, 1
jmp 0x1401c649f
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x258
pop rsi
pop rbx
ret
Function at 0x1401c65c0
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x1040
call fcn.1402063e0
sub rsp, rax
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov r14, r8
mov r15, rdx
mov rbp, rcx
mov edi, 0x1000
mov rcx, qword [0x1402c5110]
mov r8d, edi
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x20]
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov rbx, rax
xor esi, esi
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1401c66e1
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x1401c66ab
lea eax, ds:[rcx + rsi]
cmp edi, eax
jae 0x1401c6678
mov rcx, qword [0x1402c5110]
add edi, edi
mov r9d, edi
mov edx, 4
test rbx, rbx
jne 0x1401c6668
mov r8d, r9d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401c6671
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ecx, dword [rsp + 0x20]
mov rbx, rax
mov r8d, ecx
lea rdx, [rsp + 0x30]
mov ecx, esi
add rcx, rbx
call fcn.1402074d0
add esi, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x1401c6631
lea eax, [rsi + 1]
cmp edi, eax
jae 0x1401c66e1
lea r9d, [rdi + 1]
lfence
mov rcx, qword [0x1402c5110]
mov edx, 4
test rbx, rbx
jne 0x1401c66d5
mov r8d, r9d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401c66de
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov rbx, rax
mov byte [rsi + rbx], 0
test esi, esi
je 0x1401c6712
test r15, r15
je 0x1401c66f3
mov qword [r15], rbx
jmp 0x1401c6706
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r14, r14
je 0x1401c670e
mov dword [r14], esi
mov al, 1
jmp 0x1401c6728
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401e0100
mov rbx, qword [rsp + 0x1088]
add rsp, 0x1040
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401c75e0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
lea rbx, str.CryptoWinRT.dll
mov qword [rsp + 0x38], 0x1e
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x40], rbx
mov rsi, rcx
xor edi, edi
call fcn.1401776c0
mov r10, rax
test rax, rax
jne 0x1401c7672
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401c7672
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401c7672
cmp dword [0x1402baf40], 0x3e
jae 0x1401c784a
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
je 0x1401c784a
lea r8, str.Windows.Security.Cryptography.CryptographicBuffer
mov dword [rsp + 0x48], 1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1401c76b8
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x88], ecx
je 0x1401c76b4
mov edx, ecx
shr rdx, 1
jmp 0x1401c76fb
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x88], ecx
jne 0x1401c76ed
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x88], ecx
je 0x1401c76d0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov eax, 0x5a4d
mov dword [rsp + 0x4c], edx
mov qword [rsp + 0x58], r8
cmp word [r10], ax
jne 0x1401c784a
mov ecx, dword ds:[r10 + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c784a
cmp dword [rcx + r10], 0x4550
jne 0x1401c784a
lea rdx, [r10 + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c784a
cmp dword [rdx + 4], edi
je 0x1401c784a
lea r8, [r10 + rax]
mov word [rsp + 0x20], di
lea r9, str.DllGetActivationFactory
mov rcx, r10
call fcn.140177a80
test rax, rax
je 0x1401c784a
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x48]
call qword [case.0x14013b5a0.0]
mov ebx, eax
test eax, eax
js 0x1401c77c7
mov rcx, qword [rsp + 0x90]
lea r8, [rsp + 0x30]
lea rdx, [0x14028be28]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14013b5a0.0]
mov rcx, qword [rsp + 0x90]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013b5a0.0]
test ebx, ebx
js 0x1401c784a
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x98]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
call qword [case.0x14013b5a0.0]
test eax, eax
js 0x1401c7838
mov rcx, qword [rsp + 0x98]
call fcn.1401c7540
mov r8, qword [rsp + 0x98]
mov rdi, rax
test r8, r8
je 0x1401c7838
test byte [r8], 1
jne 0x1401c7838
mov ecx, 0xffffffff
lock xadd dword [r8 + 0x18], ecx
cmp ecx, 1
jne 0x1401c7838
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013b5a0.0]
mov rax, rdi
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401c7c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test byte [0x1402c1e80], 1
movzx edi, dl
mov rbx, rcx
jne 0x1401c7cb7
lock bts qword [0x1402c1e80], 0x1f
jae 0x1401c7c9e
test byte [0x1402c1e80], 1
jne 0x1401c7cb7
xor edx, edx
lea rcx, [0x1402c1e80]
call sym.SystemInformer.exe_QifWaitForEvent
jmp 0x1401c7cb7
nop
call fcn.1401471a0
lea rcx, [0x1402c1e80]
mov dword [0x1402c8368], eax
call sym.SystemInformer.exe_QifSetEvent
mov eax, dword [0x1402c8368]
nop dword [rax]
cmp eax, 0xffffffff
je 0x1401c7d77
test dil, dil
je 0x1401c7d32
cmp dword [0x1402baf40], 0xffffffff
jae 0x1401c7d01
cmp eax, 0x40
jae 0x1401c7d01
mov rcx, qword gs:[0x30]
mov eax, dword [0x1402c8368]
mov qword [rcx + rax*8 + 0x1480], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1401c7d24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
nop dword [rax]
test eax, eax
js 0x1401c7d77
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [0x1402baf40], 0xffffffff
jae 0x1401c7d64
nop dword [rax + rax]
cmp eax, 0x40
jae 0x1401c7d64
lfence
mov rcx, qword gs:[0x30]
mov rax, qword [rcx + rax*8 + 0x1480]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401c8740
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
test byte [0x1402c1e70], 1
jne 0x1401c8913
lock bts qword [0x1402c1e70], 0x1f
jae 0x1401c8784
test byte [0x1402c1e70], 1
jne 0x1401c8913
xor edx, edx
lea rcx, [0x1402c1e70]
call sym.SystemInformer.exe_QifWaitForEvent
movzx eax, byte [0x1402c5476]
add rsp, 0x48
ret
lea rax, str.kernelbase.dll
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x30], 0x1c
call fcn.1401776c0
mov rsi, rax
test rax, rax
je 0x1401c88d6
mov qword [rsp + 0x58], rbp
mov ebp, 0x5a4d
mov qword [rsp + 0x40], rdi
cmp word [rax], bp
jne 0x1401c8815
mov ecx, dword [rax + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c8815
cmp dword [rcx + rsi], 0x4550
jne 0x1401c8815
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c8815
cmp dword [rdx + 4], 0
je 0x1401c8815
xor ebx, ebx
lea r8, [rsi + rax]
lea r9, str.OpenPackageInfoByFullNameForUser
mov word [rsp + 0x20], bx
mov rcx, rsi
call fcn.140177a80
jmp 0x1401c8819
xor ebx, ebx
mov eax, ebx
mov qword [0x1402c9190], rax
cmp word [rsi], bp
jne 0x1401c886b
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c886b
cmp dword [rcx + rsi], 0x4550
jne 0x1401c886b
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c886b
cmp dword [rdx + 4], 0
je 0x1401c886b
lea r8, [rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.GetPackageApplicationIds
mov rcx, rsi
call fcn.140177a80
jmp 0x1401c886e
mov rax, rbx
cmp word [rsi], bp
mov rbp, qword [rsp + 0x58]
mov qword [0x1402c9188], rax
jne 0x1401c88c8
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c88c8
cmp dword [rcx + rsi], 0x4550
jne 0x1401c88c8
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c88c8
cmp dword [rdx + 4], 0
je 0x1401c88c8
lea r8, ds:[rsi + rax]
mov word [rsp + 0x20], bx
lea r9, str.ClosePackageInfo
mov rcx, rsi
call fcn.140177a80
mov rbx, rax
mov rdi, qword [rsp + 0x40]
mov qword [0x1402c9180], rbx
jmp 0x1401c88dd
mov rbx, qword [0x1402c9180]
cmp qword [0x1402c9190], 0
mov rsi, qword [rsp + 0x60]
je 0x1401c8902
cmp qword [0x1402c9188], 0
je 0x1401c8902
test rbx, rbx
je 0x1401c8902
mov byte [0x1402c5476], 1
lea rcx, [0x1402c1e70]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
movzx eax, byte [0x1402c5476]
add rsp, 0x48
ret
Function at 0x1401cf580
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, dword [rcx + 0x30]
mov eax, 0x38
mov r8d, edi
mov rsi, rdx
and r8d, 0x3f
mov rbp, rcx
sub eax, r8d
lea rcx, [rsp + 0x21]
mov ebx, 0x78
sub ebx, r8d
cmp r8d, 0x38
cmovb ebx, eax
xor edx, edx
lea eax, [rbx - 1]
movsxd r8, eax
call fcn.140207110
movsxd rax, ebx
lea rdx, [rsp + 0x20]
add rdx, rax
mov byte [rsp + 0x20], 0x80
mov eax, dword [rbp + 0x2c]
lea r8d, [rbx + 8]
shl eax, 3
mov ecx, edi
shr ecx, 0x1d
or ecx, eax
lea eax, [rdi*8]
bswap ecx
mov dword [rdx], ecx
mov rcx, rbp
bswap eax
mov dword [rdx + 4], eax
lea rdx, [rsp + 0x20]
call fcn.1401cf4a0
mov ecx, dword [rbp + 0x18]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shr edx, 8
and ecx, 0xff00
shl eax, 0x10
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsi], edx
mov ecx, dword [rbp + 0x1c]
mov edx, ecx
shl edx, 0x10
mov eax, ecx
and eax, 0xff00
shr ecx, 8
or edx, eax
and ecx, 0xff00
movzx eax, byte [rbp + 0x1f]
shl edx, 8
or edx, ecx
or edx, eax
mov dword [rsi + 4], edx
mov ecx, dword [rbp + 0x20]
mov edx, ecx
shl edx, 0x10
mov eax, ecx
and eax, 0xff00
shr ecx, 8
or edx, eax
and ecx, 0xff00
movzx eax, byte [rbp + 0x23]
shl edx, 8
or edx, ecx
or edx, eax
mov dword [rsi + 8], edx
mov ecx, dword [rbp + 0x24]
mov edx, ecx
shl edx, 0x10
mov eax, ecx
and eax, 0xff00
or edx, eax
shl edx, 8
movzx eax, byte [rbp + 0x27]
shr ecx, 8
and ecx, 0xff00
or edx, ecx
or edx, eax
mov dword [rsi + 0xc], edx
mov ecx, dword [rbp + 0x28]
mov eax, ecx
and eax, 0xff00
mov edx, ecx
shl edx, 0x10
or edx, eax
shr ecx, 8
movzx eax, byte [rbp + 0x2b]
and ecx, 0xff00
shl edx, 8
or edx, eax
or edx, ecx
mov dword [rsi + 0x10], edx
xor eax, eax
mov qword [rbp + 0x2c], rax
mov dword [rbp + 0x18], 0x67452301
mov dword [rbp + 0x1c], 0xefcdab89
mov dword [rbp + 0x20], 0x98badcfe
mov dword [rbp + 0x24], 0x10325476
mov dword [rbp + 0x28], 0xc3d2e1f0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401e0100
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401d63c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x1f90]
mov eax, 0x2090
call fcn.1402063e0
sub rsp, rax
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0x1f80], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp + 0x1f78]
xor r9d, r9d
mov qword [rsp + 0x70], rax
lea rax, [0x1402c1ee0]
mov qword [rsp + 0x28], rax
lea rax, [0x1401d6a50]
mov qword [rsp + 0x20], rax
call fcn.1401d9520
test eax, eax
js 0x1401d6506
xor ebx, ebx
test eax, eax
mov rax, qword [rsp + 0x68]
jle 0x1401d64ae
nop
cmp rax, qword [rsp + 0x70]
jb 0x1401d649e
lea rcx, [rsp + 0x78]
cmp rax, rcx
je 0x1401d649e
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x60]
sub eax, ecx
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x60]
sub eax, 0x18
mov dword [rsp + 0x30], eax
xor r9d, r9d
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x1401d6506
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov byte [rax], 0xa
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x78]
cmp rax, rcx
je 0x1401d6502
mov eax, dword [rsp + 0x68]
lea rcx, [rsp + 0x60]
sub eax, ecx
mov qword [rsp + 0x40], rbx
mov rcx, qword [rsp + 0x60]
sub eax, 0x18
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
setns bl
dec ebx
mov eax, ebx
jmp 0x1401d650b
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x1f80]
xor rcx, rsp
call fcn.1401e0100
mov rbx, qword [rsp + 0x20b8]
add rsp, 0x2090
pop rbp
ret

Function at 0x1401d6b00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
test rcx, rcx
je 0x1401d6b74
xor eax, eax
lea rdi, [rcx + 0x18]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], 0x2000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x1401d6b74
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1401d6b74
add rax, 0x18
mov qword [rbx + 8], rdi
add rax, rbx
mov qword [rbx + 0x10], rax
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov eax, 0xffffffff
add rsp, 0x60
pop rdi
ret
Function at 0x1401d6ba0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
test rcx, rcx
je 0x1401d6c09
mov rax, qword [rcx + 8]
lea rdi, [rcx + 0x18]
cmp rax, rdi
je 0x1401d6bfc
xor ecx, ecx
sub eax, ebx
mov qword [rsp + 0x40], rcx
sub eax, 0x18
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov rcx, qword [rbx]
xor r8d, r8d
mov dword [rsp + 0x30], eax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x1401d6c09
mov qword [rbx + 8], rdi
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov eax, 0xffffffff
add rsp, 0x60
pop rdi
ret