joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016fae0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1030], 1
jne 0x14016fc60
lock bts qword [0x1402c1030], 0x1f
nop
jae 0x14016fb25
test byte [0x1402c1030], 1
jne 0x14016fc60
xor edx, edx
lea rcx, [0x1402c1030]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016fc60
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016fbb2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016fbb2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016fbb2
cmp dword [0x1402baf40], 0x3e
jae 0x14016fc4f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016fc4f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016fc4f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016fc4f
cmp dword [rdx + rcx], 0x4550
jne 0x14016fc4f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016fc4f
cmp dword [rdx + 4], edi
je 0x14016fc4f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDeriveCapabilitySidsFromName
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016fc4f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c86a0], rax
xor rax, r9
mov qword [0x1402c8670], rax
lea rcx, [0x1402c1030]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8670]
test rax, rax
je 0x14016fc81
mov rcx, qword [0x1402c86a0]
test rcx, rcx
je 0x14016fc81
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016fca0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c0fb0], 1
jne 0x14016fe20
lock bts qword [0x1402c0fb0], 0x1f
nop
jae 0x14016fce5
test byte [0x1402c0fb0], 1
jne 0x14016fe20
xor edx, edx
lea rcx, [0x1402c0fb0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016fe20
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016fd72
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016fd72
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016fd72
cmp dword [0x1402baf40], 0x3e
jae 0x14016fe0f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016fe0f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016fe0f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016fe0f
cmp dword [rdx + rcx], 0x4550
jne 0x14016fe0f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016fe0f
cmp dword [rdx + 4], edi
je 0x14016fe0f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertSecurityDescriptorToStringSecurityDescriptorW
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016fe0f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c85f0], rax
xor rax, r9
mov qword [0x1402c8580], rax
lea rcx, [0x1402c0fb0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8580]
test rax, rax
je 0x14016fe41
mov rcx, qword [0x1402c85f0]
test rcx, rcx
je 0x14016fe41
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016fe60
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c10c0], 1
jne 0x14016ffe0
lock bts qword [0x1402c10c0], 0x1f
nop
jae 0x14016fea5
test byte [0x1402c10c0], 1
jne 0x14016ffe0
xor edx, edx
lea rcx, [0x1402c10c0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016ffe0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.advapi32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016ff32
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016ff32
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016ff32
cmp dword [0x1402baf40], 0x3e
jae 0x14016ffcf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016ffcf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016ffcf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016ffcf
cmp dword [rdx + rcx], 0x4550
jne 0x14016ffcf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016ffcf
cmp dword [rdx + 4], edi
je 0x14016ffcf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016ffcf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8640], rax
xor rax, r9
mov qword [0x1402c8608], rax
lea rcx, [0x1402c10c0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8608]
test rax, rax
je 0x140170001
mov rcx, qword [0x1402c8640]
test rcx, rcx
je 0x140170001
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170020
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1040], 1
jne 0x1401701a0
lock bts qword [0x1402c1040], 0x1f
nop
jae 0x140170065
test byte [0x1402c1040], 1
jne 0x1401701a0
xor edx, edx
lea rcx, [0x1402c1040]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x1401701a0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.shlwapi.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x1401700f2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401700f2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401700f2
cmp dword [0x1402baf40], 0x3e
jae 0x14017018f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017018f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017018f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017018f
cmp dword [rdx + rcx], 0x4550
jne 0x14017018f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017018f
cmp dword [rdx + 4], edi
je 0x14017018f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.SHAutoComplete
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14017018f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c85b0], rax
xor rax, r9
mov qword [0x1402c8630], rax
lea rcx, [0x1402c1040]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8630]
test rax, rax
je 0x1401701c1
mov rcx, qword [0x1402c85b0]
test rcx, rcx
je 0x1401701c1
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401701e0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1060], 1
jne 0x140170360
lock bts qword [0x1402c1060], 0x1f
nop
jae 0x140170225
test byte [0x1402c1060], 1
jne 0x140170360
xor edx, edx
lea rcx, [0x1402c1060]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x140170360
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x1401702b2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401702b2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401702b2
cmp dword [0x1402baf40], 0x3e
jae 0x14017034f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017034f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017034f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017034f
cmp dword [rdx + rcx], 0x4550
jne 0x14017034f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017034f
cmp dword [rdx + 4], edi
je 0x14017034f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssCaptureSnapshot
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14017034f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c86b8], rax
xor rax, r9
mov qword [0x1402c8598], rax
lea rcx, [0x1402c1060]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8598]
test rax, rax
je 0x140170381
mov rcx, qword [0x1402c86b8]
test rcx, rcx
je 0x140170381
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401703a0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c10e0], 1
jne 0x140170520
lock bts qword [0x1402c10e0], 0x1f
nop
jae 0x1401703e5
test byte [0x1402c10e0], 1
jne 0x140170520
xor edx, edx
lea rcx, [0x1402c10e0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x140170520
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x140170472
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170472
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170472
cmp dword [0x1402baf40], 0x3e
jae 0x14017050f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017050f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017050f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017050f
cmp dword [rdx + rcx], 0x4550
jne 0x14017050f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017050f
cmp dword [rdx + 4], edi
je 0x14017050f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssQuerySnapshot
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14017050f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c85a8], rax
xor rax, r9
mov qword [0x1402c8578], rax
lea rcx, [0x1402c10e0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8578]
test rax, rax
je 0x140170541
mov rcx, qword [0x1402c85a8]
test rcx, rcx
je 0x140170541
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170560
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1100], 1
jne 0x1401706e0
lock bts qword [0x1402c1100], 0x1f
nop
jae 0x1401705a5
test byte [0x1402c1100], 1
jne 0x1401706e0
xor edx, edx
lea rcx, [0x1402c1100]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x1401706e0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.kernel32.dll
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x140170632
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170632
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170632
cmp dword [0x1402baf40], 0x3e
jae 0x1401706cf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401706cf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401706cf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401706cf
cmp dword [rdx + rcx], 0x4550
jne 0x1401706cf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401706cf
cmp dword [rdx + 4], edi
je 0x1401706cf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PssFreeSnapshot
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x1401706cf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8668], rax
xor rax, r9
mov qword [0x1402c85c0], rax
lea rcx, [0x1402c1100]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c85c0]
test rax, rax
je 0x140170701
mov rcx, qword [0x1402c8668]
test rcx, rcx
je 0x140170701
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170720
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c10b0], 1
jne 0x1401708a0
lock bts qword [0x1402c10b0], 0x1f
nop
jae 0x140170765
test byte [0x1402c10b0], 1
jne 0x1401708a0
xor edx, edx
lea rcx, [0x1402c10b0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x1401708a0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x1401707f2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401707f2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401707f2
cmp dword [0x1402baf40], 0x3e
jae 0x14017088f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14017088f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017088f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14017088f
cmp dword [rdx + rcx], 0x4550
jne 0x14017088f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017088f
cmp dword [rdx + 4], edi
je 0x14017088f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.CreateEnvironmentBlock
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14017088f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c85e8], rax
xor rax, r9
mov qword [0x1402c8688], rax
lea rcx, [0x1402c10b0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8688]
test rax, rax
je 0x1401708c1
mov rcx, qword [0x1402c85e8]
test rcx, rcx
je 0x1401708c1
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1401708e0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c0fe0], 1
jne 0x140170a60
lock bts qword [0x1402c0fe0], 0x1f
nop
jae 0x140170925
test byte [0x1402c0fe0], 1
jne 0x140170a60
xor edx, edx
lea rcx, [0x1402c0fe0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x140170a60
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x1401709b2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401709b2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401709b2
cmp dword [0x1402baf40], 0x3e
jae 0x140170a4f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140170a4f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140170a4f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170a4f
cmp dword [rdx + rcx], 0x4550
jne 0x140170a4f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170a4f
cmp dword [rdx + 4], edi
je 0x140170a4f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.DestroyEnvironmentBlock
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x140170a4f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c85b8], rax
xor rax, r9
mov qword [0x1402c8620], rax
lea rcx, [0x1402c0fe0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8620]
test rax, rax
je 0x140170a81
mov rcx, qword [0x1402c85b8]
test rcx, rcx
je 0x140170a81
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170aa0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c10d0], 1
jne 0x140170c20
lock bts qword [0x1402c10d0], 0x1f
nop
jae 0x140170ae5
test byte [0x1402c10d0], 1
jne 0x140170c20
xor edx, edx
lea rcx, [0x1402c10d0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x140170c20
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, str.userenv.dll
mov qword [rsp + 0x30], 0x16
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x140170b72
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170b72
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170b72
cmp dword [0x1402baf40], 0x3e
jae 0x140170c0f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140170c0f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140170c0f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170c0f
cmp dword [rdx + rcx], 0x4550
jne 0x140170c0f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170c0f
cmp dword [rdx + 4], edi
je 0x140170c0f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetAppContainerRegistryLocation
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x140170c0f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8660], rax
xor rax, r9
mov qword [0x1402c8618], rax
lea rcx, [0x1402c10d0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8618]
test rax, rax
je 0x140170c41
mov rcx, qword [0x1402c8660]
test rcx, rcx
je 0x140170c41
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140170c60
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c0fc0], 1
jne 0x140170de0
lock bts qword [0x1402c0fc0], 0x1f
nop
jae 0x140170ca5
test byte [0x1402c0fc0], 1
jne 0x140170de0
xor edx, edx
lea rcx, [0x1402c0fc0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x140170de0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x140264380]
mov qword [rsp + 0x30], 0x14
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x140170d32
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170d32
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140170d32
cmp dword [0x1402baf40], 0x3e
jae 0x140170dcf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140170dcf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140170dcf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170dcf
cmp dword [rdx + rcx], 0x4550
jne 0x140170dcf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170dcf
cmp dword [rdx + 4], edi
je 0x140170dcf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.SetWindowDisplayAffinity
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x140170dcf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8568], rax
xor rax, r9
mov qword [0x1402c8658], rax
lea rcx, [0x1402c0fc0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8658]
test rax, rax
je 0x140170e01
mov rcx, qword [0x1402c8568]
test rcx, rcx
je 0x140170e01
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140171aa0
Capabilities:
Enumerate services

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov eax, dword [0x1402baf40]
mov r15, rdx
mov r12, rcx
cmp eax, 0x66
jb 0x140171acc
mov edi, 0x3ff
jmp 0x140171adc
cmp eax, 0x64
mov edi, 0x3b
mov ecx, 0x1ff
cmovae edi, ecx
xor r13d, r13d
xor eax, eax
lock cmpxchg qword [0x1402c86e0], r13
mov rbp, rax
jne 0x140171b26
xor edx, edx
lea r8d, [r13 + 5]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rcx, rax
test rax, rax
je 0x140171b26
xor eax, eax
lock cmpxchg qword [0x1402c86e0], rcx
mov rbp, rax
jne 0x140171b1a
mov rbp, rcx
jmp 0x140171b26
nop word [rax + rax]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [0x1402c11d0]
mov edx, 4
mov rcx, qword [0x1402c5110]
mov r8d, esi
mov qword [rsp + 0x90], rbx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x48], r13
mov r9d, 3
mov r14, rax
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0xa8]
mov r8d, edi
mov qword [rsp + 0x38], rax
xor edx, edx
lea rax, [rsp + 0xa0]
mov rcx, rbp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x140171c5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov ebx, eax
cmp eax, 0x105
jne 0x140171c3d
mov rcx, qword [0x1402c5110]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add esi, dword ds:[rsp + 0xa0]
mov edx, 4
mov rcx, qword [0x1402c5110]
mov r8d, esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x48], r13
mov r9d, 3
mov r14, rax
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0xa8]
mov r8d, edi
mov qword [rsp + 0x38], rax
xor edx, edx
lea rax, [rsp + 0xa0]
mov rcx, rbp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x140171c5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov ebx, eax
nop dword [rax]
test ebx, ebx
jns 0x140171c5e
lfence
mov rcx, qword [0x1402c5110]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140171c7d
mov ebx, r13d
lfence
cmp esi, 0x20000
ja 0x140171c6f
mov dword [0x1402c11d0], esi
mov eax, dword [rsp + 0xa8]
mov dword [r15], eax
mov qword [r12], r14
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret