joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ab9a0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov qword [rax - 0x30], 0x18
mov rbp, rdx
mov qword [rax + 0x20], r14
lea rbx, str.mrmcorer.dll
mov qword [rax - 0x38], r14
lea rdx, [rax - 0x30]
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], rbx
mov rdi, r8
mov rsi, rcx
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x1401aba50
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aba50
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aba50
cmp dword [0x1402bff40], 0x3e
jae 0x1401aba46
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401aba50
mov ebx, 0x8007007e
jmp 0x1401abb72
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401abb08
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401abb08
cmp dword [rdx + rcx], 0x4550
jne 0x1401abb08
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401abb08
cmp dword [rdx + 4], r14d
je 0x1401abb08
lea r8, [rcx + rax]
mov word [rsp + 0x20], r14w
lea r9, str.DllGetClassObject
call fcn.14017e4c0
test rax, rax
je 0x1401abb08
lea r8, [rsp + 0x38]
lea rdx, [0x14020fc00]
lea rcx, [0x14028e710]
call qword [case.0x14013d84a.0]
mov ebx, eax
test eax, eax
js 0x1401abb0d
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x88]
lea r8, [0x14028e788]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14013d84a.0]
mov rcx, qword ds:[rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d84a.0]
jmp 0x1401abb0d
mov ebx, 0x8007007f
test ebx, ebx
jne 0x1401abb72
mov rcx, qword [rsp + 0x88]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x14013d84a.0]
mov ebx, eax
test eax, eax
jne 0x1401abb72
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x30]
lea rdx, [0x14028e798]
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14013d84a.0]
mov ebx, eax
test eax, eax
jne 0x1401abb72
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14013d84a.0]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401abb89
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d84a.0]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1401abba6
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d84a.0]
test ebx, ebx
jne 0x1401abbb2
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1401c71c0
Capabilities:
Parse pe header

Disassembly:
mov qword ss:[rsp + 8], rbx
push rdi
sub rsp, 0x90
test byte [0x1402c6f00], 1
mov rbx, rdx
mov rdi, rcx
jne 0x1401c72df
lock bts qword [0x1402c6f00], 0x1f
setb al
test al, al
je 0x1401c7219
test byte [0x1402c6f00], 1
nop
jne 0x1401c72df
xor edx, edx
lea rcx, [0x1402c6f00]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401c72df
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401c7276
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401c7276
cmp dword [0x1402bff40], 0x3e
jae 0x1401c72d3
xor r8d, r8d
lea rcx, str.cryptui.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401c72d3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401c72ca
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c72ca
cmp dword [rdx + rcx], 0x4550
jne 0x1401c72ca
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c72ca
cmp dword [rdx + 4], 0
je 0x1401c72ca
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.CryptUIDlgViewSignerInfoW
mov word [rsp + 0x20], ax
call fcn.14017e4c0
jmp 0x1401c72cc
xor eax, eax
mov qword [0x1402ceb98], rax
lea rcx, [0x1402c6f00]
call sym.SystemInformer.exe_PhfSetEvent
mov rax, qword [0x1402ceb98]
test rax, rax
je 0x1401c7368
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x60
xor ecx, ecx
mov qword [rsp + 0x88], rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
test rbx, rbx
je 0x1401c7368
cmp dword [rbx + 0x78], ecx
jbe 0x1401c7368
mov rdx, qword [rbx + 0x80]
test rdx, rdx
je 0x1401c7368
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x58], rcx
lea rcx, str.1.3.6.1.5.5.7.3.3
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x30]
call qword [case.0x14013d84a.0]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x1401ca640
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x1402caaf0]
mov ebp, 4
mov edx, ebp
mov r8d, 0x18
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
xorps xmm0, xmm0
mov rdi, rax
mov rcx, rbx
xor eax, eax
cmp dword [0x1402bff40], 0x3f
mov dword [rsp + 0x20], eax
cmovae edx, ebp
xor r9d, r9d
movups xmmword [rdi], xmm0
xor r8d, r8d
mov qword [rdi + 0x10], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword ds:[rdi], rax
test rax, rax
jne 0x1401ca6c6
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x1402bff40], 0x3f
lea r8, [rsp + 0x70]
mov r9d, ebp
mov edx, 0x54
mov rcx, rax
jae 0x1401ca6ec
mov dword [rsp + 0x70], 0xa00
jmp 0x1401ca769
mov dword [rsp + 0x70], 0x2800
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
mov r9d, ebp
mov dword [rsp + 0x78], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402bff40]
nop
cmp eax, 0x64
jb 0x1401ca74c
mov rcx, qword ds:[rdi]
lea r8, [rsp + 0x30]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov edx, 0x85
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402bff40]
cmp eax, 0x72
jb 0x1401ca76f
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov r9d, ebp
mov edx, 0xc3
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rbx, qword [rsp + 0x60]
mov al, 1
mov qword [rsi], rdi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401ca8e0
Capabilities:
Prepare http request

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov eax, ecx
test r9b, 1
je 0x1401ca8fb
lfence
mov eax, 0x800000
nop dword [rax + rax]
test r9b, 2
je 0x1401ca90d
lfence
bts eax, 8
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401ca937
add rsp, 0x40
pop rbx
ret
mov r9d, 4
mov dword [rsp + 0x50], 8
lea r8, [rsp + 0x50]
mov edx, 0x3f
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x1401ca9c0
Capabilities:
Receive http response

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1401caa20
Capabilities:
Set http header

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
mov eax, r8d
test eax, eax
mov r8d, 0xffffffff
mov r9d, 0xa0000000
cmovne r8d, eax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1401caa60
Capabilities:
Read http header

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
lea rax, [rsp + 0x50]
mov rsi, rcx
mov qword [rsp + 0x28], rbp
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x16
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1401caaa5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp eax, 0x7a
jne 0x1401cab16
mov rdx, qword [0x1402ca998]
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov edx, 0x16
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], bp
mov r9, qword [rdi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x1401cab21
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401cab16
call fcn.140141ea0
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rax, rdi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401cab40
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
lea rax, [rsp + 0x50]
mov rsi, rdx
mov qword [rsp + 0x28], r14
mov rbp, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
mov r8, rdx
xor r9d, r9d
mov dword [rsp + 0x50], r14d
mov edx, 0xffff
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop
test eax, eax
jne 0x1401cab8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401cac0a
mov rdx, qword [0x1402ca998]
mov qword [rsp + 0x58], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov qword [rsp + 0x28], r14
mov r8, rsi
mov edx, 0xffff
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], r14w
mov r9, qword [rdi + 8]
mov rcx, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x1401cac1a
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401cac0a
call fcn.140141ea0
xor eax, eax
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov r8, qword [rdi + 8]
xorps xmm1, xmm1
mov rax, r8
mov ecx, r8d
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401cac4d
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x1401cac49
mov eax, ecx
shr rax, 1
jmp 0x1401cac83
add rax, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x1401cac75
nop dword [rax]
add rax, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x1401cac60
sub rax, r8
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rbp, qword [rsp + 0x68]
add rax, rax
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401cace0
Capabilities:
Read http header

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, edx
mov dword [rsp + 0x30], 0x100
xor ebx, ebx
mov rsi, r8
mov edx, ebx
test al, 1
je 0x1401cad19
lfence
mov edx, 5
test al, 2
je 0x1401cad23
lfence
or edx, 0x13
mov rcx, qword ds:[rcx + 0x10]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1401cadfd
mov eax, dword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov qword [rsp + 0x278], rdi
mov r9d, eax
xor dil, dil
test rax, rax
je 0x1401cad8c
movzx ecx, word [rsp + 0x40]
cmp cx, 0x2d
je 0x1401cad7b
cmp cx, 0x2b
jne 0x1401cad8c
cmp cx, 0x2d
lea r11, [rsp + 0x42]
lea r9, [rax - 2]
sete dil
shr r9, 1
mov r10b, 1
mov rdx, rbx
je 0x1401caddc
mov qword [rsp + 0x250], r14
lea r14, [0x14028b2b0]
nop word [rax + rax]
movzx eax, byte [r11 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x1401cadc9
lea rcx, [rbx + rbx*4]
lea rbx, [r8 + rcx*2]
jmp 0x1401cadcc
xor r10b, r10b
inc rdx
cmp rdx, r9
jb 0x1401cadb0
mov r14, qword [rsp + 0x250]
mov rax, rbx
neg rax
test dil, dil
mov rdi, qword [rsp + 0x278]
cmove rax, rbx
test r10b, r10b
je 0x1401cadfd
mov qword [rsi], rax
mov al, 1
jmp 0x1401cadff
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x258
pop rsi
pop rbx
ret
Function at 0x1401caf20
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x1040
call fcn.140209e10
sub rsp, rax
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov r14, r8
mov r15, rdx
mov rbp, rcx
mov edi, 0x1000
mov rcx, qword [0x1402caaf0]
mov r8d, edi
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x20]
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov rbx, rax
xor esi, esi
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1401cb041
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x1401cb00b
lea eax, ds:[rcx + rsi]
cmp edi, eax
jae 0x1401cafd8
mov rcx, qword [0x1402caaf0]
add edi, edi
mov r9d, edi
mov edx, 4
test rbx, rbx
jne 0x1401cafc8
mov r8d, r9d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401cafd1
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ecx, dword [rsp + 0x20]
mov rbx, rax
mov r8d, ecx
lea rdx, [rsp + 0x30]
mov ecx, esi
add rcx, rbx
call fcn.14020af00
add esi, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x1401caf91
lea eax, [rsi + 1]
cmp edi, eax
jae 0x1401cb041
lea r9d, [rdi + 1]
lfence
mov rcx, qword [0x1402caaf0]
mov edx, 4
test rbx, rbx
jne 0x1401cb035
mov r8d, r9d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401cb03e
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov rbx, rax
mov byte [rsi + rbx], 0
test esi, esi
je 0x1401cb072
test r15, r15
je 0x1401cb053
mov qword [r15], rbx
jmp 0x1401cb066
mov rcx, qword [0x1402caaf0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r14, r14
je 0x1401cb06e
mov dword [r14], esi
mov al, 1
jmp 0x1401cb088
mov rcx, qword [0x1402caaf0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401e4a20
mov rbx, qword [rsp + 0x1088]
add rsp, 0x1040
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401cbf60
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
lea rbx, str.CryptoWinRT.dll
mov qword [rsp + 0x30], 0x1e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
mov rsi, rcx
xor edi, edi
call fcn.14017e120
mov r10, rax
test rax, rax
jne 0x1401cbff2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401cbff2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401cbff2
cmp dword [0x1402bff40], 0x3e
jae 0x1401cc1d3
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
je 0x1401cc1d3
lea r8, str.Windows.Security.Cryptography.CryptographicBuffer
mov dword [rsp + 0x30], 1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1401cc035
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x78], ecx
je 0x1401cc031
mov edx, ecx
shr rdx, 1
jmp 0x1401cc078
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x78], ecx
jne 0x1401cc06a
nop word [rax + rax]
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x78], ecx
je 0x1401cc050
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov eax, 0x5a4d
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x40], r8
cmp word [r10], ax
jne 0x1401cc1d3
mov ecx, dword ds:[r10 + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401cc1d3
cmp dword [rcx + r10], 0x4550
jne 0x1401cc1d3
lea rdx, [r10 + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401cc1d3
cmp dword [rdx + 4], edi
je 0x1401cc1d3
lea r8, [r10 + rax]
mov word [rsp + 0x20], di
lea r9, str.DllGetActivationFactory
mov rcx, r10
call fcn.14017e4c0
test rax, rax
je 0x1401cc1d3
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call qword [case.0x14013d84a.0]
mov ebx, eax
test eax, eax
jne 0x1401cc146
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rdx, [0x14028f308]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14013d84a.0]
mov rcx, qword ds:[rsp + 0x78]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d84a.0]
test ebx, ebx
js 0x1401cc1d3
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x80]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
call qword [case.0x14013d84a.0]
test eax, eax
js 0x1401cc1be
mov rcx, qword [rsp + 0x80]
call fcn.1401cbec0
mov r8, qword [rsp + 0x80]
mov rdi, rax
test r8, r8
je 0x1401cc1be
test byte [r8], 1
jne 0x1401cc1be
mov ecx, 0xffffffff
lock xadd dword [r8 + 0x18], ecx
cmp ecx, 1
jne 0x1401cc1be
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d84a.0]
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401cc5e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test byte [0x1402c6f50], 1
movzx edi, dl
mov rbx, rcx
jne 0x1401cc63e
lock bts qword [0x1402c6f50], 0x1f
setb al
test al, al
je 0x1401cc627
test byte [0x1402c6f50], 1
jne 0x1401cc63e
xor edx, edx
lea rcx, [0x1402c6f50]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401cc63e
call fcn.140149580
lea rcx, [0x1402c6f50]
mov dword [0x1402cead8], eax
call sym.SystemInformer.exe_PhfSetEvent
mov eax, dword [0x1402cead8]
cmp eax, 0xffffffff
je 0x1401cc6ad
test dil, dil
je 0x1401cc66d
mov rdx, rbx
mov ecx, eax
call fcn.140149740
test eax, eax
js 0x1401cc6ad
lfence
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [0x1402bff40], 0xffffffff
jae 0x1401cc69a
cmp eax, 0x40
jae 0x1401cc69a
lfence
mov rcx, qword gs:[0x30]
mov rax, qword [rcx + rax*8 + 0x1480]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401cd0a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
test byte [0x1402c6f40], 1
jne 0x1401cd293
lock bts qword [0x1402c6f40], 0x1f
setb al
test al, al
je 0x1401cd0eb
test byte [0x1402c6f40], 1
jne 0x1401cd293
xor edx, edx
lea rcx, [0x1402c6f40]
call sym.SystemInformer.exe_PhfWaitForEvent
movzx eax, byte [0x1402caf3a]
add rsp, 0x48
ret
lea rax, str.kernelbase.dll
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], 0x1c
call fcn.14017e120
mov rdi, rax
test rax, rax
je 0x1401cd256
mov qword [rsp + 0x58], rbp
mov ebp, 0x5a4d
mov qword [rsp + 0x60], rsi
cmp word [rax], bp
jne 0x1401cd187
mov ecx, dword [rax + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401cd187
cmp dword [rcx + rdi], 0x4550
jne 0x1401cd187
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401cd187
cmp dword [rdx + 4], 0
je 0x1401cd187
xor ebx, ebx
lea r8, [rdi + rax]
lea r9, str.OpenPackageInfoByFullNameForUser
mov word [rsp + 0x20], bx
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401cd18b
xor ebx, ebx
mov eax, ebx
mov rdx, rdi
mov ecx, 0x3c
mov qword [0x1402cec10], rax
lea rsi, [rdx + rcx]
cmp word [rdi], bp
jne 0x1401cd1ea
mov ecx, dword [rsi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401cd1ea
cmp dword [rcx + rdi], 0x4550
jne 0x1401cd1ea
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401cd1ea
cmp dword [rdx + 4], 0
je 0x1401cd1ea
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.GetPackageApplicationIds
mov rcx, rdi
call fcn.14017e4c0
jmp 0x1401cd1ed
mov rax, rbx
cmp word [rdi], bp
mov rbp, qword [rsp + 0x58]
mov qword [0x1402cec08], rax
jne 0x1401cd248
mov ecx, dword [rsi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401cd248
cmp dword [rcx + rdi], 0x4550
jne 0x1401cd248
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401cd248
cmp dword [rdx + 4], 0
je 0x1401cd248
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.ClosePackageInfo
mov rcx, rdi
call fcn.14017e4c0
mov rbx, rax
mov rsi, qword [rsp + 0x60]
mov qword [0x1402cec00], rbx
jmp 0x1401cd25d
mov rbx, qword [0x1402cec00]
cmp qword [0x1402cec10], 0
mov rdi, qword [rsp + 0x40]
je 0x1401cd282
cmp qword [0x1402cec08], 0
je 0x1401cd282
test rbx, rbx
je 0x1401cd282
mov byte [0x1402caf3a], 1
lea rcx, [0x1402c6f40]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
movzx eax, byte [0x1402caf3a]
add rsp, 0x48
ret
Function at 0x1401d3ed0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, dword [rcx + 0x30]
mov eax, 0x38
mov r8d, edi
mov rsi, rdx
and r8d, 0x3f
mov rbp, rcx
sub eax, r8d
lea rcx, [rsp + 0x21]
mov ebx, 0x78
sub ebx, r8d
cmp r8d, 0x38
cmovb ebx, eax
xor edx, edx
lea eax, [rbx - 1]
movsxd r8, eax
call fcn.14020ab40
movsxd rax, ebx
lea rdx, [rsp + 0x20]
add rdx, rax
mov byte [rsp + 0x20], 0x80
mov eax, dword [rbp + 0x2c]
lea r8d, [rbx + 8]
shl eax, 3
mov ecx, edi
shr ecx, 0x1d
or ecx, eax
lea eax, [rdi*8]
bswap ecx
mov dword [rdx], ecx
mov rcx, rbp
bswap eax
mov dword [rdx + 4], eax
lea rdx, [rsp + 0x20]
call fcn.1401d3e00
mov ecx, dword [rbp + 0x18]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi], edx
mov ecx, dword [rbp + 0x1c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 4], edx
mov ecx, dword [rbp + 0x20]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 8], edx
mov ecx, dword [rbp + 0x24]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 0xc], edx
mov ecx, dword [rbp + 0x28]
mov eax, ecx
and eax, 0xff00
mov edx, ecx
shl edx, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff0000
shr ecx, 0x10
or eax, ecx
shl edx, 8
shr eax, 8
or edx, eax
mov dword [rsi + 0x10], edx
xor eax, eax
mov qword [rbp + 0x2c], rax
mov dword [rbp + 0x18], 0x67452301
mov dword [rbp + 0x1c], 0xefcdab89
mov dword [rbp + 0x20], 0x98badcfe
mov dword [rbp + 0x24], 0x10325476
mov dword [rbp + 0x28], 0xc3d2e1f0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401e4a20
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret