joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016e5e0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1050], 1
jne 0x14016e760
lock bts qword [0x1402c1050], 0x1f
nop
jae 0x14016e625
test byte [0x1402c1050], 1
jne 0x14016e760
xor edx, edx
lea rcx, [0x1402c1050]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016e760
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016e6b2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016e6b2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016e6b2
cmp dword [0x1402baf40], 0x3e
jae 0x14016e74f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016e74f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016e74f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016e74f
cmp dword [rdx + rcx], 0x4550
jne 0x14016e74f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016e74f
cmp dword [rdx + 4], edi
je 0x14016e74f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationEnlistment
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016e74f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8570], rax
xor rax, r9
mov qword [0x1402c8550], rax
lea rcx, [0x1402c1050]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8550]
test rax, rax
je 0x14016e781
mov rcx, qword [0x1402c8570]
test rcx, rcx
je 0x14016e781
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016e7a0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c10a0], 1
jne 0x14016e920
lock bts qword [0x1402c10a0], 0x1f
nop
jae 0x14016e7e5
test byte [0x1402c10a0], 1
jne 0x14016e920
xor edx, edx
lea rcx, [0x1402c10a0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016e920
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016e872
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016e872
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016e872
cmp dword [0x1402baf40], 0x3e
jae 0x14016e90f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016e90f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016e90f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016e90f
cmp dword [rdx + rcx], 0x4550
jne 0x14016e90f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016e90f
cmp dword [rdx + 4], edi
je 0x14016e90f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationResourceManager
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016e90f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8600], rax
xor rax, r9
mov qword [0x1402c8680], rax
lea rcx, [0x1402c10a0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8680]
test rax, rax
je 0x14016e941
mov rcx, qword [0x1402c8600]
test rcx, rcx
je 0x14016e941
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016e960
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1080], 1
jne 0x14016eae0
lock bts qword [0x1402c1080], 0x1f
nop
jae 0x14016e9a5
test byte [0x1402c1080], 1
jne 0x14016eae0
xor edx, edx
lea rcx, [0x1402c1080]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016eae0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016ea32
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016ea32
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016ea32
cmp dword [0x1402baf40], 0x3e
jae 0x14016eacf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016eacf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016eacf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016eacf
cmp dword [rdx + rcx], 0x4550
jne 0x14016eacf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016eacf
cmp dword [rdx + 4], edi
je 0x14016eacf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationTransaction
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016eacf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8628], rax
xor rax, r9
mov qword [0x1402c8590], rax
lea rcx, [0x1402c1080]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8590]
test rax, rax
je 0x14016eb01
mov rcx, qword [0x1402c8628]
test rcx, rcx
je 0x14016eb01
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016eb20
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c10f0], 1
jne 0x14016eca0
lock bts qword [0x1402c10f0], 0x1f
nop
jae 0x14016eb65
test byte [0x1402c10f0], 1
jne 0x14016eca0
xor edx, edx
lea rcx, [0x1402c10f0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016eca0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016ebf2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016ebf2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016ebf2
cmp dword [0x1402baf40], 0x3e
jae 0x14016ec8f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016ec8f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016ec8f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016ec8f
cmp dword [rdx + rcx], 0x4550
jne 0x14016ec8f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016ec8f
cmp dword [rdx + 4], edi
je 0x14016ec8f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtQueryInformationTransactionManager
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016ec8f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8558], rax
xor rax, r9
mov qword [0x1402c8698], rax
lea rcx, [0x1402c10f0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8698]
test rax, rax
je 0x14016ecc1
mov rcx, qword [0x1402c8558]
test rcx, rcx
je 0x14016ecc1
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016ece0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1090], 1
jne 0x14016ee60
lock bts qword [0x1402c1090], 0x1f
nop
jae 0x14016ed25
test byte [0x1402c1090], 1
jne 0x14016ee60
xor edx, edx
lea rcx, [0x1402c1090]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016ee60
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016edb2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016edb2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016edb2
cmp dword [0x1402baf40], 0x3e
jae 0x14016ee4f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016ee4f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016ee4f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016ee4f
cmp dword [rdx + rcx], 0x4550
jne 0x14016ee4f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016ee4f
cmp dword [rdx + 4], edi
je 0x14016ee4f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtSetInformationVirtualMemory
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016ee4f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c85d0], rax
xor rax, r9
mov qword [0x1402c8638], rax
lea rcx, [0x1402c1090]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8638]
test rax, rax
je 0x14016ee81
mov rcx, qword [0x1402c85d0]
test rcx, rcx
je 0x14016ee81
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016eea0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1010], 1
jne 0x14016f020
lock bts qword [0x1402c1010], 0x1f
nop
jae 0x14016eee5
test byte [0x1402c1010], 1
jne 0x14016f020
xor edx, edx
lea rcx, [0x1402c1010]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016f020
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016ef72
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016ef72
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016ef72
cmp dword [0x1402baf40], 0x3e
jae 0x14016f00f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016f00f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016f00f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016f00f
cmp dword [rdx + rcx], 0x4550
jne 0x14016f00f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016f00f
cmp dword [rdx + 4], edi
je 0x14016f00f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtCreateProcessStateChange
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016f00f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c85f8], rax
xor rax, r9
mov qword [0x1402c8588], rax
lea rcx, [0x1402c1010]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8588]
test rax, rax
je 0x14016f041
mov rcx, qword [0x1402c85f8]
test rcx, rcx
je 0x14016f041
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016f060
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1070], 1
jne 0x14016f1e0
lock bts qword [0x1402c1070], 0x1f
nop
jae 0x14016f0a5
test byte [0x1402c1070], 1
jne 0x14016f1e0
xor edx, edx
lea rcx, [0x1402c1070]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016f1e0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016f132
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f132
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f132
cmp dword [0x1402baf40], 0x3e
jae 0x14016f1cf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016f1cf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016f1cf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016f1cf
cmp dword [rdx + rcx], 0x4550
jne 0x14016f1cf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016f1cf
cmp dword [rdx + 4], edi
je 0x14016f1cf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.NtChangeProcessState
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016f1cf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8650], rax
xor rax, r9
mov qword [0x1402c8560], rax
lea rcx, [0x1402c1070]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8560]
test rax, rax
je 0x14016f201
mov rcx, qword [0x1402c8650]
test rcx, rcx
je 0x14016f201
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016f220
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1020], 1
jne 0x14016f3a0
lock bts qword [0x1402c1020], 0x1f
nop
jae 0x14016f265
test byte [0x1402c1020], 1
jne 0x14016f3a0
xor edx, edx
lea rcx, [0x1402c1020]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016f3a0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016f2f2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f2f2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f2f2
cmp dword [0x1402baf40], 0x3e
jae 0x14016f38f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016f38f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016f38f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016f38f
cmp dword [rdx + rcx], 0x4550
jne 0x14016f38f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016f38f
cmp dword [rdx + 4], edi
je 0x14016f38f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlDefaultNpAcl
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016f38f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c86a8], rax
xor rax, r9
mov qword [0x1402c85d8], rax
lea rcx, [0x1402c1020]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c85d8]
test rax, rax
je 0x14016f3c1
mov rcx, qword [0x1402c86a8]
test rcx, rcx
je 0x14016f3c1
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016f3e0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c0fa0], 1
jne 0x14016f560
lock bts qword [0x1402c0fa0], 0x1f
nop
jae 0x14016f425
test byte [0x1402c0fa0], 1
jne 0x14016f560
xor edx, edx
lea rcx, [0x1402c0fa0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016f560
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016f4b2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f4b2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f4b2
cmp dword [0x1402baf40], 0x3e
jae 0x14016f54f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016f54f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016f54f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016f54f
cmp dword [rdx + rcx], 0x4550
jne 0x14016f54f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016f54f
cmp dword [rdx + 4], edi
je 0x14016f54f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetTokenNamedObjectPath
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016f54f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8678], rax
xor rax, r9
mov qword [0x1402c85e0], rax
lea rcx, [0x1402c0fa0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c85e0]
test rax, rax
je 0x14016f581
mov rcx, qword [0x1402c8678]
test rcx, rcx
je 0x14016f581
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016f5a0
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c0fd0], 1
jne 0x14016f720
lock bts qword [0x1402c0fd0], 0x1f
nop
jae 0x14016f5e5
test byte [0x1402c0fd0], 1
jne 0x14016f720
xor edx, edx
lea rcx, [0x1402c0fd0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016f720
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016f672
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f672
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f672
cmp dword [0x1402baf40], 0x3e
jae 0x14016f70f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016f70f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016f70f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016f70f
cmp dword [rdx + rcx], 0x4550
jne 0x14016f70f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016f70f
cmp dword [rdx + 4], edi
je 0x14016f70f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerNamedObjectPath
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016f70f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8610], rax
xor rax, r9
mov qword [0x1402c85c8], rax
lea rcx, [0x1402c0fd0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c85c8]
test rax, rax
je 0x14016f741
mov rcx, qword [0x1402c8610]
test rcx, rcx
je 0x14016f741
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016f760
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c0ff0], 1
jne 0x14016f8e0
lock bts qword [0x1402c0ff0], 0x1f
nop
jae 0x14016f7a5
test byte [0x1402c0ff0], 1
jne 0x14016f8e0
xor edx, edx
lea rcx, [0x1402c0ff0]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016f8e0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016f832
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f832
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f832
cmp dword [0x1402baf40], 0x3e
jae 0x14016f8cf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016f8cf
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016f8cf
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016f8cf
cmp dword [rdx + rcx], 0x4550
jne 0x14016f8cf
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016f8cf
cmp dword [rdx + 4], edi
je 0x14016f8cf
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerSidType
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016f8cf
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c85a0], rax
xor rax, r9
mov qword [0x1402c86b0], rax
lea rcx, [0x1402c0ff0]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c86b0]
test rax, rax
je 0x14016f901
mov rcx, qword [0x1402c85a0]
test rcx, rcx
je 0x14016f901
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x14016f920
Capabilities:
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
test byte [0x1402c1000], 1
jne 0x14016faa0
lock bts qword [0x1402c1000], 0x1f
nop
jae 0x14016f965
test byte [0x1402c1000], 1
jne 0x14016faa0
xor edx, edx
lea rcx, [0x1402c1000]
call sym.SystemInformer.exe_QifWaitForEvent
nop dword [rax]
jmp 0x14016faa0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
lea rbx, [0x14023bb00]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], rbx
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14016f9f2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f9f2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14016f9f2
cmp dword [0x1402baf40], 0x3e
jae 0x14016fa8f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14016fa8f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14016fa8f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016fa8f
cmp dword [rdx + rcx], 0x4550
jne 0x14016fa8f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016fa8f
cmp dword [rdx + 4], edi
je 0x14016fa8f
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.RtlGetAppContainerParent
call fcn.140177a80
mov r9, rax
test rax, rax
je 0x14016fa8f
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402c8648], rax
xor rax, r9
mov qword [0x1402c8690], rax
lea rcx, [0x1402c1000]
call sym.SystemInformer.exe_QifSetEvent
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x1402c8690]
test rax, rax
je 0x14016fac1
mov rcx, qword [0x1402c8648]
test rcx, rcx
je 0x14016fac1
xor rax, rcx
add rsp, 0x40
pop rdi
ret
mov rax, rdi
add rsp, 0x40
pop rdi
ret