joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ab500
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
test byte [0x1402c7c68], 1
jne 0x1401ab7c0
lock bts qword [0x1402c7c68], 0x1f
setb al
test al, al
je 0x1401ab54b
test byte [0x1402c7c68], 1
jne 0x1401ab7c0
xor edx, edx
lea rcx, [0x1402c7c68]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [0x1402cfa90]
add rsp, 0x48
ret
cmp dword [0x1402c0f40], 0x3e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
lea rbx, str.appresolver.dll
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0x1e
jae 0x1401ab685
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401ab5e9
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ab5e9
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ab5e9
cmp dword [0x1402c0f40], 0x3e
nop
jae 0x1401ab7af
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401ab7af
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401ab7af
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ab7af
cmp dword [rdx + rcx], 0x4550
jne 0x1401ab7af
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ab7af
cmp dword [rdx + 4], 0
je 0x1401ab7af
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.14017f180
test rax, rax
je 0x1401ab7af
lea r8, [rsp + 0x50]
lea rdx, [0x140210c20]
lea rcx, [0x14028fa90]
call qword [case.0x14013dbaa.0]
test eax, eax
js 0x1401ab7af
lea r8, [0x14028fa80]
nop
jmp 0x1401ab782
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401ab6f2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ab6f2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ab6f2
cmp dword [0x1402c0f40], 0x3e
jae 0x1401ab7af
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401ab7af
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401ab7af
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ab7af
cmp dword [rdx + rcx], 0x4550
jne 0x1401ab7af
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ab7af
cmp dword ds:[rdx + 4], 0
je 0x1401ab7af
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.14017f180
test rax, rax
je 0x1401ab7af
lea r8, [rsp + 0x50]
lea rdx, [0x140210c20]
lea rcx, [0x14028fa90]
call qword [case.0x14013dbaa.0]
test eax, eax
js 0x1401ab7af
lea r8, [0x14028faf8]
mov rcx, qword [rsp + 0x50]
lea r9, [0x1402cfa90]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14013dbaa.0]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013dbaa.0]
lea rcx, [0x1402c7c68]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
mov rax, qword [0x1402cfa90]
add rsp, 0x48
ret
Function at 0x1401ac2a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov qword [rsp + 0x30], 0x26
lea rbx, str.twinapi.appcore.dll
mov rsi, rcx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401ac36b
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ac36b
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ac36b
cmp dword [0x1402c0f40], 0x3e
jae 0x1401ac33d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ac36b
mov ebx, 0x8007007e
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401ac359
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013dbaa.0]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401ac428
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ac428
cmp dword [rdx + rcx], 0x4550
jne 0x1401ac428
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ac428
cmp dword [rdx + 4], 0
je 0x1401ac428
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.DllGetClassObject
mov word [rsp + 0x20], ax
call fcn.14017f180
test rax, rax
je 0x1401ac428
lea r8, [rsp + 0x68]
lea rdx, [0x140210c20]
lea rcx, [0x14028fa18]
call qword [case.0x14013dbaa.0]
mov ebx, eax
test eax, eax
js 0x1401ac42d
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
lea r8, [0x14028fb08]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14013dbaa.0]
mov rcx, qword ds:[rsp + 0x68]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013dbaa.0]
jmp 0x1401ac42d
mov ebx, 0x8007007f
test ebx, ebx
jne 0x1401ac342
mov rcx, qword [rsp + 0x60]
mov r8d, 0x10000
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14013dbaa.0]
mov ebx, eax
test eax, eax
jne 0x1401ac342
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov qword [rdi], rcx
add rsp, 0x40
pop rdi
ret
Function at 0x1401ac480
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov qword [rax - 0x30], 0x18
mov rbp, rdx
mov qword [rax + 0x20], r14
lea rbx, str.mrmcorer.dll
mov qword [rax - 0x38], r14
lea rdx, [rax - 0x30]
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], rbx
mov rdi, r8
mov rsi, rcx
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401ac530
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ac530
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ac530
cmp dword [0x1402c0f40], 0x3e
jae 0x1401ac526
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ac530
mov ebx, 0x8007007e
jmp 0x1401ac652
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401ac5e8
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ac5e8
cmp dword [rdx + rcx], 0x4550
jne 0x1401ac5e8
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ac5e8
cmp dword [rdx + 4], r14d
je 0x1401ac5e8
lea r8, [rcx + rax]
mov word [rsp + 0x20], r14w
lea r9, str.DllGetClassObject
call fcn.14017f180
test rax, rax
je 0x1401ac5e8
lea r8, [rsp + 0x38]
lea rdx, [0x140210c20]
lea rcx, [0x14028fa60]
call qword [case.0x14013dbaa.0]
mov ebx, eax
test eax, eax
js 0x1401ac5ed
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x88]
lea r8, [0x14028fad8]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14013dbaa.0]
mov rcx, qword ds:[rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013dbaa.0]
jmp 0x1401ac5ed
mov ebx, 0x8007007f
test ebx, ebx
jne 0x1401ac652
mov rcx, qword [rsp + 0x88]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x14013dbaa.0]
mov ebx, eax
test eax, eax
jne 0x1401ac652
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x30]
lea rdx, [0x14028fae8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14013dbaa.0]
mov ebx, eax
test eax, eax
jne 0x1401ac652
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14013dbaa.0]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401ac669
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013dbaa.0]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1401ac686
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013dbaa.0]
test ebx, ebx
jne 0x1401ac692
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1401ae3a0
Capabilities:
Parse pe header

Disassembly:
mov qword ss:[rsp + 8], rbx
push rdi
sub rsp, 0x90
test byte [0x1402c7ce8], 1
mov rbx, rdx
mov rdi, rcx
jne 0x1401ae4bf
lock bts qword [0x1402c7ce8], 0x1f
setb al
test al, al
je 0x1401ae3f9
test byte [0x1402c7ce8], 1
nop
jne 0x1401ae4bf
xor edx, edx
lea rcx, [0x1402c7ce8]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401ae4bf
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ae456
xor edx, edx
lea rcx, str.cryptui.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x1401ae456
cmp dword [0x1402c0f40], 0x3e
jae 0x1401ae4b3
xor r8d, r8d
lea rcx, str.cryptui.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x1401ae4b3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401ae4aa
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401ae4aa
cmp dword [rdx + rcx], 0x4550
jne 0x1401ae4aa
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401ae4aa
cmp dword [rdx + 4], 0
je 0x1401ae4aa
lea r8, [rcx + rax]
xor eax, eax
lea r9, str.CryptUIDlgViewSignerInfoW
mov word [rsp + 0x20], ax
call fcn.14017f180
jmp 0x1401ae4ac
xor eax, eax
mov qword [0x1402cfac8], rax
lea rcx, [0x1402c7ce8]
call sym.SystemInformer.exe_PhfSetEvent
mov rax, qword [0x1402cfac8]
test rax, rax
je 0x1401ae548
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x60
xor ecx, ecx
mov qword [rsp + 0x88], rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
test rbx, rbx
je 0x1401ae548
cmp dword [rbx + 0x78], ecx
jbe 0x1401ae548
mov rdx, qword [rbx + 0x80]
test rdx, rdx
je 0x1401ae548
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x58], rcx
lea rcx, str.1.3.6.1.5.5.7.3.3
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x30]
call qword [case.0x14013dbaa.0]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x1401b1800
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x1402cba10]
mov ebp, 4
mov edx, ebp
mov r8d, 0x18
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
xorps xmm0, xmm0
mov rdi, rax
mov rcx, rbx
xor eax, eax
cmp dword [0x1402c0f40], 0x3f
mov dword [rsp + 0x20], eax
cmovae edx, ebp
xor r9d, r9d
movups xmmword [rdi], xmm0
xor r8d, r8d
mov qword [rdi + 0x10], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword ds:[rdi], rax
test rax, rax
jne 0x1401b1886
mov rcx, qword [0x1402cba10]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x1402c0f40], 0x3f
lea r8, [rsp + 0x70]
mov r9d, ebp
mov edx, 0x54
mov rcx, rax
jae 0x1401b18ac
mov dword [rsp + 0x70], 0xa00
jmp 0x1401b1929
mov dword [rsp + 0x70], 0x2800
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
mov r9d, ebp
mov dword [rsp + 0x78], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402c0f40]
nop
cmp eax, 0x64
jb 0x1401b190c
mov rcx, qword ds:[rdi]
lea r8, [rsp + 0x30]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov edx, 0x85
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402c0f40]
cmp eax, 0x72
jb 0x1401b192f
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov r9d, ebp
mov edx, 0xc3
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rbx, qword [rsp + 0x60]
mov al, 1
mov qword [rsi], rdi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401b1aa0
Capabilities:
Prepare http request

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov eax, ecx
test r9b, 1
je 0x1401b1abb
lfence
mov eax, 0x800000
nop dword [rax + rax]
test r9b, 2
je 0x1401b1acd
lfence
bts eax, 8
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401b1af7
add rsp, 0x40
pop rbx
ret
mov r9d, 4
mov dword [rsp + 0x50], 8
lea r8, [rsp + 0x50]
mov edx, 0x3f
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x1401b1b80
Capabilities:
Receive http response

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1401b1be0
Capabilities:
Set http header

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
mov eax, r8d
test eax, eax
mov r8d, 0xffffffff
mov r9d, 0xa0000000
cmovne r8d, eax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1401b1c20
Capabilities:
Read http header

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
lea rax, [rsp + 0x50]
mov rsi, rcx
mov qword [rsp + 0x28], rbp
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x16
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1401b1c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp eax, 0x7a
jne 0x1401b1cd6
mov rdx, qword [0x1402cb8c0]
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov edx, 0x16
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], bp
mov r9, qword [rdi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x1401b1ce1
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401b1cd6
call fcn.140142200
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rax, rdi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401b1d00
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
lea rax, [rsp + 0x50]
mov rsi, rdx
mov qword [rsp + 0x28], r14
mov rbp, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
mov r8, rdx
xor r9d, r9d
mov dword [rsp + 0x50], r14d
mov edx, 0xffff
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop
test eax, eax
jne 0x1401b1d4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401b1dca
mov rdx, qword [0x1402cb8c0]
mov qword [rsp + 0x58], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov qword [rsp + 0x28], r14
mov r8, rsi
mov edx, 0xffff
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], r14w
mov r9, qword [rdi + 8]
mov rcx, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x1401b1dda
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401b1dca
call fcn.140142200
xor eax, eax
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov r8, qword [rdi + 8]
xorps xmm1, xmm1
mov rax, r8
mov ecx, r8d
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401b1e0d
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x1401b1e09
mov eax, ecx
shr rax, 1
jmp 0x1401b1e43
add rax, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x1401b1e35
nop dword [rax]
add rax, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x1401b1e20
sub rax, r8
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rbp, qword [rsp + 0x68]
add rax, rax
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401b1ea0
Capabilities:
Read http header

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, edx
mov dword [rsp + 0x30], 0x100
xor ebx, ebx
mov rsi, r8
mov edx, ebx
test al, 1
je 0x1401b1ed9
lfence
mov edx, 5
test al, 2
je 0x1401b1ee3
lfence
or edx, 0x13
mov rcx, qword ds:[rcx + 0x10]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1401b1fbd
mov eax, dword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov qword [rsp + 0x278], rdi
mov r9d, eax
xor dil, dil
test rax, rax
je 0x1401b1f4c
movzx ecx, word [rsp + 0x40]
cmp cx, 0x2d
je 0x1401b1f3b
cmp cx, 0x2b
jne 0x1401b1f4c
cmp cx, 0x2d
lea r11, [rsp + 0x42]
lea r9, [rax - 2]
sete dil
shr r9, 1
mov r10b, 1
mov rdx, rbx
je 0x1401b1f9c
mov qword [rsp + 0x250], r14
lea r14, [0x14028c600]
nop word [rax + rax]
movzx eax, byte [r11 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x1401b1f89
lea rcx, [rbx + rbx*4]
lea rbx, [r8 + rcx*2]
jmp 0x1401b1f8c
xor r10b, r10b
inc rdx
cmp rdx, r9
jb 0x1401b1f70
mov r14, qword [rsp + 0x250]
mov rax, rbx
neg rax
test dil, dil
mov rdi, qword [rsp + 0x278]
cmove rax, rbx
test r10b, r10b
je 0x1401b1fbd
mov qword [rsi], rax
mov al, 1
jmp 0x1401b1fbf
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x258
pop rsi
pop rbx
ret
Function at 0x1401b20e0
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x1040
call fcn.14020ad50
sub rsp, rax
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov r14, r8
mov r15, rdx
mov rbp, rcx
mov edi, 0x1000
mov rcx, qword [0x1402cba10]
mov r8d, edi
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x20]
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov rbx, rax
xor esi, esi
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1401b2201
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x1401b21cb
lea eax, ds:[rcx + rsi]
cmp edi, eax
jae 0x1401b2198
mov rcx, qword [0x1402cba10]
add edi, edi
mov r9d, edi
mov edx, 4
test rbx, rbx
jne 0x1401b2188
mov r8d, r9d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401b2191
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ecx, dword [rsp + 0x20]
mov rbx, rax
mov r8d, ecx
lea rdx, [rsp + 0x30]
mov ecx, esi
add rcx, rbx
call fcn.14020be40
add esi, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x1401b2151
lea eax, [rsi + 1]
cmp edi, eax
jae 0x1401b2201
lea r9d, [rdi + 1]
lfence
mov rcx, qword [0x1402cba10]
mov edx, 4
test rbx, rbx
jne 0x1401b21f5
mov r8d, r9d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401b21fe
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov rbx, rax
mov byte [rsi + rbx], 0
test esi, esi
je 0x1401b2232
test r15, r15
je 0x1401b2213
mov qword [r15], rbx
jmp 0x1401b2226
mov rcx, qword [0x1402cba10]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r14, r14
je 0x1401b222e
mov dword [r14], esi
mov al, 1
jmp 0x1401b2248
mov rcx, qword [0x1402cba10]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401e5e20
mov rbx, qword [rsp + 0x1088]
add rsp, 0x1040
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401b3120
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
lea rbx, str.CryptoWinRT.dll
mov qword [rsp + 0x30], 0x1e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
mov rsi, rcx
xor edi, edi
call fcn.14017ede0
mov r10, rax
test rax, rax
jne 0x1401b31b2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401b31b2
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401b31b2
cmp dword [0x1402c0f40], 0x3e
jae 0x1401b3393
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
je 0x1401b3393
lea r8, str.Windows.Security.Cryptography.CryptographicBuffer
mov dword [rsp + 0x30], 1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1401b31f5
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x78], ecx
je 0x1401b31f1
mov edx, ecx
shr rdx, 1
jmp 0x1401b3238
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x78], ecx
jne 0x1401b322a
nop word [rax + rax]
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x78], ecx
je 0x1401b3210
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov eax, 0x5a4d
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x40], r8
cmp word [r10], ax
jne 0x1401b3393
mov ecx, dword ds:[r10 + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401b3393
cmp dword [rcx + r10], 0x4550
jne 0x1401b3393
lea rdx, [r10 + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401b3393
cmp dword [rdx + 4], edi
je 0x1401b3393
lea r8, [r10 + rax]
mov word [rsp + 0x20], di
lea r9, str.DllGetActivationFactory
mov rcx, r10
call fcn.14017f180
test rax, rax
je 0x1401b3393
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call qword [case.0x14013dbaa.0]
mov ebx, eax
test eax, eax
jne 0x1401b3306
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rdx, [0x1402904c8]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14013dbaa.0]
mov rcx, qword ds:[rsp + 0x78]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013dbaa.0]
test ebx, ebx
js 0x1401b3393
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x80]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
call qword [case.0x14013dbaa.0]
test eax, eax
js 0x1401b337e
mov rcx, qword [rsp + 0x80]
call fcn.1401b3080
mov r8, qword [rsp + 0x80]
mov rdi, rax
test r8, r8
je 0x1401b337e
test byte [r8], 1
jne 0x1401b337e
mov ecx, 0xffffffff
lock xadd dword [r8 + 0x18], ecx
cmp ecx, 1
jne 0x1401b337e
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013dbaa.0]
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401b37a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test byte [0x1402c7d38], 1
movzx edi, dl
mov rbx, rcx
jne 0x1401b37fe
lock bts qword [0x1402c7d38], 0x1f
setb al
test al, al
je 0x1401b37e7
test byte [0x1402c7d38], 1
jne 0x1401b37fe
xor edx, edx
lea rcx, [0x1402c7d38]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401b37fe
call fcn.1401499e0
lea rcx, [0x1402c7d38]
mov dword [0x1402cfa08], eax
call sym.SystemInformer.exe_PhfSetEvent
mov eax, dword [0x1402cfa08]
cmp eax, 0xffffffff
je 0x1401b386d
test dil, dil
je 0x1401b382d
mov rdx, rbx
mov ecx, eax
call fcn.140149ba0
test eax, eax
js 0x1401b386d
lfence
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [0x1402c0f40], 0xffffffff
jae 0x1401b385a
cmp eax, 0x40
jae 0x1401b385a
lfence
mov rcx, qword gs:[0x30]
mov rax, qword [rcx + rax*8 + 0x1480]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret