joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17002f070
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
xor ebp, ebp
cmp byte [0x17008f4f0], 0
jne 0x17002f1c6
mov rbx, rcx
mov r12, qword [rcx]
mov eax, dword [r12 - 0x38]
test eax, 0x81000
jne 0x17002f1c6
mov rsi, rdx
test byte [0x17008d458], 8
je 0x17002f0e7
mov rcx, qword [r12 - 0x40]
call fcn.170030560
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, str.process_attach
lea r9, str.__s__p____START_n
mov ecx, 3
call fcn.17002dd80
mov eax, dword [r12 - 0x38]
or eax, 0x1000
mov dword [r12 - 0x38], eax
test rsi, rsi
je 0x17002f0fe
mov word [r12 - 0x34], 0xffff
mov rdx, qword [r12 - 0x18]
test rdx, rdx
je 0x17002f114
lea r8, [rsp + 0x38]
xor ecx, ecx
call sym.ntdll.dll_RtlActivateActivationContext
mov rdi, qword [rbx + 0x28]
xor ebp, ebp
test rdi, rdi
je 0x17002f160
lea r14, str.dep__dependency_from__node
lea r15, str._data_rock3_wine_builds_wine_7_dlls_ntdll_loader.c
nop dword [rax]
mov rdi, qword [rdi]
cmp qword [rdi + 0x18], rbx
je 0x17002f14a
mov rcx, r14
mov rdx, r15
mov r8d, 0x34a
call fcn.1700240e0
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.17002f070
test eax, eax
jne 0x17002f1d7
cmp rdi, qword [rbx + 0x28]
jne 0x17002f130
cmp qword [r12 - 0x80], 0
je 0x17002f1e1
test ebp, ebp
je 0x17002f220
cmp qword [r12 - 0x18], 0
je 0x17002f184
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call sym.ntdll.dll_RtlDeactivateActivationContext
and byte [r12 - 0x37], 0xef
test byte [0x17008d458], 8
je 0x17002f1c6
mov rcx, qword [r12 - 0x40]
call fcn.170030560
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, str.process_attach
lea r9, str.__s__p____END_n
mov ecx, 3
call fcn.17002dd80
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ebp, eax
cmp qword [r12 - 0x80], 0
jne 0x17002f168
lea rax, [r12 - 0x80]
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rbx, qword [rdx + 0x38]
add rdx, 0x30
mov qword [r12 - 0x80], rdx
mov qword [r12 - 0x78], rbx
mov qword [rbx], rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x18]
mov qword [rcx + 0x38], rax
test ebp, ebp
jne 0x17002f170
lea rbx, [r12 - 0xa0]
mov r14, qword [0x17008f578]
mov qword [0x17008f578], rbx
mov ecx, 1
mov rdx, rbx
call fcn.170036660
mov rcx, rbx
mov edx, 1
mov r8, rsi
call fcn.170031240
mov ebp, eax
test eax, eax
je 0x17002f2b3
mov rcx, rbx
xor edx, edx
mov r8, rsi
call fcn.170031240
mov ecx, 2
mov rdx, rbx
call fcn.170036660
mov qword [0x17008f550], rbx
test byte [0x17008d458], 4
je 0x17002f2b9
mov rcx, qword [r12 - 0x40]
call fcn.170030560
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, str.process_attach
lea r9, str.Initialization_of__s_failed_n
mov ecx, 2
call fcn.17002dd80
jmp 0x17002f2b9
or byte [r12 - 0x36], 8
mov qword [0x17008f578], r14
cmp qword [r12 - 0x18], 0
jne 0x17002f178
jmp 0x17002f184
Function at 0x17002f2e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
xor esi, esi
cmp byte [0x17008f4f0], 0
jne 0x17002f4fe
mov rdi, rcx
test byte [0x17008d458], 8
je 0x17002f334
mov qword [rsp + 0x20], rdi
lea rdx, [0x17008d458]
lea r8, [0x170072968]
lea r9, [0x1700726cf]
mov ecx, 3
call fcn.17002dd80
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
add dword [0x17008f4f8], 1
mov rsi, qword [0x17008f570]
test rsi, rsi
je 0x17002f359
cmp qword [rsi + 0x30], rdi
je 0x17002f39d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov rsi, rax
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rsi, qword [rsi]
cmp rsi, rax
je 0x17002f466
cmp qword [rsi + 0x20], rdi
jne 0x17002f380
add rsi, 0xfffffffffffffff0
mov qword [0x17008f570], rsi
test byte [0x17008d458], 8
je 0x17002f3d3
mov rcx, qword [rsi + 0x60]
call fcn.170030560
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, [0x170072968]
lea r9, str.__s____START_n
mov ecx, 3
call fcn.17002dd80
mov rcx, qword [rsi + 0x98]
xor esi, esi
xor edx, edx
call fcn.170031720
cmp dword [0x17008f4f8], 1
jg 0x17002f4c3
mov r14, qword gs:[0x30]
mov rax, qword [r14 + 0x60]
mov r15, qword [rax + 0x18]
lea rbx, [r15 + 0x30]
mov rax, qword [r15 + 0x38]
cmp rax, rbx
je 0x17002f46d
movzx r8d, byte [0x17008f4f0]
jmp 0x17002f429
mov rax, qword [rax + 8]
cmp rax, rbx
je 0x17002f46d
mov ecx, dword [rax + 0x48]
test ecx, 0x80000
je 0x17002f420
lea rdi, [rax - 0x20]
cmp word [rdi + 0x6c], 0
je 0x17002f444
test r8b, r8b
je 0x17002f420
and ecx, 0xfff7ffff
mov dword [rax + 0x48], ecx
mov rcx, rdi
xor edx, edx
call fcn.170031240
mov ecx, 2
mov rdx, rdi
call fcn.170036660
jmp 0x17002f405
mov esi, 0xc0000135
jmp 0x17002f4eb
mov rax, qword [r14 + 0x60]
mov rdi, qword [rax + 0x18]
lea rbx, [rdi + 0x30]
mov rcx, qword [rdi + 0x38]
cmp rcx, rbx
jne 0x17002f498
jmp 0x17002f4b6
mov rcx, rdi
cmp rdi, rbx
je 0x17002f4ae
mov rdi, qword [rcx + 8]
cmp word [rcx + 0x4c], 0
jne 0x17002f490
add rcx, 0xffffffffffffffe0
call fcn.170036830
jmp 0x17002f490
mov rax, qword [r14 + 0x60]
mov rdi, qword [rax + 0x18]
mov rcx, qword [rdi + 0x18]
add rdi, 0x10
cmp rcx, rdi
jne 0x17002f518
test byte [0x17008d458], 8
je 0x17002f4eb
lea rdx, [0x17008d458]
lea r8, [0x170072968]
lea r9, str.END_n
mov ecx, 3
call fcn.17002dd80
add dword [0x17008f4f8], 0xffffffff
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rcx, rbx
cmp rbx, rdi
je 0x17002f4c3
mov rbx, qword [rcx + 8]
cmp word [rcx + 0x6c], 0
jne 0x17002f510
call fcn.170036830
jmp 0x17002f510
Function at 0x17002f530
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov rsi, rdx
mov rdi, rcx
test byte [0x17008d458], 8
je 0x17002f579
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea rdx, [0x17008d458]
lea r8, [0x1700726ff]
lea r9, str.module__p__name__p._n
mov ecx, 3
call fcn.17002dd80
test rdi, rdi
jne 0x17002f58f
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x10]
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rbx, qword [0x17008f570]
test rbx, rbx
je 0x17002f5ad
cmp qword [rbx + 0x30], rdi
je 0x17002f5e9
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov rbx, rax
nop word cs:[rax + rax]
nop
mov rbx, qword [rbx]
cmp rbx, rax
je 0x17002f610
cmp qword [rbx + 0x20], rdi
jne 0x17002f5d0
add rbx, 0xfffffffffffffff0
mov qword [0x17008f570], rbx
lea rdx, [rbx + 0x48]
mov rcx, rsi
call sym.ntdll.dll_RtlCopyUnicodeString
movzx eax, word [rsi + 2]
movzx ecx, word [rbx + 0x48]
add rcx, 2
xor edx, edx
cmp rcx, rax
mov esi, 0xc0000023
cmovbe esi, edx
jmp 0x17002f615
mov esi, 0xc0000135
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x17002f630
Capabilities:
Get number of processors

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
and rsp, 0xfffffffffffffff0
mov r15, r9
mov rsi, r8
mov r14, rdx
mov ebx, ecx
mov r12, qword [rbp + 0xa0]
test byte [0x17008d458], 8
je 0x17002f6a1
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ebx
lea rdx, [0x17008d458]
lea r8, [0x170072726]
lea r9, str.flags__x__load_path__p__dll_characteristics__p__name__p__base__p._n
mov ecx, 3
call fcn.17002dd80
mov edi, 0xc000000d
cmp ebx, 7
ja 0x17002f861
mov eax, ebx
and eax, 3
cmp eax, 3
je 0x17002f861
cmp ebx, 4
jb 0x17002f6eb
test byte [0x17008d458], 1
je 0x17002f6eb
mov dword [rsp + 0x20], ebx
lea rdx, [0x17008d458]
lea r8, [0x170072726]
lea r9, str.Unsupported_flags__x._n
xor ecx, ecx
call fcn.17002dd80
test rsi, rsi
je 0x17002f715
test byte [0x17008d458], 1
je 0x17002f715
lea rdx, [0x17008d458]
lea r8, [0x170072726]
lea r9, str.dll_characteristics_unsupported._n
xor ecx, ecx
call fcn.17002dd80
mov rcx, qword [r15 + 8]
call fcn.17002e890
mov rsi, rax
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rdx, rsi
test rsi, rsi
jne 0x17002f739
mov rdx, qword [r15 + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
lea r9, [rsp + 0x50]
mov rcx, r14
call fcn.17002f880
mov edi, eax
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x17002f790
mov rax, qword [rax + 0x30]
mov qword [r12], rax
lea rcx, [rsp + 0x58]
call sym.ntdll.dll_RtlFreeUnicodeString
test edi, edi
je 0x17002f7b2
xor r13d, r13d
jmp 0x17002f7e3
test edi, edi
jne 0x17002f79e
mov rcx, qword [rsp + 0x48]
call sym.ntdll.dll_NtClose
lea rcx, [rsp + 0x58]
call sym.ntdll.dll_RtlFreeUnicodeString
mov edi, 0xc0000135
xor r13d, r13d
jmp 0x17002f7e3
test bl, 2
jne 0x17002f7d0
xor edi, edi
mov r13b, 1
test bl, 1
jne 0x17002f7e3
mov rdx, qword [r12]
xor edi, edi
xor ecx, ecx
call sym.ntdll.dll_LdrAddRefDll
jmp 0x17002f7e3
mov rdx, qword [r12]
mov ecx, 1
call sym.ntdll.dll_LdrAddRefDll
xor edi, edi
mov r13b, 1
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rsi
call sym.ntdll.dll_RtlFreeHeap
test byte [0x17008d458], 8
je 0x17002f861
mov rcx, r15
call fcn.170040430
mov rsi, rax
test r13b, r13b
je 0x17002f829
mov rbx, qword [r12]
jmp 0x17002f82b
xor ebx, ebx
mov rcx, r14
call fcn.170030560
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
lea rdx, [0x17008d458]
lea r8, [0x170072726]
lea r9, str._s_____p__load_path__s__n
mov ecx, 3
call fcn.17002dd80
mov eax, edi
lea rsp, [rbp + 0x38]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x170030440
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov rdi, rdx
mov esi, ecx
cmp ecx, 2
jb 0x170030489
test byte [0x17008d458], 1
je 0x170030489
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea rdx, [0x17008d458]
lea r8, [0x1700727cf]
lea r9, str._p_flags__x_not_implemented_n
xor ecx, ecx
call fcn.17002dd80
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rbx, qword [0x17008f570]
test rbx, rbx
je 0x1700304a7
cmp qword [rbx + 0x30], rdi
je 0x1700304d9
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov rbx, rax
nop
mov rbx, qword [rbx]
cmp rbx, rax
je 0x170030536
cmp qword [rbx + 0x20], rdi
jne 0x1700304c0
add rbx, 0xfffffffffffffff0
mov qword [0x17008f570], rbx
mov ax, 0xffff
test sil, 1
jne 0x1700304f0
movzx eax, word [rbx + 0x6c]
cmp ax, 0xffff
je 0x1700304f4
add eax, 1
mov word [rbx + 0x6c], ax
xor esi, esi
test byte [0x17008d458], 8
je 0x17003053b
mov rcx, qword [rbx + 0x60]
call fcn.170030560
movsx ecx, word [rbx + 0x6c]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, [0x1700727cf]
lea r9, str.__s__ldr.LoadCount:__d_n
mov ecx, 3
call fcn.17002dd80
jmp 0x17003053b
mov esi, 0xc000000d
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1700308a0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
and rsp, 0xfffffffffffffff0
mov rsi, r8
mov edi, edx
mov rbx, rcx
mov dword [rcx], 0
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r14, qword [rax + 0x18]
mov r15, qword [r14 + 0x10]
add r14, 0x10
cmp r15, r14
je 0x1700309f9
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rbx
lea r12, [rbx + 8]
mov ebx, 0x12c
xor eax, eax
mov dword [rsp + 0x24], 0
jmp 0x1700309d6
mov qword [r12], 0
mov rcx, qword [r15 + 0x30]
mov qword [r12 + 8], rcx
mov rcx, qword [r15 + 0x30]
mov qword [r12 + 0x10], rcx
mov ecx, dword [r15 + 0x40]
mov dword [r12 + 0x18], ecx
mov ecx, dword [r15 + 0x68]
mov dword [r12 + 0x1c], ecx
lea r13d, [rax + 1]
mov word [r12 + 0x20], ax
mov word [r12 + 0x22], 0
movzx eax, word [r15 + 0x6c]
mov word [r12 + 0x24], ax
mov dword [rsp + 0x38], 0x1000000
lea rax, [r12 + 0x28]
mov qword [rsp + 0x40], rax
lea rdx, [r15 + 0x48]
lea rcx, [rsp + 0x38]
xor r8d, r8d
call sym.ntdll.dll_RtlUnicodeStringToAnsiString
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
mov edx, 0x5c
call sym.ntdll.dll_strrchr
mov ecx, eax
sub ecx, esi
add ecx, 1
test rax, rax
mov eax, 0
cmove ecx, eax
mov word [r12 + 0x26], cx
mov rax, qword [rsp + 0x30]
add dword [rax], 1
add r12, 0x128
mov eax, r13d
mov r15, qword [r15]
add ebx, 0x128
cmp r15, r14
je 0x1700309e8
cmp ebx, edi
jbe 0x170030920
mov dword [rsp + 0x24], 0xc0000004
jmp 0x1700309c8
add ebx, 0xfffffed8
mov rsi, qword [rsp + 0x28]
mov edi, dword [rsp + 0x24]
jmp 0x170030a00
mov ebx, 4
xor edi, edi
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
test rsi, rsi
je 0x170030a13
mov dword [rsi], ebx
mov eax, edi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x170030a30
Capabilities:
Get number of processors

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3d8
lea rbp, [rsp + 0x80]
and rsp, 0xfffffffffffffff0
mov r14, r9
mov r12d, r8d
mov r15, rdx
mov r13, qword [rbp + 0x3c8]
mov edi, dword [rbp + 0x3c0]
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x40
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov rax, qword [rcx + 8]
movzx ebx, word [rcx]
mov edx, ebx
and edx, 0xfffffffe
nop
mov rcx, rdx
lea rsi, [rax + rdx]
cmp rsi, rax
jbe 0x170030ab8
lea rdx, [rcx - 2]
cmp word [rax + rcx - 2], 0x5c
jne 0x170030aa0
sub ebx, ecx
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x48], rcx
mov eax, ebx
add eax, 0xb8
mov word [rsp + 0x40], ax
mov word [rsp + 0x42], ax
lea rdx, str.RegistryMachineSoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov r8d, 0xb8
call sym.ntdll.dll_memcpy
lea rcx, [rsp + 0x1c8]
mov rdx, rsi
mov r8, rbx
call sym.ntdll.dll_memcpy
lea rcx, [rsp + 0x38]
lea r8, [rsp + 0x60]
mov edx, 1
call sym.ntdll.dll_NtOpenKey
mov ebx, eax
test eax, eax
jne 0x170030c96
cmp r12d, 4
jne 0x170030bac
test r13, r13
je 0x170030b32
mov dword [r13], 4
mov ebx, 0x80000005
cmp edi, 4
jb 0x170030c8c
mov rsi, qword [rsp + 0x38]
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, r15
call sym.ntdll.dll_RtlInitUnicodeString
mov dword [rsp + 0x34], 0x7e
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x7e
lea r9, [rsp + 0x90]
mov rcx, rsi
mov rdx, rdi
mov r8d, 2
call sym.ntdll.dll_NtQueryValueKey
mov ebx, eax
test eax, eax
jne 0x170030c8c
cmp dword [rsp + 0x94], 4
jne 0x170030c63
mov eax, dword [rsp + 0x9c]
jmp 0x170030c89
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x90]
mov rdx, r15
call sym.ntdll.dll_RtlInitUnicodeString
add edi, 0xc
mov dword [rsp + 0x50], edi
mov r15, qword gs:[0x30]
mov rax, qword [r15 + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rdi
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170030c5c
mov rsi, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x90]
mov rcx, rbx
mov r8d, 2
mov r9, rsi
call sym.ntdll.dll_NtQueryValueKey
mov ebx, eax
test eax, eax
je 0x170030c20
cmp ebx, 0x80000005
jne 0x170030c48
test r13, r13
je 0x170030c2c
mov eax, dword [rsi + 8]
mov dword [r13], eax
test r14, r14
je 0x170030c48
test ebx, ebx
jne 0x170030c48
mov rdx, rsi
add rdx, 0xc
mov r8d, dword [rsi + 8]
mov rcx, r14
call sym.ntdll.dll_memcpy
mov rax, qword [r15 + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rsi
call sym.ntdll.dll_RtlFreeHeap
jmp 0x170030c8c
mov ebx, 0xc0000017
jmp 0x170030c8c
mov eax, dword [rsp + 0x34]
and eax, 0xfffffffe
mov word [rsp + rax + 0x90], 0
lea rcx, [rsp + 0x9c]
xor edx, edx
mov r8d, 0x10
call sym.ntdll.dll_wcstoul
mov dword [r14], eax
mov rcx, qword [rsp + 0x38]
call sym.ntdll.dll_NtClose
mov eax, ebx
lea rsp, [rbp + 0x358]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x170030f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov bl, byte [0x17008f4f0]
test byte [0x17008d458], 8
je 0x170030f3f
lea rdx, [0x17008d458]
lea r8, [0x17007293f]
lea r9, [0x170072952]
mov ecx, 3
call fcn.17002dd80
mov byte [0x17008f4f0], 1
test bl, 1
jne 0x170030f65
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x17c8]
mov edx, 1
call sym.ntdll.dll_RtlProcessFlsData
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x18]
lea rbx, [rdi + 0x30]
mov rax, qword [rdi + 0x38]
cmp rax, rbx
je 0x170030fd6
movzx r8d, byte [0x17008f4f0]
jmp 0x170030f99
mov rax, qword [rax + 8]
cmp rax, rbx
je 0x170030fd6
mov ecx, dword [rax + 0x48]
test ecx, 0x80000
je 0x170030f90
lea rsi, [rax - 0x20]
cmp word [rsi + 0x6c], 0
je 0x170030fb4
test r8b, r8b
je 0x170030f90
and ecx, 0xfff7ffff
mov dword [rax + 0x48], ecx
mov rcx, rsi
xor edx, edx
call fcn.170031240
mov ecx, 2
mov rdx, rsi
call fcn.170036660
jmp 0x170030f7a
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x170033a20
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
and rsp, 0xfffffffffffffff8
mov rax, rdx
test r9, r9
je 0x170033a4a
mov r10, qword [r9]
test r10, r10
je 0x170033a4a
mov edx, dword [r10 + 0xc]
cmp edx, r8d
ja 0x170033a4a
add edx, dword [r10 + 0x10]
cmp edx, r8d
ja 0x170033a93
movzx r11d, word [rcx + 6]
test r11d, r11d
je 0x170033aa9
movzx edx, word [rcx + 0x14]
lea r10, [rcx + rdx]
add r10, 0x18
jmp 0x170033a7a
add r10, 0x28
add r11d, 0xffffffff
je 0x170033aa9
mov ecx, dword [r10 + 0xc]
cmp ecx, r8d
ja 0x170033a70
mov edx, dword [r10 + 0x10]
add edx, ecx
cmp edx, r8d
jbe 0x170033a70
test r9, r9
je 0x170033a9a
mov qword [r9], r10
mov ecx, dword [r10 + 0xc]
mov edx, dword [r10 + 0x14]
sub r8d, ecx
add r8, rdx
add rax, r8
jmp 0x170033aab
xor eax, eax
mov rsp, rbp
pop rbp
ret

Function at 0x170033ab0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
and rsp, 0xfffffffffffffff8
movzx edx, word [rcx + 6]
test edx, edx
je 0x170033aeb
movzx eax, word [rcx + 0x14]
add rax, rcx
add rax, 0x18
jmp 0x170033ad9
add rax, 0x28
add edx, 0xffffffff
je 0x170033aeb
mov ecx, dword [rax + 0xc]
cmp ecx, r8d
ja 0x170033ad0
add ecx, dword [rax + 0x10]
cmp ecx, r8d
jbe 0x170033ad0
jmp 0x170033aed
xor eax, eax
mov rsp, rbp
pop rbp
ret

Function at 0x170033b00
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov rsi, rdx
mov rdi, rcx
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
add rax, 0x20
jmp 0x170033b43
mov rcx, qword [rcx]
cmp rcx, rax
je 0x170033b5e
mov rbx, qword [rcx + 0x20]
cmp rbx, rdi
ja 0x170033b40
mov edx, dword [rcx + 0x30]
add rdx, rbx
cmp rdx, rdi
jbe 0x170033b40
jmp 0x170033b60
xor ebx, ebx
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov qword [rsi], rbx
mov rax, rbx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x170034b20
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
cmp edx, 1
jne 0x170034ba0
mov rsi, rcx
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rax, qword [0x17008f570]
test rax, rax
je 0x170034b55
cmp qword [rax + 0x30], rsi
je 0x170034b89
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x20
mov rax, rcx
nop dword [rax]
mov rax, qword [rax]
cmp rax, rcx
je 0x170034b94
cmp qword [rax + 0x20], rsi
jne 0x170034b70
add rax, 0xfffffffffffffff0
mov qword [0x17008f570], rax
cmp word [rax + 0x6e], 0xffff
jne 0x170034b94
or byte [rax + 0x6a], 4
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov eax, 1
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
Function at 0x170034f10
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdx, rcx
lea rcx, [rsp + 0x20]
call sym.ntdll.dll_RtlInitUnicodeString
mov rdx, qword [0x17008f570]
test rdx, rdx
je 0x170034f4e
add rdx, 0x58
lea rcx, [rsp + 0x20]
mov r8b, 1
call sym.ntdll.dll_RtlEqualUnicodeString
test al, al
je 0x170034f4e
mov rsi, qword [0x17008f570]
jmp 0x170034faf
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbx, qword [rax + 0x18]
mov rsi, qword [rbx + 0x10]
add rbx, 0x10
cmp rsi, rbx
je 0x170034fad
lea rdi, [rsp + 0x20]
jmp 0x170034f88
mov rsi, qword [rsi]
cmp rsi, rbx
je 0x170034fad
lea rdx, [rsi + 0x58]
mov rcx, rdi
mov r8b, 1
call sym.ntdll.dll_RtlEqualUnicodeString
test al, al
je 0x170034f80
cmp dword [rsi + 0x12c], 0
jne 0x170034f80
mov qword [0x17008f570], rsi
jmp 0x170034faf
xor esi, esi
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x170035090
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x40], r8
mov rbx, rdx
mov r15, rcx
test rcx, rcx
jne 0x1700350bc
mov r15, qword [0x17008f580]
mov rcx, r15
call sym.ntdll.dll_wcslen
mov rsi, rax
mov edi, esi
and edi, 0xfffffffc
mov rcx, rbx
call sym.ntdll.dll_wcslen
cmp edi, 0x14
mov ecx, 0x14
cmovae ecx, esi
lea r8d, [rax + rcx]
add r8d, 2
mov rdi, qword gs:[0x30]
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax + 0x30]
add r8, r8
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170035254
mov rsi, rax
movzx eax, word [r15]
test ax, ax
je 0x17003525b
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], rbx
xor r14d, r14d
jmp 0x170035150
mov al, byte [rsp + 0x37]
mov r13b, al
lea r15, [rbx + r13*2]
mov rcx, rdi
call sym.ntdll.dll_RtlFreeUnicodeString
movzx eax, word [r15]
test ax, ax
je 0x17003526a
mov r12d, r14d
xor ebp, ebp
mov rbx, r15
mov r14, qword [rsp + 0x48]
test ax, ax
je 0x170035187
nop word cs:[rax + rax]
nop dword [rax]
cmp ax, 0x3b
je 0x170035187
movzx eax, word [rbx + 2]
add rbx, 2
add rbp, 2
test ax, ax
jne 0x170035170
shr rbp, 1
xor r13d, r13d
cmp ax, 0x3b
sete byte [rsp + 0x37]
mov edi, ebp
lea r8, [rdi + rdi]
mov rcx, rsi
mov rdx, r15
call sym.ntdll.dll_memcpy
test ebp, ebp
je 0x1700351d0
lea eax, [rbp - 1]
cmp word [rsi + rax*2], 0x5c
je 0x1700351d2
add rbp, 1
mov word [rsi + rdi*2], 0x5c
jmp 0x1700351d2
xor ebp, ebp
mov rdi, qword [rsp + 0x40]
mov eax, ebp
lea rcx, [rsi + rax*2]
mov rdx, r14
call sym.ntdll.dll_wcscpy
mov qword [rdi + 8], 0
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus
test eax, eax
jne 0x170035266
mov ebp, r12d
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0xc0]
mov r9, qword [rsp + 0xc8]
call fcn.1700352b0
mov r12d, eax
mov r14d, 1
cmp eax, 0x4000000e
je 0x170035130
cmp r12d, 0xc0000135
jne 0x17003527b
mov r14d, ebp
jmp 0x170035130
mov ebp, 0xc0000017
jmp 0x170035295
mov r12d, 0xc0000135
mov ebp, r12d
jmp 0x170035283
mov ebp, eax
jmp 0x17003527e
mov ebp, 0x4000000e
test r14d, r14d
mov rdi, qword [rsp + 0x38]
jne 0x170035283
jmp 0x170035261
mov ebp, r12d
mov rdi, qword [rsp + 0x38]
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rsi
call sym.ntdll.dll_RtlFreeHeap
mov eax, ebp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret