joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1700394f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov r15, rdx
mov r13, rcx
movzx r14d, word [rdx]
movzx r12d, r14w
test r8b, r8b
je 0x17003954c
mov word [r13 + 2], r14w
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r12
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r13 + 8], rax
test rax, rax
jne 0x170039558
mov eax, 0xc0000017
jmp 0x1700395c4
mov eax, 0x80000005
cmp r14w, word [r13 + 2]
ja 0x1700395c4
cmp r14w, 2
jb 0x1700395bd
shr r12, 1
xor eax, eax
nop word cs:[rax + rax]
nop
mov rcx, qword [0x17008d6a8]
mov rdx, qword [r15 + 8]
movzx esi, word [rdx + rax*2]
mov edx, esi
shr edx, 7
and edx, 0x1fe
movzx edx, word [rcx + rdx]
mov edi, esi
shr edi, 4
and edi, 0xf
add rdi, rdx
movzx edx, word [rcx + rdi*2]
mov ebx, esi
and ebx, 0xf
add rbx, rdx
movzx ecx, word [rcx + rbx*2]
add cx, si
mov rdx, qword [r13 + 8]
mov word [rdx + rax*2], cx
add rax, 1
cmp r12, rax
jne 0x170039570
mov word [r13], r14w
xor eax, eax
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x170039620
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov r15, rdx
mov r13, rcx
movzx r14d, word [rdx]
movzx r12d, r14w
test r8b, r8b
je 0x17003967c
mov word [r13 + 2], r14w
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r12
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r13 + 8], rax
test rax, rax
jne 0x170039688
mov eax, 0xc0000017
jmp 0x1700396f4
mov eax, 0x80000005
cmp r14w, word [r13 + 2]
ja 0x1700396f4
cmp r14w, 2
jb 0x1700396ed
shr r12, 1
xor eax, eax
nop word cs:[rax + rax]
nop
mov rcx, qword [0x17008d6a0]
mov rdx, qword [r15 + 8]
movzx esi, word [rdx + rax*2]
mov edx, esi
shr edx, 7
and edx, 0x1fe
movzx edx, word [rcx + rdx]
mov edi, esi
shr edi, 4
and edi, 0xf
add rdi, rdx
movzx edx, word [rcx + rdi*2]
mov ebx, esi
and ebx, 0xf
add rbx, rdx
movzx ecx, word [rcx + rbx*2]
add cx, si
mov rdx, qword [r13 + 8]
mov word [rdx + rax*2], cx
add rax, 1
cmp r12, rax
jne 0x1700396a0
mov word [r13], r14w
xor eax, eax
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x170039d80
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov dword [rsp + 0x34], ecx
test rdx, rdx
je 0x170039e46
mov ebx, r9d
mov r15d, r8d
mov r13, rdx
mov r12, qword [0x17008f5c8]
mov esi, dword [r12 + 0x40]
add ecx, 0xfffffc00
rol ecx, 0x16
cmp ecx, 4
ja case.default.0x170039ddf
mov r14d, 0xc0000001
mov al, 1
lea rdx, [0x170039f50]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
xor eax, eax
lea rdx, [rsp + 0x34]
mov ecx, eax
call sym.ntdll.dll_NtQueryDefaultLocale
mov r8, qword [0x17008f5c8]
movzx edx, word [r8 + 0x1e]
mov r14d, 0xc00000ef
test edx, edx
je case.0x170039ddf.4
mov r9d, ebx
add r12, rsi
mov ebx, dword [rsp + 0x34]
mov ecx, dword [r8 + 0x2c]
add rcx, r8
add edx, 0xffffffff
xor esi, esi
jmp 0x170039e29
add edi, 0xffffffff
mov edx, edi
cmp esi, edx
jg case.0x170039ddf.4
lea eax, [rsi + rdx]
mov edi, eax
shr edi, 0x1f
add edi, eax
sar edi, 1
movsxd rax, edi
cmp dword [rcx + rax*8], ebx
ja 0x170039e20
jae 0x170039e68
add edi, 1
mov esi, edi
jmp 0x170039e25
mov r14d, 0xc00000f0
jmp case.0x170039ddf.4
mov r14d, 0xc00000ef
mov eax, r14d
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test r15b, 2
jne 0x170039e88
movzx edx, word [rcx + rax*8 + 4]
movzx ebx, word [r8 + 0x22]
imul ebx, edx
add ebx, dword [r8 + 0x24]
cmp word [rbx + r8 + 0x18], 0
je case.0x170039ddf.4
movzx ebx, word [rcx + rax*8 + 6]
movzx r15d, word [r12 + rbx*2]
test r9b, r9b
je 0x170039eca
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
lea rdi, [r15 + r15]
add rdi, 2
xor edx, edx
mov r8, rdi
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r13 + 8], rax
test rax, rax
je 0x170039f42
mov word [r13 + 2], di
jmp 0x170039ee8
movzx eax, word [r13 + 2]
lea ecx, [r15 + r15]
add ecx, 2
mov r14d, 0xc0000023
cmp ecx, eax
ja case.0x170039ddf.4
mov rax, qword [r13 + 8]
lea rdx, [r12 + rbx*2]
add rdx, 2
mov rcx, rax
call sym.ntdll.dll_wcscpy
add r15d, r15d
mov word [r13], r15w
xor r14d, r14d
test byte [0x17008d610], 8
je case.0x170039ddf.4
mov esi, dword [rsp + 0x34]
mov rcx, r13
call fcn.170040430
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
lea r8, [0x170073e70]
lea r9, str._04x_____s_n
mov ecx, 3
call fcn.170037250
jmp case.0x170039ddf.4
mov r14d, 0xc0000017
jmp case.0x170039ddf.4
Function at 0x1700443a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
and rsp, 0xfffffffffffffff0
mov r15, r9
mov r14, r8
mov r12d, edx
mov rsi, rcx
test byte [0x17008d6c0], 8
je 0x170044402
mov rcx, rsi
call fcn.170044180
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
lea r8, [0x17007716a]
lea r9, str.__s__u__p__p__n
mov ecx, 3
call fcn.170044100
xor ebx, ebx
test rsi, rsi
je 0x170044551
cmp word [rsi], 0
je 0x170044551
test r15, r15
je 0x170044423
mov qword [r15], 0
mov rcx, rsi
call sym.ntdll.dll_RtlIsDosDeviceName_U
test eax, eax
je 0x17004447b
mov edi, eax
movzx r15d, di
lea ebx, [r15 + 0xa]
cmp ebx, r12d
ja 0x170044551
lea ebx, [r15 + 8]
shr edi, 0x11
lea rdx, str.._
mov rcx, r14
call sym.ntdll.dll_wcscpy
lea rcx, [r14 + 8]
lea rdx, [rsi + rdi*2]
mov esi, r15d
mov r8, rsi
call sym.ntdll.dll_memmove
and esi, 0xfffffffe
mov word [rsi + r14 + 8], 0
jmp 0x170044551
mov rcx, rsi
mov rdx, r14
mov r8d, r12d
call fcn.1700449f0
test eax, eax
je 0x170044551
mov r13d, eax
cmp eax, r12d
jbe 0x1700444f3
mov rax, qword gs:[0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, r13d
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov rdi, rax
mov rcx, rsi
mov rdx, rax
mov r8d, r13d
call fcn.1700449f0
mov esi, eax
mov ebx, eax
add rbx, 2
mov eax, r12d
cmp rbx, rax
jbe 0x1700444fd
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rdi
call sym.ntdll.dll_RtlFreeHeap
jmp 0x170044551
mov ebx, r13d
test r15, r15
jne 0x170044529
jmp 0x170044551
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call sym.ntdll.dll_memcpy
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rdi
call sym.ntdll.dll_RtlFreeHeap
mov ebx, esi
test r15, r15
je 0x170044551
mov rcx, r14
mov dx, 0x5c
call sym.ntdll.dll_wcsrchr
test rax, rax
je 0x170044551
add r14, 4
cmp rax, r14
jb 0x170044551
cmp word [rax + 2], 0
je 0x170044551
add rax, 2
mov qword [r15], rax
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1700493d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x150
lea rbp, [rsp + 0x80]
and rsp, 0xfffffffffffffff0
test byte [0x17008d6e0], 8
je 0x1700493f4
call fcn.170049450
mov rdi, qword gs:[0x30]
mov rax, qword [rdi + 0x60]
cmp byte [rax + 2], 0
je 0x170049441
lea rax, [0x17006bf10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x40]
lea rsi, [rsp + 0x20]
mov rdx, rsi
call fcn.17006bfc8
test eax, eax
jne 0x170049441
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
mov qword [rdi], rsi
call sym.ntdll.dll_DbgBreakPoint
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
xor ecx, ecx
call sym.ntdll.dll_RtlExitUserThread
int3
Function at 0x17004a700
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebp, 0xc000000d
cmp cl, 5
ja 0x17004a7c2
mov rdi, r9
mov rsi, r8
mov r15, rdx
movsx rax, cl
lea rcx, [0x1700777b0]
mov r14, qword [rcx + rax*8]
mov rcx, r14
call sym.ntdll.dll_wcslen
mov rbp, rax
mov rcx, r15
call sym.ntdll.dll_wcslen
mov rbx, rax
add ebx, ebp
lea r12d, [rbx + rbx]
add r12d, 2
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
movsxd r8, r12d
xor ebp, ebp
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rdi + 8], rax
test rax, rax
je 0x17004a7bd
add ebx, ebx
mov rcx, rax
mov rdx, r14
call sym.ntdll.dll_wcscpy
mov rcx, qword [rdi + 8]
mov rdx, r15
call sym.ntdll.dll_wcscat
mov word [rdi], bx
mov word [rdi + 2], r12w
mov dword [rsi], 0x30
mov qword [rsi + 8], 0
mov dword [rsi + 0x18], 0x40
mov qword [rsi + 0x10], rdi
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
jmp 0x17004a7c2
mov ebp, 0xc0000017
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x17004bab0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x1058
call fcn.17006c0e4
sub rsp, rax
mov r15, rdx
mov rbx, rcx
lea r12, [rsp + 0x50]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call sym.ntdll.dll_RtlInitUnicodeString
lea rsi, [rsp + 0x3c]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x1000
mov rcx, rbx
mov rdx, rdi
mov r8d, 2
mov r9, r12
call sym.ntdll.dll_NtQueryValueKey
cmp eax, 0x80000005
jne 0x17004bb4e
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, dword [rsp + 0x3c]
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov r12, rax
mov eax, dword [rsp + 0x3c]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8d, 2
mov r9, r12
call sym.ntdll.dll_NtQueryValueKey
test eax, eax
je 0x17004bb8d
xor ebx, ebx
lea rax, [rsp + 0x50]
cmp r12, rax
je 0x17004bb79
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r12
call sym.ntdll.dll_RtlFreeHeap
mov rax, rbx
add rsp, 0x1058
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r14, [r12 + 0xc]
mov rcx, r14
mov dx, 0x3b
call sym.ntdll.dll_wcschr
mov esi, 2
test rax, rax
je 0x17004bbc9
nop dword [rax + rax]
add rax, 2
mov rcx, rax
mov dx, 0x3b
call sym.ntdll.dll_wcschr
add rsi, 1
test rax, rax
jne 0x17004bbb0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x30]
lea rbx, [rsi*8]
mov rcx, r14
call sym.ntdll.dll_wcslen
lea r8, [rbx + rax*2]
add r8, 2
mov rcx, rdi
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x17004bb52
mov rbx, rax
lea rdi, [rax + rsi*8]
mov rcx, rdi
mov rdx, r14
call sym.ntdll.dll_wcscpy
mov qword [rbx], rdi
mov rcx, rdi
mov dx, 0x3b
call sym.ntdll.dll_wcschr
test rax, rax
je 0x17004bc56
mov esi, 1
mov word [rax], 0
add rax, 2
mov qword [rbx + rsi*8], rax
add rsi, 1
mov rcx, rax
mov dx, 0x3b
call sym.ntdll.dll_wcschr
test rax, rax
jne 0x17004bc30
mov eax, esi
jmp 0x17004bc5b
mov eax, 1
mov qword [rbx + rax*8], 0
test byte [0x17008d700], 8
je 0x17004bb54
mov rcx, r15
call fcn.17004b890
mov rdi, rax
mov rcx, r14
call fcn.17004b890
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r8, str.load_list
lea r9, str._s___s_n
mov ecx, 3
call fcn.17004b070
jmp 0x17004bb54
Function at 0x17004d310
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x608
lea rbp, [rsp + 0x80]
and rsp, 0xfffffffffffffff0
mov r13, r9
mov r15d, edx
mov rdi, rcx
mov ecx, r8d
mov esi, 1
shl esi, cl
mov r12, qword [rbp + 0x5f0]
cmp r8d, 0x20
cmovae esi, r8d
mov rcx, rdi
call sym.ntdll.dll_strlen
mov rbx, rax
lea r14, [rsp + 0x200]
mov rcx, r14
mov rdx, rdi
call sym.ntdll.dll_strcpy
lea rcx, [rsp + rbx]
add rcx, 0x200
mov edx, 0x400
sub rdx, rbx
mov r8, r13
mov r9, r12
call sym.ntdll.dll__vsnprintf
test byte [0x17008d730], 4
je 0x17004d3db
cdqe
add rbx, rax
cmp byte [rsp + rbx + 0x1ff], 0xa
lea rax, str._08x:_08x:__s
lea r9, str._08x:_08x:__s_n
cmove r9, rax
mov rax, rsp
mov qword [rax + 0x30], r14
mov dword [rax + 0x28], esi
mov dword [rax + 0x20], r15d
lea rdx, [0x17008d730]
lea r8, [0x170077c4e]
mov ecx, 2
call fcn.17004cf00
mov eax, esi
test sil, 1
je 0x17004d497
mov rsi, qword gs:[0x30]
mov rax, qword [rsi + 0x60]
cmp byte [rax + 2], 0
je 0x17004d497
lea rax, [0x17006bdf0]
mov qword [rsp + 0xd8], rax
lea rax, [0x17004d4b0]
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xf0]
lea rdi, [rsp + 0xd0]
mov rdx, rdi
call fcn.17006bfc8
test eax, eax
jne 0x17004d497
mov rax, qword [rsi]
mov qword [rsp + 0xd0], rax
mov qword [rsi], rdi
mov qword [rsp + 0x38], 0x40010006
mov qword [rsp + 0x40], 0
lea rax, [sym.ntdll.dll_RtlRaiseException]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 2
mov qword [rsp + 0x60], r14
mov rcx, r14
call sym.ntdll.dll_strlen
add rax, 1
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x38]
call sym.ntdll.dll_RtlRaiseException
xor eax, eax
lea rsp, [rbp + 0x588]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x17004dd10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov ebx, r8d
mov rdi, rdx
mov esi, ecx
test byte [0x17008d720], 8
je 0x17004dd5e
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
lea rdx, [0x17008d720]
lea r8, [0x170077de9]
lea r9, str.__d__p__d__n
mov ecx, 3
call fcn.17004cf00
not esi
test ebx, ebx
jle 0x17004ddcb
test bl, 1
jne 0x17004dd72
mov eax, ebx
cmp ebx, 1
jne 0x17004dd94
jmp 0x17004ddcb
movzx eax, byte [rdi]
movzx ecx, sil
xor ecx, eax
lea rax, [0x170077e10]
shr esi, 8
xor esi, dword [rax + rcx*4]
add rdi, 1
lea eax, [rbx - 1]
cmp ebx, 1
je 0x17004ddcb
add eax, 2
lea rcx, [0x170077e10]
nop
movzx edx, byte [rdi]
movzx ebx, sil
xor ebx, edx
shr esi, 8
xor esi, dword [rcx + rbx*4]
movzx edx, byte [rdi + 1]
movzx ebx, sil
xor ebx, edx
shr esi, 8
xor esi, dword [rcx + rbx*4]
add eax, 0xfffffffe
add rdi, 2
cmp eax, 2
jg 0x17004dda0
not esi
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x17004ff90
Capabilities:
Compress data via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
and rsp, 0xfffffffffffffff0
mov r13, r9
mov r15d, r8d
mov rdi, rdx
mov ebx, ecx
mov rdx, qword [rbp + 0x80]
mov r14d, dword [rbp + 0x70]
test byte [0x17008d720], 1
movzx r12d, cx
je 0x170050019
mov rax, qword [rbp + 0x88]
mov ecx, dword [rbp + 0x78]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r12d
lea rdx, [0x17008d720]
lea r8, [0x170078450]
lea r9, str.0x_04x___p___u___p___u___u___p___p:_semi_stub_n
xor ecx, ecx
call fcn.17004cf00
and ebx, 0xfeff
mov esi, 0xc000000d
cmp bx, 2
jae 0x17005003d
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
jne 0x1700500d1
mov eax, r14d
mov r14, r13
test r15d, r15d
je 0x1700500b4
mov ebx, r15d
add rbx, rdi
mov r15d, eax
add r15, r13
mov r12d, 0x1000
mov rcx, r13
nop word cs:[rax + rax]
nop dword [rax]
mov rax, rbx
sub rax, rdi
cmp rax, 0x1000
cmovge rax, r12
mov esi, eax
lea r14, [rcx + rsi]
add r14, 2
cmp r14, r15
ja 0x170050109
add eax, 0xffffffff
or eax, 0x3000
mov word [rcx], ax
add rcx, 2
mov rdx, rdi
mov r8, rsi
call sym.ntdll.dll_memcpy
add rdi, rsi
mov rcx, r14
cmp rdi, rbx
jb 0x170050070
xor esi, esi
mov rax, qword [rbp + 0x80]
test rax, rax
je 0x17005002a
sub r14d, r13d
mov dword [rax], r14d
jmp 0x17005002a
mov esi, 0xc000025f
test byte [0x17008d720], 1
je 0x17005002a
mov dword [rsp + 0x20], r12d
lea rdx, [0x17008d720]
lea r8, [0x170078450]
lea r9, str.format__u_not_implemented_n
xor ecx, ecx
call fcn.17004cf00
jmp 0x17005002a
mov esi, 0xc0000023
jmp 0x17005002a

Function at 0x170052560
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov r14, rdx
mov r15, rcx
mov rcx, rdx
call sym.ntdll.dll_wcslen
mov rdi, rax
add eax, eax
add eax, 2
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
movsxd rbx, eax
xor esi, esi
xor edx, edx
mov r8, rbx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r15 + 8], rax
test rax, rax
je 0x1700525d0
add edi, edi
mov rcx, rax
mov rdx, r14
mov r8, rbx
call sym.ntdll.dll_memcpy
mov word [r15 + 2], bx
mov word [r15], di
mov sil, 1
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1700525e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x17005260c
mov rcx, rdi
call sym.ntdll.dll_strlen
movzx r14d, ax
jmp 0x17005260f
xor r14d, r14d
lea rcx, [rsp + 0x2c]
mov rdx, rdi
mov r8d, r14d
call sym.ntdll.dll_RtlMultiByteToUnicodeSize
mov eax, dword [rsp + 0x2c]
add eax, 2
cmp eax, 0xffff
jbe 0x170052631
xor ebx, ebx
jmp 0x170052689
lea ecx, [rax - 2]
mov word [rsi], cx
mov r8d, eax
mov word [rsi + 2], ax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor ebx, ebx
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsi + 8], rax
test rax, rax
je 0x170052689
movzx edx, word [rsi]
mov dword [rsp + 0x20], r14d
mov rcx, rax
xor r8d, r8d
mov r9, rdi
call sym.ntdll.dll_RtlMultiByteToUnicodeN
mov rax, qword [rsi + 8]
movzx ecx, word [rsi]
and ecx, 0xfffffffe
mov word [rax + rcx], 0
mov bl, 1
mov eax, ebx
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1700526a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rdx + 8]
movzx r8d, word [rdi]
lea rcx, [rsp + 0x2c]
call sym.ntdll.dll_RtlMultiByteToUnicodeSize
mov eax, dword [rsp + 0x2c]
add eax, 2
mov ebx, 0xc00000f0
cmp eax, 0xffff
ja 0x17005275c
lea ecx, [rax - 2]
mov word [rsi], cx
test r14b, r14b
je 0x170052719
mov r8d, eax
mov word [rsi + 2], ax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsi + 8], rax
test rax, rax
je 0x170052757
movzx ecx, word [rsi]
jmp 0x17005272a
movzx edx, word [rsi + 2]
mov ebx, 0x80000005
cmp eax, edx
ja 0x17005275c
mov rax, qword [rsi + 8]
movzx edx, cx
mov r9, qword [rdi + 8]
movzx ecx, word [rdi]
mov dword [rsp + 0x20], ecx
xor ebx, ebx
mov rcx, rax
xor r8d, r8d
call sym.ntdll.dll_RtlMultiByteToUnicodeN
mov rax, qword [rsi + 8]
movzx ecx, word [rsi]
and ecx, 0xfffffffe
mov word [rax + rcx], 0
jmp 0x17005275c
mov ebx, 0xc0000017
mov eax, ebx
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x170052810
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov esi, 0xc000000d
test rdx, rdx
je 0x17005284d
mov rdi, r8
test r8, r8
je 0x17005284d
mov rbx, rdx
mov r14d, ecx
movzx eax, word [rdx]
movzx ecx, word [rdx + 2]
cmp ax, cx
jbe 0x170052860
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test eax, eax
jne 0x170052870
test cx, cx
je 0x170052870
cmp qword [rbx + 8], 0
je 0x17005284d
cmp r14d, 2
je 0x17005284d
cmp r14d, 3
ja 0x17005284d
test eax, eax
jne 0x170052898
cmp r14d, 3
je 0x170052898
mov dword [rdi], 0
mov qword [rdi + 8], 0
xor esi, esi
jmp 0x17005284d
lea r15d, [rax + 2]
test r14d, r14d
cmove r15d, eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor esi, esi
xor edx, edx
mov r8, r15
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rdi + 8], rax
test rax, rax
je 0x170052908
mov r12, rax
mov rdx, qword [rbx + 8]
movzx r13d, word [rbx]
mov rcx, rax
mov r8, r13
call sym.ntdll.dll_memcpy
mov word [rdi], r13w
movzx eax, word [rbx]
mov word [rdi + 2], ax
test r14d, r14d
je 0x17005284d
mov word [rdi + 2], r15w
and r13d, 0xfffffffe
mov word [r12 + r13], 0
jmp 0x17005284d
mov esi, 0xc0000017
jmp 0x17005284d

Function at 0x170052d70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rdx + 8]
movzx r8d, word [rdi]
lea rcx, [rsp + 0x34]
call sym.ntdll.dll_RtlUnicodeToMultiByteSize
mov eax, dword [rsp + 0x34]
lea edx, [rax + 1]
mov word [rsi], ax
test bl, bl
je 0x170052dd9
mov word [rsi + 2], dx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, edx
xor ebx, ebx
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsi + 8], rax
test rax, rax
je 0x170052e1c
movzx eax, word [rsi]
jmp 0x170052df5
movzx ecx, word [rsi + 2]
xor ebx, ebx
cmp edx, ecx
jbe 0x170052df5
test cx, cx
je 0x170052e23
add ecx, 0xffffffff
mov word [rsi], cx
mov ebx, 0x80000005
mov eax, ecx
mov rcx, qword [rsi + 8]
movzx edx, ax
mov r9, qword [rdi + 8]
movzx eax, word [rdi]
mov dword [rsp + 0x20], eax
xor r8d, r8d
call sym.ntdll.dll_RtlUpcaseUnicodeToOemN
mov rax, qword [rsi + 8]
movzx ecx, word [rsi]
mov byte [rax + rcx], 0
jmp 0x170052e28
mov ebx, 0xc0000017
jmp 0x170052e28
mov ebx, 0x80000005
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x170052e90
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call sym.ntdll.dll_RtlOemStringToUnicodeSize
mov ebx, 0xc00000f0
cmp eax, 0xffff
ja 0x170052f3b
lea ecx, [rax - 2]
mov word [rsi], cx
test r14b, r14b
je 0x170052ef8
mov r8d, eax
mov word [rsi + 2], ax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsi + 8], rax
test rax, rax
je 0x170052f36
movzx ecx, word [rsi]
jmp 0x170052f09
movzx edx, word [rsi + 2]
mov ebx, 0x80000005
cmp eax, edx
ja 0x170052f3b
mov rax, qword [rsi + 8]
movzx edx, cx
mov r9, qword [rdi + 8]
movzx ecx, word [rdi]
mov dword [rsp + 0x20], ecx
xor ebx, ebx
mov rcx, rax
xor r8d, r8d
call sym.ntdll.dll_RtlOemToUnicodeN
mov rax, qword [rsi + 8]
movzx ecx, word [rsi]
and ecx, 0xfffffffe
mov word [rax + rcx], 0
jmp 0x170052f3b
mov ebx, 0xc0000017
mov eax, ebx
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x170052f50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rdx + 8]
movzx r8d, word [rdi]
lea rcx, [rsp + 0x34]
call sym.ntdll.dll_RtlUnicodeToMultiByteSize
mov eax, dword [rsp + 0x34]
lea edx, [rax + 1]
mov word [rsi], ax
test bl, bl
je 0x170052fb9
mov word [rsi + 2], dx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, edx
xor ebx, ebx
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsi + 8], rax
test rax, rax
je 0x170052ffc
movzx eax, word [rsi]
jmp 0x170052fd5
movzx ecx, word [rsi + 2]
xor ebx, ebx
cmp edx, ecx
jbe 0x170052fd5
test cx, cx
je 0x170053003
add ecx, 0xffffffff
mov word [rsi], cx
mov ebx, 0x80000005
mov eax, ecx
mov rcx, qword [rsi + 8]
movzx edx, ax
mov r9, qword [rdi + 8]
movzx eax, word [rdi]
mov dword [rsp + 0x20], eax
xor r8d, r8d
call sym.ntdll.dll_RtlUnicodeToMultiByteN
mov rax, qword [rsi + 8]
movzx ecx, word [rsi]
mov byte [rax + rcx], 0
jmp 0x170053008
mov ebx, 0xc0000017
jmp 0x170053008
mov ebx, 0x80000005
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret