joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17000e7e0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc1
test byte [0x7ffe0308], 1
jne 0x17000e7f5
syscall
ret
jmp 0x17000e7f8
call qword [0x7ffe1000]
ret

Function at 0x17000e800
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc2
test byte [0x7ffe0308], 1
jne 0x17000e815
syscall
ret
jmp 0x17000e818
call qword [0x7ffe1000]
ret

Function at 0x17000e820
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc3
test byte [0x7ffe0308], 1
jne 0x17000e835
syscall
ret
jmp 0x17000e838
call qword [0x7ffe1000]
ret

Function at 0x17000e840
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc4
test byte [0x7ffe0308], 1
jne 0x17000e855
syscall
ret
jmp 0x17000e858
call qword [0x7ffe1000]
ret

Function at 0x17000e860
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc5
test byte [0x7ffe0308], 1
jne 0x17000e875
syscall
ret
jmp 0x17000e878
call qword [0x7ffe1000]
ret

Function at 0x17000e880
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc6
test byte [0x7ffe0308], 1
jne 0x17000e895
syscall
ret
jmp 0x17000e898
call qword [0x7ffe1000]
ret

Function at 0x17000e8a0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc7
test byte [0x7ffe0308], 1
jne 0x17000e8b5
syscall
ret
jmp 0x17000e8b8
call qword [0x7ffe1000]
ret

Function at 0x17000e8c0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc8
test byte [0x7ffe0308], 1
jne 0x17000e8d5
syscall
ret
jmp 0x17000e8d8
call qword [0x7ffe1000]
ret

Function at 0x17000e8e0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc9
test byte [0x7ffe0308], 1
jne 0x17000e8f5
syscall
ret
jmp 0x17000e8f8
call qword [0x7ffe1000]
ret

Function at 0x17000e900
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xca
test byte [0x7ffe0308], 1
jne 0x17000e915
syscall
ret
jmp 0x17000e918
call qword [0x7ffe1000]
ret

Function at 0x17000e920
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xcb
test byte [0x7ffe0308], 1
jne 0x17000e935
syscall
ret
jmp 0x17000e938
call qword [0x7ffe1000]
ret

Function at 0x17000e940
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xcc
test byte [0x7ffe0308], 1
jne 0x17000e955
syscall
ret
jmp 0x17000e958
call qword [0x7ffe1000]
ret

Function at 0x17000e960
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xcd
test byte [0x7ffe0308], 1
jne 0x17000e975
syscall
ret
jmp 0x17000e978
call qword [0x7ffe1000]
ret

Function at 0x17000e980
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xce
test byte [0x7ffe0308], 1
jne 0x17000e995
syscall
ret
jmp 0x17000e998
call qword [0x7ffe1000]
ret

Function at 0x17000e9a0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xcf
test byte [0x7ffe0308], 1
jne 0x17000e9b5
syscall
ret
jmp 0x17000e9b8
call qword [0x7ffe1000]
ret

Function at 0x17000e9c0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd0
test byte [0x7ffe0308], 1
jne 0x17000e9d5
syscall
ret
jmp 0x17000e9d8
call qword [0x7ffe1000]
ret
Function at 0x17000e9e0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd1
test byte [0x7ffe0308], 1
jne 0x17000e9f5
syscall
ret
jmp 0x17000e9f8
call qword [0x7ffe1000]
ret

Function at 0x17000ea00
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd2
test byte [0x7ffe0308], 1
jne 0x17000ea15
syscall
ret
jmp 0x17000ea18
call qword [0x7ffe1000]
ret

Function at 0x17000ea20
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd3
test byte [0x7ffe0308], 1
jne 0x17000ea35
syscall
ret
jmp 0x17000ea38
call qword [0x7ffe1000]
ret

Function at 0x17000ea40
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd4
test byte [0x7ffe0308], 1
jne 0x17000ea55
syscall
ret
jmp 0x17000ea58
call qword [0x7ffe1000]
ret

Function at 0x17000ea60
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd5
test byte [0x7ffe0308], 1
jne 0x17000ea75
syscall
ret
jmp 0x17000ea78
call qword [0x7ffe1000]
ret

Function at 0x17000ea80
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd6
test byte [0x7ffe0308], 1
jne 0x17000ea95
syscall
ret
jmp 0x17000ea98
call qword [0x7ffe1000]
ret

Function at 0x17000eaa0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd7
test byte [0x7ffe0308], 1
jne 0x17000eab5
syscall
ret
jmp 0x17000eab8
call qword [0x7ffe1000]
ret

Function at 0x17000eac0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd8
test byte [0x7ffe0308], 1
jne 0x17000ead5
syscall
ret
jmp 0x17000ead8
call qword [0x7ffe1000]
ret

Function at 0x17000eae0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd9
test byte [0x7ffe0308], 1
jne 0x17000eaf5
syscall
ret
jmp 0x17000eaf8
call qword [0x7ffe1000]
ret

Function at 0x17000eb00
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xda
test byte [0x7ffe0308], 1
jne 0x17000eb15
syscall
ret
jmp 0x17000eb18
call qword [0x7ffe1000]
ret

Function at 0x17000eb20
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xdb
test byte [0x7ffe0308], 1
jne 0x17000eb35
syscall
ret
jmp 0x17000eb38
call qword [0x7ffe1000]
ret

Function at 0x17000eb40
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xdc
test byte [0x7ffe0308], 1
jne 0x17000eb55
syscall
ret
jmp 0x17000eb58
call qword [0x7ffe1000]
ret

Function at 0x17000eb60
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xdd
test byte [0x7ffe0308], 1
jne 0x17000eb75
syscall
ret
jmp 0x17000eb78
call qword [0x7ffe1000]
ret

Function at 0x17000eb80
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xde
test byte [0x7ffe0308], 1
jne 0x17000eb95
syscall
ret
jmp 0x17000eb98
call qword [0x7ffe1000]
ret

Function at 0x17000eba0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xdf
test byte [0x7ffe0308], 1
jne 0x17000ebb5
syscall
ret
jmp 0x17000ebb8
call qword [0x7ffe1000]
ret

Function at 0x17000ebc0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe0
test byte [0x7ffe0308], 1
jne 0x17000ebd5
syscall
ret
jmp 0x17000ebd8
call qword [0x7ffe1000]
ret
Function at 0x17000ebe0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe1
test byte [0x7ffe0308], 1
jne 0x17000ebf5
syscall
ret
jmp 0x17000ebf8
call qword [0x7ffe1000]
ret

Function at 0x17000ec00
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe2
test byte [0x7ffe0308], 1
jne 0x17000ec15
syscall
ret
jmp 0x17000ec18
call qword [0x7ffe1000]
ret

Function at 0x17000ec20
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe3
test byte [0x7ffe0308], 1
jne 0x17000ec35
syscall
ret
jmp 0x17000ec38
call qword [0x7ffe1000]
ret

Function at 0x17000ec40
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe4
test byte [0x7ffe0308], 1
jne 0x17000ec55
syscall
ret
jmp 0x17000ec58
call qword [0x7ffe1000]
ret

Function at 0x17000ec60
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe5
test byte [0x7ffe0308], 1
jne 0x17000ec75
syscall
ret
jmp 0x17000ec78
call qword [0x7ffe1000]
ret

Function at 0x17000ec80
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe6
test byte [0x7ffe0308], 1
jne 0x17000ec95
syscall
ret
jmp 0x17000ec98
call qword [0x7ffe1000]
ret

Function at 0x17000eca0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe7
test byte [0x7ffe0308], 1
jne 0x17000ecb5
syscall
ret
jmp 0x17000ecb8
call qword [0x7ffe1000]
ret

Function at 0x17000ecc0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe8
test byte [0x7ffe0308], 1
jne 0x17000ecd5
syscall
ret
jmp 0x17000ecd8
call qword [0x7ffe1000]
ret

Function at 0x17000ece0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe9
test byte [0x7ffe0308], 1
jne 0x17000ecf5
syscall
ret
jmp 0x17000ecf8
call qword [0x7ffe1000]
ret

Function at 0x17000ed00
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xea
test byte [0x7ffe0308], 1
jne 0x17000ed15
syscall
ret
jmp 0x17000ed18
call qword [0x7ffe1000]
ret

Function at 0x17000ed20
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xeb
test byte [0x7ffe0308], 1
jne 0x17000ed35
syscall
ret
jmp 0x17000ed38
call qword [0x7ffe1000]
ret
Function at 0x17000f3d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov esi, r8d
mov r14, rdx
mov rbx, rcx
lea r8, [rsp + 0x30]
xor ecx, ecx
xor edx, edx
call sym.ntdll.dll_LdrLockLoaderLock
lea rdx, [rsp + 0x28]
mov rcx, rbx
call sym.ntdll.dll_LdrFindEntryForAddress
mov ebx, eax
test eax, eax
jne 0x17000f46c
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov rax, qword [rsp + 0x28]
movzx r8d, word [rax + 0x48]
add r8d, esi
add r8, 2
xor ebx, ebx
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [r14 + 8], rax
test rax, rax
je 0x17000f467
mov rdi, qword [rsp + 0x28]
mov rdx, qword [rdi + 0x50]
movzx r8d, word [rdi + 0x48]
add r8, 2
mov rcx, rax
call sym.ntdll.dll_memcpy
movzx eax, word [rdi + 0x48]
mov word [r14], ax
add si, word [rdi + 0x48]
add esi, 2
mov word [r14 + 2], si
jmp 0x17000f46c
mov ebx, 0xc0000017
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call sym.ntdll.dll_LdrUnlockLoaderLock
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x170010ff0
Capabilities:
Get process heap force flags

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov r14, r8
mov rsi, rdx
mov rdi, qword gs:[0x30]
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, 0x18
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x17001108f
mov rbx, rax
mov rax, qword [rdi + 0x290]
mov qword [rbx], rax
mov qword [rbx + 8], rsi
mov dword [rbx + 0x10], 0
mov qword [rdi + 0x290], rbx
mov rcx, rsi
call fcn.17000f2d0
test rax, rax
je 0x17001105d
lock add dword [rax + 4], 1
mov qword [r14], rbx
xor edi, edi
test byte [0x17008d130], 8
je 0x170011094
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
lea r8, [0x17006d07a]
lea r9, str._p_cookie_lx_n
mov ecx, 3
call fcn.17000f350
jmp 0x170011094
mov edi, 0xc0000017
mov eax, edi
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1700110a0
Capabilities:
Get process heap force flags

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
and rsp, 0xfffffffffffffff0
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, 0x18
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170011142
mov rbx, rax
mov rax, qword [rdi + 0x290]
mov qword [rbx], rax
mov qword [rbx + 8], rsi
mov dword [rbx + 0x10], 0
mov qword [rdi + 0x290], rbx
mov rcx, rsi
call fcn.17000f2d0
test rax, rax
je 0x170011110
lock add dword [rax + 4], 1
mov qword [r14], rbx
xor edi, edi
test byte [0x17008d130], 8
je 0x170011147
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
lea r8, [0x17006d07a]
lea r9, str._p_cookie_lx_n
mov ecx, 3
call fcn.17000f350
jmp 0x170011147
mov edi, 0xc0000017
mov eax, edi
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x170011bf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rcx
movzx r9d, word [rcx + 0x28]
movzx eax, word [rcx + 0x2a]
movzx ecx, word [rcx + 0x2c]
movzx edx, word [rsi + 0x2e]
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
lea r8, [0x17006ed90]
lea rcx, [rsp + 0x40]
mov edx, 0x40
call fcn.17001c0e0
mov rcx, qword [rsi]
test rcx, rcx
je 0x170011c49
call sym.ntdll.dll_wcslen
mov rdi, rax
add rdi, rax
jmp 0x170011c4b
xor edi, edi
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x170011c60
call sym.ntdll.dll_wcslen
add rdi, rax
add rdi, 0x19
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x170011c75
call sym.ntdll.dll_wcslen
add rdi, rax
add rdi, 0x12
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x170011c8a
call sym.ntdll.dll_wcslen
add rdi, rax
add rdi, 8
lea rcx, [rsp + 0x40]
call sym.ntdll.dll_wcslen
add rax, rdi
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
lea r8, [rax + rax]
add r8, 0x18
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170011cd1
mov rdi, rax
mov rdx, qword [rsi]
test rdx, rdx
je 0x170011cd8
mov rcx, rdi
call sym.ntdll.dll_wcscpy
jmp 0x170011cdd
xor edi, edi
jmp 0x170011e0d
mov word [rdi], 0
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x170011d2b
lea rdx, str._processorArchitecture
mov rcx, rdi
call sym.ntdll.dll_wcscat
mov rcx, rdi
call sym.ntdll.dll_wcslen
lea r15, [rdi + rax*2]
lea r14, [rdi + rax*2]
add r14, 2
mov word [rdi + rax*2], 0x22
mov rcx, r14
mov rdx, rbx
call sym.ntdll.dll_wcscpy
mov rcx, r14
call sym.ntdll.dll_wcslen
mov dword [r15 + rax*2 + 2], 0x22
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x170011d79
lea rdx, str._publicKeyToken
mov rcx, rdi
call sym.ntdll.dll_wcscat
mov rcx, rdi
call sym.ntdll.dll_wcslen
lea r15, [rdi + rax*2]
lea r14, [rdi + rax*2]
add r14, 2
mov word [rdi + rax*2], 0x22
mov rcx, r14
mov rdx, rbx
call sym.ntdll.dll_wcscpy
mov rcx, r14
call sym.ntdll.dll_wcslen
mov dword [r15 + rax*2 + 2], 0x22
mov rsi, qword [rsi + 0x20]
test rsi, rsi
je 0x170011dc7
lea rdx, str._type
mov rcx, rdi
call sym.ntdll.dll_wcscat
mov rcx, rdi
call sym.ntdll.dll_wcslen
lea r14, [rdi + rax*2]
lea rbx, [rdi + rax*2]
add rbx, 2
mov word [rdi + rax*2], 0x22
mov rcx, rbx
mov rdx, rsi
call sym.ntdll.dll_wcscpy
mov rcx, rbx
call sym.ntdll.dll_wcslen
mov dword [r14 + rax*2 + 2], 0x22
lea rdx, str._version
mov rcx, rdi
call sym.ntdll.dll_wcscat
mov rcx, rdi
call sym.ntdll.dll_wcslen
lea rbx, [rdi + rax*2]
lea rsi, [rdi + rax*2]
add rsi, 2
mov word [rdi + rax*2], 0x22
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sym.ntdll.dll_wcscpy
mov rcx, rsi
call sym.ntdll.dll_wcslen
mov dword [rbx + rax*2 + 2], 0x22
mov rax, rdi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x170023130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea rcx, [0x17008d270]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rbx, qword [0x17008d298]
lea rax, [0x17008d298]
xor ebp, ebp
mov r12d, 0
cmp rbx, rax
je 0x170023283
test rbx, rbx
je 0x170023283
lea rdi, [0x17008d270]
lea r14, [rsp + 0x38]
lea r13, str.call_vectored_handlers
xor r12d, r12d
nop word [rax + rax]
add dword [rbx + 0x18], 1
mov rcx, qword [rbx + 0x10]
call sym.ntdll.dll_RtlDecodePointer
mov r15, rax
mov rcx, rdi
call sym.ntdll.dll_RtlLeaveCriticalSection
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r12
call sym.ntdll.dll_RtlFreeHeap
test byte [0x17008d2a8], 8
je 0x170023202
mov eax, dword [rsi]
mov ecx, dword [rsi + 4]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov ecx, 3
mov r8, r13
lea r9, str.calling_handler_at__p_code_x_flags_x_n
call fcn.1700232c0
mov rcx, r14
call r15
mov ebp, eax
test byte [0x17008d2a8], 8
je 0x170023230
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov ecx, 3
mov r8, r13
lea r9, str.handler_at__p_returned__x_n
call fcn.1700232c0
mov rcx, rdi
call sym.ntdll.dll_RtlEnterCriticalSection
mov rcx, qword [rbx]
lea rax, [0x17008d298]
cmp rcx, rax
mov rax, rcx
mov edx, 0
cmove rax, rdx
add dword [rbx + 0x18], 0xffffffff
mov r12d, 0
jne 0x170023272
mov rdx, qword [rbx + 8]
mov qword [rcx + 8], rdx
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
mov qword [rdx], rcx
mov r12, rbx
cmp ebp, 0xffffffff
je 0x170023283
mov rbx, rax
test rax, rax
jne 0x1700231a0
lea rcx, [0x17008d270]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r12
call sym.ntdll.dll_RtlFreeHeap
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1700233a0
Capabilities:
Get number of processors

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
and rsp, 0xfffffffffffffff0
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x2c0]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x20], esi
lea rcx, [rsp + 0x20]
call sym.ntdll.dll_RtlRaiseException
Function at 0x17002db50
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
and rsp, 0xfffffffffffffff0
mov rsi, rcx
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rax, qword [0x17008f570]
test rax, rax
je 0x17002db80
cmp qword [rax + 0x30], rsi
je 0x17002dbb9
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x20
mov rax, rcx
nop dword [rax + rax]
mov rax, qword [rax]
cmp rax, rcx
je 0x17002dbcd
cmp qword [rax + 0x20], rsi
jne 0x17002dba0
add rax, 0xfffffffffffffff0
mov qword [0x17008f570], rax
mov esi, 0xc0000135
cmp word [rax + 0x6e], 0xffff
jne 0x17002dbd2
or byte [rax + 0x6a], 4
xor esi, esi
jmp 0x17002dbd2
mov esi, 0xc0000135
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov eax, esi
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret

Function at 0x17002dbf0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword [0x17008f570]
test rax, rax
je 0x17002dc02
cmp qword [rax + 0x30], rcx
je 0x17002dc3c
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, qword [rax + 0x18]
add r8, 0x20
xor eax, eax
mov rdx, r8
nop dword [rax]
mov rdx, qword [rdx]
cmp rdx, r8
je 0x17002dc3c
cmp qword [rdx + 0x20], rcx
jne 0x17002dc20
add rdx, 0xfffffffffffffff0
mov qword [0x17008f570], rdx
mov rax, rdx
ret

Function at 0x17002dc40
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
and rsp, 0xfffffffffffffff8
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r9, qword [rax + 0x18]
mov r8, qword [r9 + 0x20]
add r9, 0x20
mov eax, 0x8000001a
jmp 0x17002dc73
mov r8, qword [r8]
cmp r8, r9
je 0x17002dc96
mov r10, qword [r8 + 0x20]
cmp r10, rcx
ja 0x17002dc70
mov r11d, dword [r8 + 0x30]
add r10, r11
cmp r10, rcx
jbe 0x17002dc70
add r8, 0xfffffffffffffff0
mov qword [rdx], r8
xor eax, eax
mov rsp, rbp
pop rbp
ret

Function at 0x17002dca0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
and rsp, 0xfffffffffffffff0
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov byte [rsp + 0x47], 0
test byte [0x17008d458], 8
je 0x17002dcfa
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea rdx, [0x17008d458]
lea r8, [0x17007264a]
lea r9, str.__p___p___p__n
mov ecx, 3
call fcn.17002dd80
mov eax, 0xc000000d
test rbx, rbx
jne 0x17002dd69
test rdi, rdi
je 0x17002dd69
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
lea r14, [rsp + 0x47]
mov rbx, rsi
nop word cs:[rax + rax]
nop dword [rax]
mov rbx, qword [rbx]
cmp rbx, rsi
je 0x17002dd5b
lea rcx, [rbx - 0x10]
mov rdx, r15
mov r8, r14
call rdi
cmp byte [rsp + 0x47], 0
je 0x17002dd40
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
xor eax, eax
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x17002e0e0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
and rsp, 0xfffffffffffffff0
mov r14, r9
mov r13d, r8d
mov rbx, rdx
mov rdi, rcx
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlEnterCriticalSection
mov rax, qword [0x17008f570]
test rax, rax
je 0x17002e123
cmp qword [rax + 0x30], rdi
je 0x17002e15d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x20
mov rax, rcx
nop dword [rax + rax]
mov rax, qword [rax]
cmp rax, rcx
je 0x17002e21a
cmp qword [rax + 0x20], rdi
jne 0x17002e140
add rax, 0xfffffffffffffff0
mov qword [0x17008f570], rax
lea r9, [rsp + 0x34]
mov rcx, rdi
mov edx, 1
xor r8d, r8d
call sym.ntdll.dll_RtlImageDirectoryEntryToData
mov esi, 0xc000007a
mov qword [rsp + 0x28], rax
test rax, rax
je 0x17002e248
mov r8d, dword [rsp + 0x34]
test rbx, rbx
je 0x17002e221
mov rax, qword [rsp + 0x28]
mov esi, dword [rax + 0x18]
add esi, 0xffffffff
js 0x17002e213
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x40], r14
mov rbx, qword [rbx + 8]
movsxd rcx, dword [rax + 0x24]
add rcx, rdi
mov qword [rsp + 0x38], rcx
movsxd r14, dword [rax + 0x20]
add r14, rdi
xor r13d, r13d
jmp 0x17002e1dc
add r12d, 1
mov r13d, r12d
cmp r13d, esi
jg 0x17002e213
lea eax, [rsi + r13]
mov r12d, eax
shr r12d, 0x1f
add r12d, eax
sar r12d, 1
movsxd r15, r12d
movsxd rcx, dword [r14 + r15*4]
add rcx, rdi
mov rdx, rbx
call sym.ntdll.dll_strcmp
test eax, eax
je 0x17002e267
test eax, eax
jle 0x17002e1d0
add r12d, 0xffffffff
mov esi, r12d
cmp r13d, esi
jle 0x17002e1dc
mov esi, 0xc000007a
jmp 0x17002e248
mov esi, 0xc0000135
jmp 0x17002e248
mov rdx, qword [rsp + 0x28]
sub r13d, dword [rdx + 0x10]
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r9d, r13d
call fcn.17002e3c0
test rax, rax
je 0x17002e248
mov qword [r14], rax
xor esi, esi
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rsp + 0x38]
movzx r9d, word [rax + r15*2]
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
call fcn.17002e3c0
mov r14, qword [rsp + 0x40]
mov esi, 0xc000007a
test rax, rax
jne 0x17002e243
jmp 0x17002e248