joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14028e8a0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movups xmmword [rsp + 0x30], xmm9
movups xmmword [rsp + 0x40], xmm10
movups xmmword [rsp + 0x50], xmm11
movdqu xmm4, xmmword [str._f__nc]
movdqu xmm5, xmmword [0x140481de0]
movdqu xmm6, xmmword [0x140481df0]
movdqu xmm7, xmmword [0x140481e00]
movdqu xmm3, xmmword [r9]
movdqu xmm2, xmmword [r9 + 0x10]
movdqu xmm1, xmmword [r9 + 0x20]
movdqu xmm0, xmmword [r9 + 0x30]
movdqu xmm11, xmmword [0x140481e30]
movdqu xmm10, xmmword [0x140481e40]
movdqu xmm9, xmmword [0x140481e50]
movdqu xmm8, xmmword [0x140481e60]
mov rax, rdx
mov r11, rcx
lea rdx, [rcx + 0x1000]
lea rcx, [rcx + rax - 0x1000]
mov r10, r11
lea rbx, [rcx + 0x2000]
mov rax, r10
cmp r10, rcx
jae 0x14028e9b2
nop dword [rax + rax]
aesdec xmm3, xmm11
aesenc xmm2, xmm10
aesenc xmm7, xmmword [rax]
add rax, 0x40
aesdec xmm1, xmm9
aesenc xmm0, xmm8
prefetcht0 byte [rdx]
aesdec xmm6, xmmword [rax - 0x30]
aesenc xmm5, xmmword [rax - 0x20]
aesdec xmm4, xmmword [rax - 0x10]
movups xmmword [rax - 0x40], xmm3
add rdx, 0x40
movups xmmword [rax - 0x30], xmm2
movups xmmword [rax - 0x20], xmm1
movups xmmword [rax - 0x10], xmm0
cmp rax, rcx
jb 0x14028e950
mov rax, rcx
sub rax, r10
sub rax, 1
and rax, 0xffffffffffffffc0
lea r10, [r10 + rax + 0x40]
add rcx, 0x1000
cmp rcx, rbx
je 0x14028e9d0
mov rdx, r11
jmp 0x14028e940
movups xmmword [r9], xmm3
movups xmm8, xmmword [rsp + 0x20]
movups xmm9, xmmword [rsp + 0x30]
movups xmmword [r9 + 0x30], xmm0
movdqu xmm0, xmmword [0x140481e10]
movups xmm10, xmmword [rsp + 0x40]
movups xmmword [r9 + 0x10], xmm2
movups xmm11, xmmword [rsp + 0x50]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
movups xmmword [r9 + 0x20], xmm1
aesdec xmm4, xmm0
movdqu xmm0, xmmword [0x140481e20]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
movups xmmword [r8], xmm7
movups xmm7, xmmword [rsp + 0x10]
aesdec xmm4, xmm0
movups xmmword [r8 + 0x10], xmm6
movups xmm6, xmmword [rsp]
movups xmmword [r8 + 0x20], xmm5
movups xmmword [r8 + 0x30], xmm4
add rsp, 0x60
pop rbx
ret
Function at 0x1402e18e0
Capabilities:
Encode data using xor

Disassembly:
endbr64
cmp rcx, rdx
je 0x1402e1950
xor r9d, r9d
nop dword [rax]
mov r8, r9
mov rax, r9
add rcx, 1
shr rax, 2
shl r8, 6
add r8, rax
movsx eax, byte [rcx - 1]
sub eax, 0x61c88647
add r8, rax
xor r9, r8
cmp rdx, rcx
jne 0x1402e18f0
movabs rax, 0x200000005
mul r9
mov rax, r9
sub rax, rdx
shr rax, 1
add rdx, rax
mov rax, r9
shr rdx, 0x1e
mov rcx, rdx
shl rcx, 0x1f
sub rcx, rdx
sub rax, rcx
or eax, 0x40000000
ret
mov eax, 0x40000000
ret
Function at 0x1402f5a40
Capabilities:
Get socket status

Disassembly:
endbr64
push rdi
push rsi
push rbx
sub rsp, 0x460
mov rdi, qword [0x140485900]
mov rax, qword [rdi]
mov qword [rsp + 0x458], rax
xor eax, eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov rbx, rcx
mov qword [rsp + 0x258], rcx
mov rsi, rdx
lea ecx, [rcx + 1]
xor edx, edx
mov dword [rsp + 0x40], 1
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x250], 1
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov edx, eax
xor eax, eax
test edx, edx
jne 0x1402f5ae0
mov rdx, qword [rsp + 0x458]
sub rdx, qword [rdi]
jne 0x1402f5b79
add rsp, 0x460
pop rbx
pop rsi
pop rdi
ret
mov dword [rsp + 0x30], 0
cmp rbx, 0xffffffffffffffff
je 0x1402f5b6a
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
mov r8d, 0x1007
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1402f5b60
mov eax, dword [rsp + 0x30]
mov dword [rsi], 0
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], 0
test eax, eax
jne 0x1402f5b48
mov eax, 1
jmp 0x1402f5abb
mov dword [rsi], eax
lea rax, [0x14037a7e0]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 3
jmp 0x1402f5b3b
mov rcx, rsi
call method.boost::asio::detail::socket_ops.get_last_error_boost::system::error_code__bool___clone_.part.0_
jmp 0x1402f5b3b
mov edx, 0x2719
mov rcx, rsi
call fcn.140229d60
jmp 0x1402f5b3b
call dbg.__stack_chk_fail
nop
nop
Function at 0x1402f62a0
Capabilities:
Terminate thread

Disassembly:
endbr64
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [0x140485900]
mov r9d, 0xffffffff
xor r8d, r8d
movdqu xmm0, xmmword [rcx]
shufpd xmm0, xmm0, 1
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rbx, rcx
movups xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lock add dword [0x14037a780], 0
je 0x1402f6318
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rsp + 0x38]
sub rax, qword [rsi]
jne 0x1402f633b
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, qword [rbx]
xor r8d, r8d
lea rcx, [method.boost::asio::detail.apc_function_unsigned_long_long_]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1402f6304
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140303fe0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
endbr64
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4d8
mov rsi, qword [0x140485900]
mov r12, qword [sym.imp.WS2_32.dll_WSARecv]
lea rdi, [0x14037a7e0]
mov rax, qword [rsi]
mov qword [rsp + 0x4c8], rax
xor eax, eax
mov rbp, rcx
lea r15, [rsp + 0x48]
lea r14, [rsp + 0x50]
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x50], 0x400
lea r13, [rsp + 0x4c]
mov qword [rsp + 0x58], rax
mov rcx, qword [rbp]
mov rdx, r14
mov r9, r15
mov r8d, 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r13
call r12
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov qword [rsp + 0x68], rdi
cmp eax, 1
mov dword [rsp + 0x60], eax
sbb rdx, 0xffffffffffffffff
mov qword [rsp + 0x70], rdx
cmp eax, 0x40
je 0x140304160
cmp eax, 0x4d2
je 0x140304178
cmp eax, 0x2738
je 0x1403040c2
cmp eax, 0xea
je 0x1403040c2
test ebx, ebx
jne 0x140304120
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
cmp eax, 0x400
je 0x140304040
test eax, eax
jg 0x140304158
jne 0x140304120
xor eax, eax
mov rdx, qword [rsp + 0x4c8]
sub rdx, qword [rsi]
jne 0x1403041c9
add rsp, 0x4d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x2733
mov rcx, rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], 3
call method.boost::system.operator_boost::system::error_code_const__boost::system::error_code_const_
test al, al
je 0x140304190
mov eax, 1
jmp 0x1403040f3
lea rcx, [rsp + 0x60]
mov edx, 0x2746
call fcn.140229d60
jmp 0x1403040be
lea rcx, [rsp + 0x60]
mov edx, 0x274d
call fcn.140229d60
jmp 0x1403040be
lea rdx, [rsp + 0xa0]
mov rcx, rbx
mov dword [rsp + 0xa0], 0x4d5
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], 3
call method.boost::system.operator_boost::system::error_code_const__boost::system::error_code_const_
test al, al
je 0x1403040f1
jmp 0x140304158
call dbg.__stack_chk_fail
nop
nop
Function at 0x14031ad40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
add rdx, qword [rcx + 0x9e8]
nop dword [rax]
mov rcx, qword [rdx + rax]
xor qword [r8 + rax], rcx
add rax, 8
cmp rax, 0x40
jne 0x14031ad50
ret
Function at 0x14031b2f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
add rdx, qword [rcx + 0x9e8]
nop dword [rax]
mov rcx, qword [rdx + rax]
xor qword [r8 + rax], rcx
add rax, 8
cmp rax, 0x40
jne 0x14031b300
ret
Function at 0x14031b8a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
add rdx, qword [rcx + 0x9e8]
nop dword [rax]
mov rcx, qword [rdx + rax]
xor qword [r8 + rax], rcx
add rax, 8
cmp rax, 0x40
jne 0x14031b8b0
ret
Function at 0x14031be50
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
add rdx, qword [rcx + 0x9e8]
nop dword [rax]
mov rcx, qword [rdx + rax]
xor qword [r8 + rax], rcx
add rax, 8
cmp rax, 0x40
jne 0x14031be60
ret
Function at 0x14031d170
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rcx, qword [rcx + 0x9f8]
shr rdx, 6
lea rsi, [rsp + 0x20]
mov rbx, r8
mov r8d, edx
mov rdx, rsi
call method.randomx.initDatasetItem_randomx_cache__unsigned_char__unsigned_long_long_
xor eax, eax
movdqu xmm0, xmmword [rbx + rax]
pxor xmm0, xmmword [rsi + rax]
movups xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x14031d196
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x14031d2a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rcx, qword [rcx + 0x9f8]
shr rdx, 6
lea rsi, [rsp + 0x20]
mov rbx, r8
mov r8d, edx
mov rdx, rsi
call method.randomx.initDatasetItem_randomx_cache__unsigned_char__unsigned_long_long_
xor eax, eax
movdqu xmm0, xmmword [rbx + rax]
pxor xmm0, xmmword [rsi + rax]
movups xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x14031d2c6
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x14031d3d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rcx, qword [rcx + 0x9f8]
shr rdx, 6
lea rsi, [rsp + 0x20]
mov rbx, r8
mov r8d, edx
mov rdx, rsi
call method.randomx.initDatasetItem_randomx_cache__unsigned_char__unsigned_long_long_
xor eax, eax
movdqu xmm0, xmmword [rbx + rax]
pxor xmm0, xmmword [rsi + rax]
movups xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x14031d3f6
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x14031d500
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rcx, qword [rcx + 0x9f8]
shr rdx, 6
lea rsi, [rsp + 0x20]
mov rbx, r8
mov r8d, edx
mov rdx, rsi
call method.randomx.initDatasetItem_randomx_cache__unsigned_char__unsigned_long_long_
xor eax, eax
movdqu xmm0, xmmword [rbx + rax]
pxor xmm0, xmmword [rsi + rax]
movups xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x14031d526
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x14031da70
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
mov rcx, rdx
mov edx, 0x200000
mov r8, qword [rax + 0x9f0]
jmp sym.void_fillAes1Rx4_false__void__unsigned_long_long__void_

Function at 0x14031da90
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rcx
mov rcx, rdx
mov edx, 0x880
add r8, 0x40
jmp sym.void_fillAes4Rx4_false__void__unsigned_long_long__void_
Function at 0x14031dab0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x9f8], 0
mov rbx, rcx
je 0x14031daef
movdqu xmm0, xmmword [0x140585f60]
mov ecx, 0x200000
aesenc xmm0, xmm0
movups xmmword [0x140585f60], xmm0
call method.randomx::AlignedAllocator_64ull_.allocMemory_unsigned_long_long_
mov qword [rbx + 0x9f0], rax
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Cache_Dataset_not_set
mov rcx, rax
mov rbx, rax
call sym.std::invalid_argument::invalid_argument_char_const_
lea r8, [fcn.14027d6c0]
lea rdx, sym.imp.libstdc_6.dll_vtable_for_std::__cxx11::basic_stringbuf_char__std::char_traits_char___std::allocator_char___
mov rcx, rbx
call sym.__cxa_throw
mov rsi, rax
mov rcx, rbx
call sym.__cxa_free_exception
mov rcx, rsi
call sym._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x14031dfc0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
mov rcx, rdx
mov edx, 0x200000
mov r8, qword [rax + 0x9f0]
jmp sym.void_fillAes1Rx4_false__void__unsigned_long_long__void_

Function at 0x14031dfe0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rcx
mov rcx, rdx
mov edx, 0x880
add r8, 0x40
jmp sym.void_fillAes4Rx4_false__void__unsigned_long_long__void_

Function at 0x14031e000
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x9f8], 0
mov rbx, rcx
je 0x14031e03f
movdqu xmm0, xmmword [0x140585f60]
mov ecx, 0x200000
aesenc xmm0, xmm0
movups xmmword [0x140585f60], xmm0
call method.randomx::LargePageAllocator.allocMemory_unsigned_long_long_
mov qword [rbx + 0x9f0], rax
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Cache_Dataset_not_set
mov rcx, rax
mov rbx, rax
call sym.std::invalid_argument::invalid_argument_char_const_
lea r8, [fcn.14027d6c0]
lea rdx, sym.imp.libstdc_6.dll_vtable_for_std::__cxx11::basic_stringbuf_char__std::char_traits_char___std::allocator_char___
mov rcx, rbx
call sym.__cxa_throw
mov rsi, rax
mov rcx, rbx
call sym.__cxa_free_exception
mov rcx, rsi
call sym._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x14036f790
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x140485900]
mov qword [rsp + 0x50], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x20], r8
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
call dbg.__mingw_vfprintf
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbx]
jne 0x14036f7cf
add rsp, 0x30
pop rbx
ret
call dbg.__stack_chk_fail
nop
nop word cs:[rax + rax]
Function at 0x14036f7e0
Capabilities:
Generate random numbers via winapi

Disassembly:
endbr64
push rbx
sub rsp, 0x40
mov rbx, qword [0x140485900]
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14036f858
mov rcx, qword [rsp + 0x30]
lea r8, [0x140585ae0]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14036f8a5
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x14036f881
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x14036f87c
add rsp, 0x40
pop rbx
ret
mov ecx, 2
call qword [dbg.__acrt_iob_func]
lea rdx, str.Failed:_CryptAcquireContext_prov__NULL__NULL__PROV_RSA_FULL__CRYPT_VERIFYCONTEXT__CRYPT_SILENT_
mov rcx, rax
call sym.fprintf
mov ecx, 1
call sym._exit
call dbg.__stack_chk_fail
mov ecx, 2
call qword [dbg.__acrt_iob_func]
lea rdx, str.Failed:_CryptReleaseContext_prov__0_
mov rcx, rax
call sym.fprintf
mov ecx, 1
call sym._exit
mov ecx, 2
call qword [dbg.__acrt_iob_func]
lea rdx, str.Failed:_CryptGenRandom_prov___DWORD_n__result_
mov rcx, rax
call sym.fprintf
mov ecx, 1
call sym._exit
nop
nop
nop
nop
nop
nop
nop
Function at 0x1403746d0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x58
mov edx, 0x128
mov rsi, rcx
mov ecx, 1
call sym.calloc
mov rbx, rax
test rax, rax
je 0x140374738
mov dword [rax + 0x24], 0x7e
mov rax, qword [0x14039cdb8]
pcmpeqd xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x2c], rax
mov qword [rbx + 0x10], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x20]
mov dword [rbx + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [rsi], rbx
mov dword [rbx + 0x20], eax
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
ret
mov eax, 0xc
jmp 0x140374731
Function at 0x417480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41760b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006761d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4174e5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4174f4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417513
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417523
cmp rbx, 0x1000
jae 0x4174eb
jmp 0x41758d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417535
xor edx, edx
jmp 0x417584
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006761d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417519
jmp 0x417508
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006761d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00516a3a]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00516f93]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00519474]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x417640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417866
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006761d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4176b3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4176c2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4176e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4176f5
cmp rbx, 0x1000
jae 0x4176b9
nop
jmp 0x417778
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41770d
xor esi, esi
jmp 0x41776a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006761d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4176eb
jmp 0x4176d6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006761d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417800
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x00516fac]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x00516f93]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005133de]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4177a0
call sym.runtime.printlock
lea rax, [0x00516fac]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00516f93]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00518bd4]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x421640
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00675fb1], 0
jne 0x421730
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x421723
lea rsi, [0x006080b8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x4216fe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x0051b6f8]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x423b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423c86
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x423bc3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x423c7b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x423c7b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006761d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x423c69
xor eax, eax
jmp 0x423c73
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x423bb1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge