joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010b994
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.140103b4c
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x14010b9e7
test rbx, rbx
je 0x14010b9d8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x14010b9e7
mov edi, 4
jmp 0x14010ba90
call fcn.1401038f4
test al, al
jne 0x14010ba04
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x14010ba90
test bpl, bpl
je 0x14010ba67
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x14010b838]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14010ba90
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x14010ba61
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14010ba90
mov edi, dword [rsp + 0x44]
jmp 0x14010ba59
call fcn.140103a78
test al, al
jne 0x14010ba78
bts esi, 0x15
xor ecx, ecx
jmp 0x14010ba80
call fcn.1401039b0
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.14010372c
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x1401201d0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rbp + 0x2a0], rbx
mov qword [rbp + 0x2a8], rsi
mov qword [rbp + 0x2b0], rdi
xor r13b, r13b
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140120239
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140120240
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14012040b
movabs rbx, 0xffffffffffffff0
xor edi, edi
mov edx, __WSAFDIsSet
lea rcx, [rbp]
call fcn.140024260
nop
lea rax, [rbp + 0x5c]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140120263
inc ecx
cmp ecx, 0x3fffffff
jg 0x1401202d6
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x140120289
mov rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14007c170
sub rsp, rdx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x1401202d6
mov byte [rbx], 0
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
lea r8, [rbp + 0x5c]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, rdi
jmp 0x1401202d9
mov rbx, rdi
cmp byte [rbx], 0
jne 0x1401202e3
mov r8, rdi
jmp 0x1401202fa
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1401202f0
mov rdx, rbx
lea rcx, [rbp]
call fcn.14000ca90
lea r15, [rbp]
mov rbx, qword [rbp]
mov rdi, qword [rbp + 0x18]
cmp rdi, 0x10
cmovae r15, rbx
lea rcx, [rbp]
cmovae rcx, rbx
mov rax, qword [rbp + 0x10]
add rax, rcx
lea r14, [rbp]
cmp rdi, 0x10
cmovae r14, rbx
mov rsi, rax
sub rsi, r14
cmp r14, rax
mov eax, 0
cmova rsi, rax
test rsi, rsi
je 0x14012036e
mov ebx, eax
nop
movsx ecx, byte [rbx + r14]
call fcn.1400e42a0
mov byte [rbx + r15], al
inc rbx
cmp rbx, rsi
jne 0x140120350
mov rdi, qword [rbp + 0x18]
mov rbx, qword [rbp]
lea rcx, [rbp]
cmp rdi, 0x10
cmovae rcx, rbx
mov edx, 0x3fdbc7d9
call fcn.140120100
cmp eax, 0xc3a3021b
je 0x1401203f2
cmp rdi, 0x10
jb 0x1401203c5
lea rax, [rdi + 1]
cmp rax, 0x1000
jb 0x1401203bd
test bl, 0x1f
jne 0x1401203ec
mov rax, qword [rbx - 8]
cmp rax, rbx
jae 0x1401203e6
sub rbx, rax
cmp rbx, 8
jb 0x1401203e0
cmp rbx, 0x27
ja 0x1401203da
mov rbx, rax
mov rcx, rbx
call fcn.14007b810
lea rdx, [rbp + 0x30]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1401203fe
jmp 0x140120240
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
nop
mov r13b, 1
lea rcx, [rbp]
call fcn.140007010
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r13b
mov rbx, qword [rbp + 0x2a0]
mov rsi, qword [rbp + 0x2a8]
mov rdi, qword [rbp + 0x2b0]
lea rsp, [rbp + 0x270]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14012aee0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov edx, 8
xor dil, dil
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, 0xa3
lea rcx, [rsp + 0x30]
mov rbx, rax
mov dword [rax], 1
call fcn.140024260
cmp qword [rax + 0x18], 0x10
jb 0x14012af1d
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbx + 4], eax
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x14012af79
mov rcx, qword [rsp + 0x30]
inc rax
cmp rax, 0x1000
jb 0x14012af74
test cl, 0x1f
jne 0x14012b02c
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14012b032
sub rcx, rax
cmp rcx, 8
jb 0x14012b038
cmp rcx, 0x27
ja 0x14012b03e
mov rcx, rax
call fcn.14007b810
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], rsi
call fcn.14001c020
cmp qword [rax + 0x18], 0x10
jb 0x14012af92
mov rax, qword [rax]
mov edx, 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x60]
mov r9, rbx
mov qword [rsp + 0x20], rcx
mov rcx, rax
lea r8d, [rdx + 7]
call sub.DNSAPI.dll_DnsQuery_A
mov esi, eax
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x14012affb
mov rcx, qword [rsp + 0x30]
inc rax
cmp rax, 0x1000
jb 0x14012aff6
test cl, 0x1f
jne 0x14012b044
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14012b04a
sub rcx, rax
cmp rcx, 8
jb 0x14012b050
cmp rcx, 0x27
ja 0x14012b056
mov rcx, rax
call fcn.14007b810
test esi, esi
jne 0x14012b00f
mov rcx, qword [rsp + 0x60]
lea edx, [rsi + 1]
mov dil, 1
call sub.DNSAPI.dll_DnsFree
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x68]
movzx eax, dil
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3

Function at 0x14012b0b0
Capabilities:
Create thread
Terminate thread

Disassembly:
sub rsp, 0x38
mov eax, dword [0x14017cd94]
cmp dword [0x14017cd98], eax
je 0x14012b0d7
mov dword [0x14017cd98], eax
mov dword [0x14017cd9c], 0
add rsp, 0x38
ret
mov eax, dword [0x14017cd9c]
inc eax
mov dword [0x14017cd9c], eax
cmp eax, 0x708
jl 0x14012b13e
mov rcx, qword [0x14017cd38]
xor edx, edx
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x14012b134
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, section..code
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14017cd38], rax
mov dword [0x14017cd9c], 0
add rsp, 0x38
ret
Function at 0x140ed91b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140ed933f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ed91e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ed91cf
add dl, dl
jne 0x140ed91f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ed9256
xor eax, eax
add dl, dl
jne 0x140ed9205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ed930d
add dl, dl
jne 0x140ed9216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ed9223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ed9230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ed923d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ed924a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ed91de
mov eax, 1
add dl, dl
jne 0x140ed9266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ed9273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ed925b
sub eax, ebx
mov ebx, 1
jne 0x140ed92ac
mov ecx, 1
add dl, dl
jne 0x140ed928e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ed929b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ed9283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ed91de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ed92c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ed92d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ed92bd
cmp eax, 0x7d00
jae 0x140ed92fb
cmp eax, 0x500
jb 0x140ed92f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ed91de
cmp eax, 0x7f
ja 0x140ed92fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ed91de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ed9332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ed91de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1408c231f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, edi
jmp 0x1407be531
not edx
jmp 0x1407ce132
dec edx
stc
rol edx, 3
neg edx
sub edx, 0x537d295c
xor edx, 0x67b3504b
push rdi
xor dword [rsp], edx
and di, 0x7140
pop rdi
test dx, r8w
stc
movsxd rdx, edx
clc
add rbp, rdx
jmp 0x140884038
push rbp
ret
pushfq
cmp di, r14w
push rcx
test r10, 0x14c249a
push rax
bt rax, 9
movzx rax, bp
push r12
push r13
or ax, r9w
bswap rax
cmp r9d, ebp
push r10
nop
cmp r15d, esi
push rdx
rcl dx, cl
test r10b, 0x7f
push rdi
mov dh, dh
cdq
push rsi
push rbx
mov al, dil
bsr si, r11w
mov sil, 0x6a
push r9
btc di, 0x25
bt bx, 0x82
test r15, 0x2ad1d94
push r11
btc ebx, 0x92
push r15
btr si, 0x97
rdtsc
push rbp
push r14
sar ah, 0x7a
push r8
movabs rax, 0
and bpl, r10b
push rax
sub sil, 0xc6
mov r11, qword [rsp + 0x90]
seta bl
not r11d
neg bpl
btr dx, 0x60
neg r11d
mov bx, 0x6ff5
sub r11d, 0x270376d7
not r11d
lea r11, [r11 + rax]
movzx si, r15b
movabs rbx, 0x100000000
sal dil, 1
rdtsc
add r11, rbx
sbb ebp, 0x54454037
mov rsi, rsp
setae dl
sub rsp, 0x180
cmc
and rsp, 0xfffffffffffffff0
mov rdi, r11
sbb dx, 0x3862
ror ah, 0x6c
bt bp, 0x7d
movabs rax, 0
xadd bpl, dl
cmp r14w, cx
sub rdi, rax
lea rbp, [0x1408c2422]
stc
mov edx, dword [r11]
test r12w, 0x4e8f
add r11, 4
jmp 0x1407b4a1d
Function at 0x417480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41760b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4174e5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4174f4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417513
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417523
cmp rbx, 0x1000
jae 0x4174eb
jmp 0x41758d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417535
xor edx, edx
jmp 0x417584
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417519
jmp 0x417508
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00524f07]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00525452]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00527965]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x417640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417866
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4176b3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4176c2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4176e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4176f5
cmp rbx, 0x1000
jae 0x4176b9
nop
jmp 0x417778
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41770d
xor esi, esi
jmp 0x41776a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4176eb
jmp 0x4176d6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417800
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x0052546b]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x00525452]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0052198d]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4177a0
call sym.runtime.printlock
lea rax, [0x0052546b]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00525452]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00527133]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x421640
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0068f0b1], 0
jne 0x421730
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x421723
lea rsi, [0x006211b8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x4216fe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x00529d11]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x423b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423c86
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x423bc3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x423c7b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x423c7b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x423c69
xor eax, eax
jmp 0x423c73
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x423bb1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x430720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430819
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x0068f710]
test ecx, ecx
je 0x4307f2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [sym.runtime._mLockProfile_.captureStack.func1]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x4307ec
jae 0x43080e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [sym.runtime._LostContendedRuntimeLock]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime._mLockProfile_.captureStack
Function at 0x430fe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x431128
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x98], dil
test dil, dil
jne 0x43100d
xor edx, edx
xor esi, esi
jmp 0x431054
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rax
mov eax, 6
call sym.runtime.stopTheWorld
mov rcx, qword [rsp + 0x90]
movzx edi, byte [rsp + 0x98]
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], 0
nop dword [rax]
test rbx, rbx
jne 0x43106d
test dil, dil
jmp 0x431111
mov qword [rsp + 0x18], rsi
mov byte [rsp + 0x17], dl
lea rdx, [rsp + 0x80]
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rsi, [sym.runtime.Stack.func1]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
mov rax, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov byte [rsp + 0x60], dil
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068f2d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x98]
test al, al
movzx edx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x18]
je 0x43111d
mov eax, edx
mov rbx, rsi
call sym.runtime.startTheWorld
mov rax, qword [rsp + 0x20]
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime.Stack