joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012070
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140037010]
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400120c6
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140013868
cmp rax, 0x105
jb 0x1400120dd
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140026460
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.14001399c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call fcn.140035970
test eax, eax
je 0x1400120c6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001212a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400120c6
lea rdx, str.UpdateLogs
mov rcx, rdi
call fcn.140035970
test eax, eax
je 0x1400120c6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001215f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400120c6
mov esi, 1
jmp 0x1400120c6
Function at 0x140012870
Capabilities:
Query service status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x140012970
mov rsi, rax
mov rcx, rax
mov rdx, rdi
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140012996
mov rdi, rax
mov dword [rsp + 0x3c], 0xcf
imul ebp, ebx, 0x3e8
test ebp, ebp
je 0x1400129c0
xor r14d, r14d
lea r15, [rsp + 0x34]
lea rbx, [rsp + 0x38]
mov r12, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
mov rcx, rdi
xor edx, edx
mov r8, rbx
mov r9d, 0x24
call r12
test eax, eax
je 0x140012925
cmp dword [rsp + 0x3c], 1
jne 0x140012956
jmp 0x1400129e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jle 0x140012942
lea ecx, [rax - 0x425]
cmp ecx, 2
jb 0x140012956
jmp 0x140012a32
cmp eax, 0x79
jle 0x1400129e8
cmp eax, 0x41c
jne 0x140012a13
mov ecx, 0x32
call r13
add r14d, 0x32
cmp r14d, ebp
jb 0x1400128ff
mov ebx, dword [rsp + 0x3c]
jmp 0x140012a50
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov ebx, 0xfd
cmovne ebx, ecx
jmp 0x140012a63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x1400129ca
cmp edi, 5
je 0x1400129fe
cmp edi, 6
jne 0x140012a0c
mov ebx, 0xec
jmp 0x140012a63
mov ebx, 0xcf
jmp 0x140012a50
cmp edi, 0x7b
je 0x140012a05
cmp edi, 0x424
jne 0x140012a0c
mov ebx, 0xee
jmp 0x140012a63
mov ebx, 1
jmp 0x140012a50
cmp eax, 5
je 0x140012a24
cmp eax, 6
je 0x140012a2b
cmp eax, 0x57
jne 0x140012a40
mov ebx, 0xdc
jmp 0x140012a4c
mov ebx, 0xeb
jmp 0x140012a63
mov ebx, 0xed
jmp 0x140012a63
mov ebx, 0xef
jmp 0x140012a63
cmp eax, 0x7a
je 0x140012a47
cmp eax, 0x7c
jne 0x140012a40
mov ebx, 0xdd
jmp 0x140012a4c
mov ebx, 0xda
jmp 0x140012a4c
mov ebx, 0xd9
jmp 0x140012a4c
cmp eax, 0x45b
jne 0x140012a40
mov ebx, 0xde
jmp 0x140012a4c
mov ebx, 0xdf
jmp 0x140012a4c
mov ebx, 0xdb
mov dword [rsp + 0x3c], ebx
mov r14, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call r14
mov rcx, rsi
call r14
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140026460
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012a90
Capabilities:
Start service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rdx
mov r14d, ecx
lea edi, [r14 + 2]
lea rax, [rdi*8]
cmp ecx, 0xfffffffe
mov rcx, 0xffffffffffffffff
cmovge rcx, rax
call fcn.140013794
mov rsi, rax
lea rax, str.MozillaMaintenance
mov qword [rsi], rax
lea rax, str.software_update
mov qword [rsi + 8], rax
test r14d, r14d
jle 0x140012af5
lea rcx, [rsi + 0x10]
mov r8d, r14d
shl r8, 3
mov rdx, rbx
call fcn.1400264b0
lea rcx, str.MozillaMaintenance
mov edx, 5
call fcn.140012870
cmp eax, 1
jne 0x140012b8f
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x140012b99
mov rbx, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0x10
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140012ba0
mov r14, rax
mov qword [rsp + 0x20], rbx
mov r15d, 0xffffff9c
mov r12, qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r14
mov edx, edi
mov r8, rsi
call r12
test eax, eax
jne 0x140012bb0
call r13
mov ebp, eax
mov ecx, 0x64
call rbx
add r15d, 0x64
cmp r15d, 0x1324
jb 0x140012b65
jmp 0x140012bb2
mov ebp, eax
add ebp, 0x4e20
jmp 0x140012bc8
mov ebp, 0x4269
jmp 0x140012bc8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, 0x426a
jmp 0x140012bc8
xor ebp, ebp
mov rbx, qword [rsp + 0x20]
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call rdi
mov rcx, rbx
call rdi
mov rcx, rsi
call fcn.140013994
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140012bf0
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x238], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
xor edx, edx
call fcn.1400155d0
mov rcx, rdi
call fcn.140013868
cmp rax, 0x104
ja 0x140012c6d
lea rbx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
mov rdx, rdi
call fcn.14001399c
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [rsi], ecx
mov ebx, 1
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140026460
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret
Function at 0x140012c90
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
call fcn.1400116d0
test al, al
je 0x140012d7f
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
xor edi, edi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012d7f
mov rcx, qword [rsp + 0x38]
lea rbx, [rsp + 0x44]
mov dword [rbx], 4
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, str.ConsentPromptBehaviorAdmin
xor edi, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140012d2e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012d7f
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, str.PromptOnSecureDesktop
xor edi, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140012d7f
mov eax, dword [rsp + 0x34]
xor ecx, ecx
or eax, dword [rsp + 0x30]
sete cl
mov dword [rsi], ecx
mov edi, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140026460
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001a1bc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a2ec

Function at 0x14001f54c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001f56c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001adf0
or eax, 0xffffffff
jmp 0x14001f56e
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001f5a4
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14001f5c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001adf0
or eax, 0xffffffff
jmp 0x14001f5c6
xor eax, eax
add rsp, 0x28
ret
Function at 0x140035440
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
mov rdi, r9
mov rbx, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x110], rax
lea rsi, [rsp + 0x78]
mov rcx, rsi
call fcn.140001090
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400355bf
lea r14, [rsp + 0x60]
mov dword [r14], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x140035505
cmp dword [rsp + 0x60], 0
je 0x140035505
xor r12d, r12d
lea r15, [rsp + 0x80]
mov r8d, 0x90
mov rcx, r15
xor edx, edx
call fcn.1400155d0
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 9
mov r8, r15
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x140035505
mov eax, dword [rsp + 0x90]
bt eax, 0xd
jae 0x140035505
shl eax, 0xd
and eax, 0x1000000
mov r12d, eax
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movaps xmmword [rax], xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
xor ecx, ecx
mov qword [rax + 0x60], rcx
mov dword [rax], 0x68
lea rdx, str.winsta0Default
mov qword [rax + 0x10], rdx
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x1400355cb
mov rcx, qword [rsp + 0x60]
test rdi, rdi
je 0x1400355c3
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140013994
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140026460
mov eax, ebx
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14003559c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140035589
xor edi, edi
lea r14, [rsp + 0x58]
mov qword [r14], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
xor edx, edx
mov r8d, eax
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rax, qword [r14]
test rax, rax
lea rdx, [0x14004143e]
cmovne rdx, rax
call fcn.140035630
mov rcx, qword [r14]
test rcx, rcx
je 0x140035594
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140035594
Function at 0x1400358b0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rsi
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140035924
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140035956
lea rdx, [rsp + 0x54]
lea rsi, [0x14004cde0]
mov r8d, 0x105
mov rcx, rsi
call fcn.14001399c
mov word [0x14004cfe8], 0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140026460
mov rax, rsi
add rsp, 0x280
pop rsi
ret
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x1400358e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.14001adb0
cmp esi, 2
je 0x140035966
mov dword [rax], 9
jmp 0x14003596c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x14003596c
call fcn.14001adb0
mov dword [rax], 2
xor esi, esi
jmp 0x140035908
Function at 0x411fa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41212b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0055dc20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x412005
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x412014
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x412033
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x412043
cmp rbx, 0x1000
jae 0x41200b
jmp 0x4120ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x412055
xor edx, edx
jmp 0x4120a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0055dc20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x412039
jmp 0x412028
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0055dc20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x0048debe]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0048e28c]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0048ff65]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x412160
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412386
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0055dc20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4121d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4121e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x412205
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x412215
cmp rbx, 0x1000
jae 0x4121d9
nop
jmp 0x412298
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41222d
xor esi, esi
jmp 0x41228a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0055dc20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41220b
jmp 0x4121f6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0055dc20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x412320
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x0048e2a5]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x0048e28c]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0048b5fc]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4122c0
call sym.runtime.printlock
lea rax, [0x0048e2a5]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0048e28c]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0048f92a]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x41a0a0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0055da11], 0
jne 0x41a187
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41a17a
lea rbx, [0x0052fdf8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41a160
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x004914c7]
mov ebx, 0x2c
call sym.runtime.throw
nop
int3

Function at 0x41c460
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c566
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41c4a3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41c55b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x41c55b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0055dc20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41c549
xor eax, eax
jmp 0x41c553
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41c491
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x42a540
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42a7c6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42a7ba
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x0055da11], 0
jne 0x42a59a
xor edx, edx
xor ebx, ebx
jmp 0x42a5e0
xor edx, edx
jmp 0x42a5c5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call sym.runtime.shade
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42a59e
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42a754
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42a5db
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call sym.runtime.findObject
test rax, rax
jne 0x42a62c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42a5db
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42a66c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42a5db
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42a7ad
lea r10, [0x0052fdf8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42a6ef
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42a725
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42a5db
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42a7a5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42a5db
cmp rbx, 0x200
ja 0x42a794
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call sym.runtime._gcWork_.putBatch
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call sym.runtime.panicSliceAcap
mov rax, r8
call sym.runtime.panicIndex
mov rax, r8
mov ecx, 0x40
call sym.runtime.panicIndexU
mov edx, 0x200
nop
call sym.runtime.panicSliceAlenU
nop
mov qword [rsp + 8], rax
call sym.runtime.morestackc.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.wbBufFlush1