joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e65e
Capabilities:
Create process on windows

Disassembly:
jmp 0x140031450
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1f8]
mov rax, qword [0x14006b040]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x140074168]
call fcn.14001f045
nop
mov dword [rbp + 0x10], 0x68
lea rax, [rbp + 0x18]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x1a0]
call fcn.14001e555
lea rcx, [rbp + 0x98]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003150b
jmp 0x14003153a
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x14005fad0]
call fcn.14001ed75
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.14001e7f3
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x14001e929
Capabilities:
Terminate process

Disassembly:
jmp 0x140053f70
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001ea82
Capabilities:
Get geographical location

Disassembly:
jmp 0x14004e850
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14004e88d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14001f036
add rsp, 0x58
ret
Function at 0x14001eb22
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400552c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400552e0
xor al, al
jmp 0x140055361
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400552f3
xor al, al
jmp 0x140055361
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14005531d
xor al, al
jmp 0x140055361
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140055331
xor al, al
jmp 0x140055361
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140055343
xor al, al
jmp 0x140055361
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14005535f
xor al, al
jmp 0x140055361
mov al, 1
add rsp, 0x38
ret
Function at 0x14001ecfd
Capabilities:
Create process on windows

Disassembly:
jmp 0x140031280
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x140074168]
call fcn.14001f045
nop
mov rcx, qword [rbp + 0xe0]
call fcn.14001e190
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14001ed20
Capabilities:
Get common file path
Get program files directory

Disassembly:
jmp 0x1400303f0
push rbp
push rsi
push rdi
sub rsp, 0xa20
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1bc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14006b040]
xor rax, rbp
mov qword [rbp + 0x9e8], rax
lea rcx, [0x140074168]
call fcn.14001f045
nop
movzx eax, word [0x140061b1c]
mov word [rbp + 0x10], ax
lea rax, [rbp + 0x12]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movzx eax, word [0x140061b1c]
mov word [rbp + 0x240], ax
lea rax, [rbp + 0x242]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, [rbp + 0x470]
lea rcx, str.VMWare_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x480]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f8
rep stosb byte [rdi], al
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
nop
lea r8, [rbp + 0x470]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
nop
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x9b8]
call fcn.14001e546
nop
lea rcx, [rbp + 0x9b8]
call fcn.14001eea1
movzx eax, al
test eax, eax
je 0x140030502
mov dword [rbp + 0x9e4], 0
jmp 0x14003050c
mov dword [rbp + 0x9e4], 1
mov eax, dword [rbp + 0x9e4]
mov dword [rbp + 0x994], eax
lea rcx, [rbp + 0x9b8]
call fcn.14001edfc
mov eax, dword [rbp + 0x994]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14005f3d0]
call fcn.14001ed75
mov eax, edi
mov rcx, qword [rbp + 0x9e8]
xor rcx, rbp
call fcn.14001e7f3
lea rsp, [rbp + 0x9f0]
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001eea1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140030070
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x140074168]
call fcn.14001f045
nop
mov rcx, qword [rbp + 0x100]
call fcn.14001e555
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
je 0x1400300c4
mov eax, dword [rbp + 4]
and eax, 0x10
test eax, eax
je 0x1400300c4
mov dword [rbp + 0xd4], 1
jmp 0x1400300ce
mov dword [rbp + 0xd4], 0
movzx eax, byte [rbp + 0xd4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14001ef0f
Capabilities:
Terminate process

Disassembly:
jmp 0x14002fb80
push r13
push rbp
push rdi
sub rsp, 0x1e0
lea r13, [rsp + 0x20]
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
lea rcx, [0x140074168]
call fcn.14001f045
nop
call fcn.14001eb31
test eax, eax
je 0x14002fbce
call fcn.14001ed20
test eax, eax
je 0x14002fbce
call fcn.14001eae6
test eax, eax
je 0x14002fbce
call fcn.14001ec94
test eax, eax
jne 0x14002fc6f
mov rax, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov qword [rbp + 0x188], rax
lea rax, [rbp + 0x134]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x154]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x134]
movzx r8d, byte [rbp + 0x154]
movzx edx, byte [rbp + 0x174]
lea rcx, [rbp + 0xe0]
call fcn.140021bf0
mov rcx, rax
call fcn.14001ee15
mov qword [rbp + 0x190], rax
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x188]
call fcn.14001e884
mov qword [rbp + 0x198], rax
lea rdx, [0x14001e816]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [r13 + 0x1c0]
pop rdi
pop rbp
pop r13
ret

Function at 0x14001f1a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140050f20
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rdx, qword [rsp + 0x70]
mov ecx, 0x105
call fcn.14001e6ef
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140050f5f
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
jmp 0x140051001
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0xffffffff
je 0x140050f80
mov eax, dword [rsp + 0x24]
and eax, 0x10
test eax, eax
jne 0x140050f97
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 0xffffffff
mov rax, qword [rsp + 0x34]
jmp 0x140051001
mov eax, dword [rsp + 0x24]
and eax, 0x400
test eax, eax
je 0x140050fec
mov r9d, 0x2000000
mov r8d, 0x80
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14001e82f
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x50]
call fcn.14001e23a
nop
cmp dword [rsp + 0x28], 0
je 0x140050fec
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], 0xffffffff
mov rax, qword [rsp + 0x3c]
jmp 0x140051001
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0
mov rax, qword [rsp + 0x44]
add rsp, 0x68
ret
Function at 0x140052be0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001f0f4
movzx eax, al
test eax, eax
jne 0x140052c00
mov ecx, 7
call fcn.14001ed98
nop
mov byte [rsp + 0x20], 0
call fcn.14001edf7
mov byte [rsp + 0x21], al
cmp dword [0x14006bd18], 1
jne 0x140052c24
mov ecx, 7
call fcn.14001ed98
nop
jmp 0x140052c7c
cmp dword [0x14006bd18], 0
jne 0x140052c77
mov dword [0x14006bd18], 1
lea rdx, [0x14005d660]
lea rcx, [0x14005d330]
call fcn.14001e7bc
test eax, eax
je 0x140052c58
mov eax, 0xff
jmp 0x140052d81
lea rdx, [0x14005d220]
lea rcx, [section..rdata]
call fcn.14001edde
mov dword [0x14006bd18], 2
jmp 0x140052c7c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001ed5c
call fcn.14001eb81
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140052cd9
mov rcx, qword [rsp + 0x30]
call fcn.14001e640
movzx eax, al
test eax, eax
je 0x140052cd9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140075020]
nop
call fcn.14001ec30
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140052d0d
mov rcx, qword [rsp + 0x38]
call fcn.14001e640
movzx eax, al
test eax, eax
je 0x140052d0d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001efd7
nop
call fcn.140052e30
mov dword [rsp + 0x28], eax
call fcn.14001eb22
movzx eax, al
test eax, eax
jne 0x140052d2c
mov ecx, dword [rsp + 0x28]
call fcn.14001e154
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140052d3b
call fcn.14001f00e
nop
xor edx, edx
mov cl, 1
call fcn.14001e5c8
mov eax, dword [rsp + 0x28]
jmp 0x140052d81
add rsp, 0x68
ret
Function at 0x4169c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416b4b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416a25
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416a34
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416a53
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416a63
cmp rbx, 0x1000
jae 0x416a2b
jmp 0x416acd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416a75
xor edx, edx
jmp 0x416ac4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416a59
jmp 0x416a48
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00591794]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00591d28]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00594aba]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x416b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416da6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416bf3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416c02
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416c25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416c35
cmp rbx, 0x1000
jae 0x416bf9
nop
jmp 0x416cb8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416c4d
xor esi, esi
jmp 0x416caa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416c2b
jmp 0x416c16
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416d40
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x00591d41]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x00591d28]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0058db10]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416ce0
call sym.runtime.printlock
lea rax, [0x00591d41]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00591d28]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005940a6]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x420f80
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00726854], 0
jne 0x421070
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x421063
lea rsi, [0x006f8bf8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x42103e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1258]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1258], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x00597cb5]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x423480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423586
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4234c3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42357b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42357b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x423569
xor eax, eax
jmp 0x423573
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4234b1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x4306c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430810
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp dword [0x00726e7c], 0
je 0x4307de
mov qword [rax + 0x20], 0
cmp qword [rax + 0x10], 0
jbe 0x430805
mov rdx, qword [rax + 8]
mov qword [rdx], 0xffffffffffffffff
mov edx, dword [0x00726e50]
test edx, edx
jne 0x430747
mov rcx, qword [rax + 0x10]
cmp rcx, 1
jbe 0x4307f6
mov rdx, qword [rax + 8]
lea rbx, [sym.runtime._LostContendedRuntimeLock]
inc rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rax + 0x10]
cmp rcx, 2
jbe 0x4307ec
mov rax, qword [rax + 8]
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
lea rdx, [sym.runtime._mLockProfile_.captureStack.func1]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
nop
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx + 0x10]
cmp rdx, rax
jle 0x4307d8
jbe 0x4307e4
mov rcx, qword [rcx + 8]
mov qword [rcx + rax*8], 0
add rsp, 0x50
pop rbp
ret
add rsp, 0x50
pop rbp
ret
mov rcx, rdx
call sym.runtime.panicIndex
mov eax, 2
call sym.runtime.panicIndex
mov eax, 1
nop dword [rax + rax]
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
nop
jmp sym.runtime._mLockProfile_.captureStack
Function at 0x432800
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x432a86
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1280]
mov rcx, qword [rax + 0x1270]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x432a7a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1270], 0
cmp byte [0x00726854], 0
jne 0x43285a
xor edx, edx
xor ebx, ebx
jmp 0x4328a0
xor edx, edx
jmp 0x432885
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1280]
mov rax, rcx
call sym.runtime.shade
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x43285e
add rax, 0x1270
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x432a14
mov rsi, qword [rax + rdx*8 + 0x1280]
cmp rsi, 0x1000
jb 0x43289b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call sym.runtime.findObject
test rax, rax
jne 0x4328ec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43289b
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x43292c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43289b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x432a6d
lea r10, [0x006f8bf8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x4329af
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x4329e5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1258]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1258], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43289b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x432a65
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1280], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x43289b
cmp rbx, 0x200
ja 0x432a54
lea rdx, [rax + 0x1280]
lea rsi, [rax + 0x1248]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call sym.runtime._gcWork_.putBatch
mov rax, qword [rsp + 0x48]
add rax, 0x1270
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call sym.runtime.panicSliceAcap
mov rax, r8
call sym.runtime.panicIndex
mov rax, r8
mov ecx, 0x40
call sym.runtime.panicIndexU
mov edx, 0x200
nop
call sym.runtime.panicSliceAlenU
nop
mov qword [rsp + 8], rax
call sym.runtime.morestackc.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.wbBufFlush1
Function at 0x4364e0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x00726a80]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x2e8], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x2f0], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x00726a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call sym.runtime.stdcall
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret