joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401113b0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
test rdx, rdx
je 0x140111568
mov rdi, rdx
mov rsi, rcx
mov r9, qword [rcx + 0x10]
cmp r9, rdx
ja 0x14011158c
shl rdi, 5
mov rdx, qword [0x140ce74d8]
test rdx, rdx
jne 0x1401113fb
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdx
mov rcx, rdi
call fcn.140115fb0
mov r14, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401115a9
mov rbx, rax
mov rcx, qword [rsi]
mov rdi, qword [rsi + 0x10]
shl rdi, 5
je 0x14011154e
lea rax, [rcx + rdi]
cmp rbx, rax
jae 0x140111480
lea rax, [rbx + rdi]
cmp rcx, rax
jae 0x140111480
xor eax, eax
nop
movzx edx, byte [rcx + rax]
mov byte [rbx + rax], dl
movzx edx, byte [rcx + rax + 1]
mov byte [rbx + rax + 1], dl
movzx edx, byte [rcx + rax + 2]
mov byte [rbx + rax + 2], dl
movzx edx, byte [rcx + rax + 3]
mov byte [rbx + rax + 3], dl
add rax, 4
cmp rdi, rax
jne 0x140111450
jmp 0x14011154b
add rdi, 0xffffffffffffffe0
mov rdx, rdi
shr rdx, 5
add rdx, 1
mov eax, edx
and eax, 3
cmp rdi, 0x60
jae 0x14011149e
xor edi, edi
jmp 0x140111508
and rdx, 0xfffffffffffffffc
xor edi, edi
nop word cs:[rax + rax]
nop
movups xmm0, xmmword [rcx + rdi]
movups xmm1, xmmword [rcx + rdi + 0x10]
movups xmmword [rbx + rdi], xmm0
movups xmmword [rbx + rdi + 0x10], xmm1
movups xmm0, xmmword [rcx + rdi + 0x20]
movups xmm1, xmmword [rcx + rdi + 0x30]
movups xmmword [rbx + rdi + 0x20], xmm0
movups xmmword [rbx + rdi + 0x30], xmm1
movups xmm0, xmmword [rcx + rdi + 0x40]
movups xmm1, xmmword [rcx + rdi + 0x50]
movups xmmword [rbx + rdi + 0x40], xmm0
movups xmmword [rbx + rdi + 0x50], xmm1
movups xmm0, xmmword [rcx + rdi + 0x60]
movups xmm1, xmmword [rcx + rdi + 0x70]
movups xmmword [rbx + rdi + 0x60], xmm0
movups xmmword [rbx + rdi + 0x70], xmm1
sub rdi, 0xffffffffffffff80
add rdx, 0xfffffffffffffffc
jne 0x1401114b0
test rax, rax
je 0x14011154b
lea rdx, [rbx + rdi]
add rdx, 0x10
add rcx, rdi
add rcx, 0x10
shl rax, 5
xor edi, edi
nop word cs:[rax + rax]
nop dword [rax]
movups xmm0, xmmword [rcx + rdi - 0x10]
movups xmm1, xmmword [rcx + rdi]
movups xmmword [rdx + rdi - 0x10], xmm0
movups xmmword [rdx + rdi], xmm1
add rdi, 0x20
cmp rax, rdi
jne 0x140111530
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.1400d3e00
mov qword [rsi], rbx
mov qword [rsi + 8], r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__new_capacity_______0__
mov edx, 0x245
xor r9d, r9d
call fcn.1400be3d0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________new_capacity__
mov edx, 0x246
call fcn.1400be3d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.InternalMmapVector
lea r8, str.allocate
mov rcx, r14
mov r9d, eax
call fcn.1400eac80
int3
Function at 0x140114890
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x1401148d4
mov eax, ebp
lea rbx, [rax*8]
shl rax, 4
lea rsi, [rax + rax*2]
mov rdi, qword [0x140ce74d8]
test rdi, rdi
je 0x1401148e0
lea rbx, [rbx + rbx*2]
cmp rsi, rdi
jbe 0x140114903
jmp 0x14011498d
mov qword [r14], 0
jmp 0x1401149d5
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdi
lea rbx, [rbx + rbx*2]
cmp rsi, rdi
ja 0x14011498d
test rdi, rdi
jne 0x14011491e
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdi
cmp rbx, rdi
ja 0x1401149e7
mov rax, rdi
or rax, rbx
shr rax, 0x20
je 0x14011493d
mov rax, rdi
xor edx, edx
div rbx
jmp 0x140114943
mov eax, edi
xor edx, edx
div ebx
bsr rcx, rax
shl rbx, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 3
lea rax, [rax + rax*2]
cmp rbx, rax
jne 0x140114a0b
lea r15, [rbx + rbx]
test rdi, rdi
jne 0x140114984
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdi
cmp r15, rdi
jbe 0x140114a2b
test rdi, rdi
jne 0x1401149a8
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdi
mov rcx, rbx
mov rdx, rdi
call fcn.140115fb0
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140114a4b
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x191
xor r9d, r9d
call fcn.1400be3d0
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rbx
call fcn.1400be3d0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call fcn.1400be3d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call fcn.1400eac80
int3
Function at 0x140114a70
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rcx
mov ebx, dword [rcx + 0x10]
mov r14, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x140114a9d
mov rdx, r9
jmp 0x140114acf
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov esi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x140114ba5
xor al, 0x3f
mov ecx, eax
shl rsi, cl
cmp rsi, r9
jae 0x140114bc2
mov rcx, rdi
call fcn.140114890
mov rax, qword [rdi]
test rax, rax
je 0x140114b81
test r14, r14
je 0x140114b36
shl rbx, 3
lea rbx, [rbx + rbx*2]
lea r8, [r14 + rbx]
mov rcx, rdi
mov rdx, r14
call fcn.14010d560
mov rdx, qword [0x140ce74d8]
test rdx, rdx
jne 0x140114b21
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdx
mov rcx, rbx
call fcn.140115fb0
mov rcx, r14
mov rdx, rax
call fcn.1400d3e00
jmp 0x140114b77
mov qword [rdi + 8], 0
mov ecx, dword [rdi + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x140114bdf
test rcx, rcx
je 0x140114b77
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
nop dword [rax + rax]
mov dword [rax], 0xffffffff
mov qword [rax + 8], 0xffffffffffffffff
add rax, 0x18
cmp rax, rcx
jne 0x140114b60
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call fcn.1400be3d0
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1b9
call fcn.1400be3d0
mov qword [rsp + 0x20], rsi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1ba
call fcn.1400be3d0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call fcn.1400be3d0
int3
Function at 0x140114c10
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x140114c4b
mov esi, ebp
mov rbx, rsi
shl rbx, 5
mov rdi, qword [0x140ce74d8]
test rdi, rdi
je 0x140114c57
shl rsi, 4
cmp rbx, rdi
jbe 0x140114c7a
jmp 0x140114d00
mov qword [r14], 0
jmp 0x140114d48
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdi
shl rsi, 4
cmp rbx, rdi
ja 0x140114d00
test rdi, rdi
jne 0x140114c95
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdi
cmp rsi, rdi
ja 0x140114d5a
mov rax, rdi
or rax, rsi
shr rax, 0x20
je 0x140114cb4
mov rax, rdi
xor edx, edx
div rsi
jmp 0x140114cba
mov eax, edi
xor edx, edx
div esi
bsr rcx, rax
shl rsi, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 4
cmp rsi, rax
jne 0x140114d7e
lea r15, [rsi + rsi]
test rdi, rdi
jne 0x140114cf7
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdi
cmp r15, rdi
jbe 0x140114d9e
test rdi, rdi
jne 0x140114d1b
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdi
mov rcx, rsi
mov rdx, rdi
call fcn.140115fb0
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140114dbe
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x191
xor r9d, r9d
call fcn.1400be3d0
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rsi
call fcn.1400be3d0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call fcn.1400be3d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call fcn.1400eac80
int3
Function at 0x140114df0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov r14d, dword [rcx + 0x10]
mov rsi, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x140114e1e
mov rdx, r9
jmp 0x140114e50
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov edi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x140114f1f
xor al, 0x3f
mov ecx, eax
shl rdi, cl
cmp rdi, r9
jae 0x140114f3c
mov rcx, rbx
call fcn.140114c10
mov rax, qword [rbx]
test rax, rax
je 0x140114efb
test rsi, rsi
je 0x140114eb3
shl r14, 4
lea r8, [rsi + r14]
mov rcx, rbx
mov rdx, rsi
call fcn.14010dc30
mov rdx, qword [0x140ce74d8]
test rdx, rdx
jne 0x140114e9e
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdx
mov rcx, r14
call fcn.140115fb0
mov rcx, rsi
mov rdx, rax
call fcn.1400d3e00
jmp 0x140114ef1
mov qword [rbx + 8], 0
mov ecx, dword [rbx + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x140114f59
test rcx, rcx
je 0x140114ef1
shl rcx, 4
xor edx, edx
nop word cs:[rax + rax]
mov qword [rax + rdx], 0xffffffffffffffff
add rdx, 0x10
cmp rcx, rdx
jne 0x140114ee0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call fcn.1400be3d0
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1b9
call fcn.1400be3d0
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1ba
call fcn.1400be3d0
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call fcn.1400be3d0
int3
Function at 0x140115fb0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rdx - 1]
test rdx, rax
jne 0x140115fd9
lea rax, [rcx + rdx]
add rax, 0xffffffffffffffff
neg rdx
and rdx, rax
mov rax, rdx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x1401265c0]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x14011606f
lea rcx, [0x1401265c0]
call fcn.1400f46b0
mov rcx, qword [0x1401265c8]
cmp rcx, 0xffffffffffffffff
je 0x1401160b6
lea rax, [rcx - 1]
cmp rax, 1
ja 0x14011602f
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x14011605a
mov qword [rsp + 0x20], 0
lea rdx, str.IsPowerOfTwo_boundary__n
lea r9, [rsp + 0x2c]
mov r8d, 0x17
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140116067
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.IsPowerOfTwo_boundary__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rsi], 0
call fcn.1400d2110
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140116083
add edi, 1
cmp edi, 0x63
ja 0x1401160a0
pause
cmp byte [rsi], 0
jne 0x140116080
jmp 0x1401160a9
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x140116080
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140116080
jmp 0x140115fec
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24a7
xor r9d, r9d
call fcn.1400be3d0
int3

Function at 0x140119500
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011957e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140119571
mov rdx, qword [0x140ce74d8]
test rdx, rdx
jne 0x140119543
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdx
mov ecx, 0x100000
call fcn.140115fb0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401195ac
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011958c
add ebx, 1
cmp ebx, 0x63
ja 0x140119595
pause
jmp 0x14011959a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140119589
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140119589
jmp 0x140119517
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400eac80
int3
Function at 0x1401195e0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011965e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140119651
mov rdx, qword [0x140ce74d8]
test rdx, rdx
jne 0x140119623
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdx
mov ecx, 0x40000
call fcn.140115fb0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011968c
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011966c
add ebx, 1
cmp ebx, 0x63
ja 0x140119675
pause
jmp 0x14011967a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140119669
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140119669
jmp 0x1401195f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400eac80
int3

Function at 0x1401196c0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011973e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140119731
mov rdx, qword [0x140ce74d8]
test rdx, rdx
jne 0x140119703
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdx
mov ecx, 0x1000
call fcn.140115fb0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14011976c
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011974c
add ebx, 1
cmp ebx, 0x63
ja 0x140119755
pause
jmp 0x14011975a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140119749
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140119749
jmp 0x1401196d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400eac80
int3
Function at 0x140119990
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov eax, dword [rdx + 0x400000]
mov qword [rcx], rax
xor esi, esi
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
jmp 0x1401199ea
mov ecx, 0x100000
call fcn.140115fb0
add rsi, rax
add rbx, 1
cmp rbx, 0x8000
je 0x140119a16
mov rax, qword [rdi + rbx*8 + 0x400010]
test rax, rax
je 0x1401199dd
mov rdx, qword [0x140ce74d8]
test rdx, rdx
jne 0x1401199d0
mov rcx, r15
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdx
jmp 0x1401199d0
mov r15, qword [0x140d51828]
xor edi, edi
lea rbx, [0x140d11818]
lea r12, [rsp + 0x28]
xor ebp, ebp
jmp 0x140119a4a
mov ecx, 0x40000
call fcn.140115fb0
add rdi, rax
add rbp, 1
cmp rbp, 0x8000
je 0x140119a73
mov rax, qword [rbx + rbp*8 + 8]
test rax, rax
je 0x140119a3d
mov rdx, qword [0x140ce74d8]
test rdx, rdx
jne 0x140119a30
mov rcx, r12
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140ce74d8], rdx
jmp 0x140119a30
add rsi, r15
lea rax, [rdi + rsi]
add rax, 0x10010
mov qword [r14 + 8], rax
mov rax, r14
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400059e0
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x140082550]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x1400059fc
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x140005a0a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x140005a15
bts eax, 5
shr ecx, 1
test cl, 1
je 0x140005a20
bts eax, 4
shr ecx, 1
test cl, 1
je 0x140005a2b
bts eax, 3
shr ecx, 1
test cl, 1
je 0x140005a36
bts eax, 2
shr ecx, 1
test cl, 1
je 0x140005a41
bts eax, 1
test cl, 2
je 0x140005a4a
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
cmovns r8d, eax
xor ecx, ecx
lea edx, [rcx + 0x1e]
test r8b, 1
je 0x140005ae1
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x140005aed
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x140005ad5
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x1400059f0
mov dword [0x140082950], 1
ret
Function at 0x140006e60
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
xor ebx, ebx
lea r14, [rcx + 0xf0]
mov rax, qword [r14]
mov rbp, rcx
lea r9d, [rbx + 1]
cmp rax, r14
je 0x140006eac
nop dword [rax + rax]
mov rbx, rax
cmp word [rax + 0x10], dx
jne 0x140006e9f
cmp byte [rax + 0x29], r8b
je 0x140006ea7
mov rax, qword [rax]
cmp rax, r14
jne 0x140006e90
cmp rax, r14
jne 0x140006ef9
add rcx, 0x110
mov rax, qword [rcx]
cmp rax, rcx
je 0x140006efe
nop dword [rax + rax]
mov rbx, rax
cmp word [rax + 0x26], r9w
jb 0x140006efe
cmp word [rax + 0x10], dx
jne 0x140006ed6
cmp byte [rax + 0x29], r8b
je 0x140006ef1
mov rax, qword [rax]
cmp rax, rcx
jne 0x140006ec0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp rax, rcx
je 0x140006efe
xor r9d, r9d
test rbx, rbx
jne 0x140006f11
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
movzx eax, r8b
mov qword [rsp + 0x30], rsi
cmp rax, qword [rbp + 0x48]
jae 0x140006f5c
lea r8, [rax + rax*4]
shr dx, 0xc
shl r8, 4
add r8, qword [rbp + 0x40]
movzx eax, dx
lea rcx, [r8 + rax*2]
movzx eax, word [r8 + rax*2 + 6]
test ax, ax
je 0x140006f5c
sub ax, 1
mov word [rcx + 6], ax
jne 0x140006f5c
movzx ecx, word [r8 + 4]
movzx eax, dx
btr ecx, eax
mov word [r8 + 4], cx
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
movzx esi, byte [rbx + 0x28]
and esi, 0xf
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
cmp qword [rbx + 0x58], 0
je 0x140006fe5
test r9d, r9d
je 0x140006f8e
movzx eax, word [rbx + 0x24]
sub dword [rbp + 0xd8], eax
mov rax, qword [rbx + 0x58]
dec qword [rax]
mov rax, qword [rbx + 0x58]
cmp qword [rax], 0
jne 0x140006fe5
or dword [rax + 8], 0x100
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbx + 0x58]
test rdi, rdi
je 0x140006fe0
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x140006fc2
mov rcx, rdi
call rax
test byte [rdi + 8], 4
jne 0x140006fd7
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140006fd7
call qword [0x140079080]
mov rcx, rdi
call qword [0x140079080]
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
call qword [0x140079080]
mov rcx, qword [r14]
cmp rcx, r14
je 0x140006fff
mov eax, dword [rcx + 0x18]
add eax, dword [rcx + 0x14]
mov dword [rbp + 0x70], eax
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret