joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800018d0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1488
call fcn.18000a9f0
sub rsp, rax
mov rsi, r9
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x180020cc0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
xor ebp, ebp
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, r15
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ecx, ecx
test eax, eax
sete cl
shl ecx, 3
lea eax, [rcx + rcx*4]
lea r13, [0x1800201b0]
movabs r12, 0xcb685aa46d778352
mov rax, qword [rax + r13]
add rax, r12
jmp rax

Function at 0x180007680
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x180007716
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18000771d
mov r15, rsi
jmp 0x1800076db
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call sub.msvcrt.dll_memcpy
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x18000770e
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800076f3
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x1800076b0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18000770e
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x1800076db
sub rsi, r15
jmp 0x18000780a
xor esi, esi
jmp 0x18000780a
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x180007770
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x180007770
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.msvcrt.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x180007781
jmp 0x180007807
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x180007807
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1800077b0
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x1800077e3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call sub.msvcrt.dll_fread
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x1800077b0
jmp 0x180007807
test r14, r14
je 0x180007804
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call sub.msvcrt.dll_fread
sub r14, rax
jmp 0x180007807
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18000bd38
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18000bd72
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18000bd77
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18000bdc0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800199d0]
cmp byte [rcx + rax], 0
je 0x18000bdc0
dec r8
sub rdx, 1
jne 0x18000bda6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x18000de50
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x60
mov rbx, rcx
mov dword [rax - 0x28], 0
mov qword [rax - 0x20], rcx
mov qword [rax - 0x18], r8
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov eax, dword [rdx + 0x118]
shl eax, 0x10
or eax, dword [rdx + 0x11c]
cmp eax, 0x60000
jb 0x18000deab
call fcn.18000d9b0
mov r8, qword [rax + 0xe0]
jmp 0x18000deb7
call fcn.18000d9b0
mov r8, qword [rax + 0xd8]
lea rdx, [rsp + 0x48]
mov ecx, dword [rbx]
call r8
mov dword [rsp + 0x40], 0
jmp 0x18000decb
mov eax, dword [rsp + 0x40]
add rsp, 0x60
pop rbx
ret
Function at 0x18000dee0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x18000df38
call fcn.18000d9b0
add rax, 0x138
jmp 0x18000df41
call fcn.18000dcc0
add rax, 0x28
mov qword [rax], rbx
mov rax, qword gs:[0x30]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rbx + 8]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x18000df7d
call fcn.18000d9b0
add rax, 0x128
jmp 0x18000df86
call fcn.18000dcc0
add rax, 0x18
mov qword [rax], rdi
mov rax, qword [rsi]
mov rdi, qword [rax + 0x38]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x18000dfc0
call fcn.18000d9b0
add rax, 0x130
jmp 0x18000dfc9
call fcn.18000dcc0
add rax, 0x20
mov qword [rax], rdi
call fcn.18000dcc0
mov ecx, dword [rsp + 0x80]
xor edi, edi
mov byte [rsp + 0x38], 1
mov r9, rbx
mov qword [rsp + 0x30], rdi
mov r8, rbp
mov dword [rax + 0x30], ecx
mov rdx, r14
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsi]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.180012650
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov eax, dword [rcx + 0x118]
shl eax, 0x10
or eax, dword [rcx + 0x11c]
cmp eax, 0x60000
jb 0x18000e036
call fcn.18000d9b0
add rax, 0x138
jmp 0x18000e03f
call fcn.18000dcc0
add rax, 0x28
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov qword [rax], rdi
mov eax, 1
mov rdi, qword [rsp + 0x68]
mov dword [rcx], 1
add rsp, 0x40
pop r14
ret
Function at 0x1800108d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x180020cc0]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18001090c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.18000cb04
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1800109c8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x180010a2e
test ebx, ebx
jne 0x180010a2e
lea ecx, [rax + 2]
call fcn.18000cb04
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.18000aa50
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x1800112b0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x180020cc0]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov rdi, rdx
mov esi, ecx
test rdx, rdx
je 0x18001131c
mov edx, 0x2d
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x18001131c
xor ebx, ebx
lea r8, [rsp + 0x120]
mov ecx, ebx
mov rdx, rdi
nop
movsx eax, byte [rdx]
test al, al
je 0x18001134c
mov word [r8], ax
inc ecx
add r8, 2
inc rdx
cmp ecx, 0x100
jne 0x180011300
bt dword [0x18001b938], 0
lea rdx, str.setlocale
lea rcx, [0x180020e90]
call fcn.180013a20
test rax, rax
je 0x180011425
mov rdx, rdi
mov ecx, esi
call rax
jmp 0x180011425
movsxd rax, ecx
add rax, rax
cmp rax, 0x200
jae 0x18001144a
mov edx, 0x2d
mov word [rsp + rax + 0x120], bx
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x18001131c
mov r9d, 0xff
lea r8, [rsp + 0x320]
mov edx, 0x1001
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18001131c
movsxd rcx, eax
lea r8, [rsp + 0x320]
mov edx, 0x5f
mov r9d, 0x100
sub r9d, eax
mov word [rsp + rcx*2 + 0x31e], dx
lea r8, [r8 + rcx*2]
mov edx, 0x1002
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18001131c
lea rax, [rsp + 0x320]
lea rcx, [rsp + 0x20]
movzx edx, word [rax]
test dx, dx
je 0x180011413
mov byte [rcx], dl
inc ebx
inc rcx
add rax, 2
cmp ebx, 0x100
jne 0x1800113f3
jmp 0x18001131c
movsxd rax, ebx
lea rdi, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
jmp 0x18001131c
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.18000aa50
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18000bed8
int3
Function at 0x180012b80
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rbx, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x180012bd8
call fcn.18000d9b0
mov ecx, dword [rax + 0x2c0]
jmp 0x180012be0
call fcn.18000dcc0
mov ecx, dword [rax + 0x10]
mov rdi, qword [rsp + 0xa0]
test ecx, ecx
jne 0x180012c1c
mov eax, dword [rbx]
cmp eax, 0xe06d7363
je 0x180012c1c
cmp eax, 0x80000029
jne 0x180012c0c
cmp dword [rbx + 0x18], 0xf
jne 0x180012c13
cmp qword [rbx + 0x60], 0x19930520
je 0x180012c1c
cmp eax, 0x80000026
je 0x180012c1c
test byte [rdi], 0x20
jne 0x180012da7
mov r8d, dword [rbx + 4]
test r8b, 0x66
je 0x180012ce0
movsxd rax, dword [rdi + 8]
test eax, eax
je 0x180012da7
mov rdx, rax
lea r9, [0x180000000]
add rdx, qword [rsi + 8]
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r9 + 0x19ce0]
movzx ecx, byte [rcx + r9 + 0x19cf0]
sub rdx, rax
mov eax, dword [rdx - 4]
shr eax, cl
test eax, eax
je 0x180012da7
cmp dword [rsp + 0xa8], 0
jne 0x180012da7
test r8b, 0x20
je 0x180012ccd
mov eax, dword [rbx]
cmp eax, 0x80000026
jne 0x180012cae
mov r8, qword [rsi + 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.180014e70
mov r9d, eax
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.180011e10
jmp 0x180012da7
cmp eax, 0x80000029
jne 0x180012ccd
mov r9d, dword [rbx + 0x38]
mov r8, rdi
mov rcx, qword [rbx + 0x28]
mov rdx, rsi
call fcn.180011e10
jmp 0x180012da7
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.18000d530
jmp 0x180012da7
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.1800119a0
cmp dword [rsp + 0x40], 0
jne 0x180012d01
test byte [rdi], 0x40
je 0x180012da7
cmp dword [rbx], 0xe06d7363
jne 0x180012d6d
cmp dword [rbx + 0x18], 3
jb 0x180012d6d
cmp dword [rbx + 0x20], 0x19930522
jbe 0x180012d6d
mov rax, qword [rbx + 0x30]
cmp dword [rax + 8], 0
je 0x180012d6d
call fcn.18000da80
mov rcx, qword [rbx + 0x30]
movsxd rdx, dword [rcx + 8]
add rax, rdx
je 0x180012d6d
movzx ecx, byte [rsp + 0xb8]
mov r9, rsi
mov dword [rsp + 0x38], ecx
mov r8, r14
mov rcx, qword [rsp + 0xb0]
mov rdx, rbp
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call rax
jmp 0x180012dac
mov rax, qword [rsp + 0xb0]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov r8, r14
mov eax, dword [rsp + 0xa8]
mov rdx, rbp
mov dword [rsp + 0x30], eax
mov rcx, rbx
movzx eax, byte [rsp + 0xb8]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rdi
call fcn.180012dd0
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1406aa0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406aa237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406aa0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa0c7
add dl, dl
jne 0x1406aa0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa14e
xor eax, eax
add dl, dl
jne 0x1406aa0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa205
add dl, dl
jne 0x1406aa10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406aa142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406aa0d6
mov eax, 1
add dl, dl
jne 0x1406aa15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa153
sub eax, ebx
mov ebx, 1
jne 0x1406aa1a4
mov ecx, 1
add dl, dl
jne 0x1406aa186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406aa193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406aa1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406aa1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa1b5
cmp eax, 0x7d00
jae 0x1406aa1f3
cmp eax, 0x500
jb 0x1406aa1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa0d6
cmp eax, 0x7f
ja 0x1406aa1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406aa22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406aa0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x412f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4130eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00573a68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x412fc5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x412fd4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x412ff3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413003
cmp rbx, 0x1000
jae 0x412fcb
jmp 0x41306d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413015
xor edx, edx
jmp 0x413064
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00573a68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x412ff9
jmp 0x412fe8
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00573a68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x0047bef6]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0047c1bd]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0047d97c]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x413120
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413346
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00573a68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413193
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4131a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4131c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4131d5
cmp rbx, 0x1000
jae 0x413199
nop
jmp 0x413258
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4131ed
xor esi, esi
jmp 0x41324a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00573a68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4131cb
jmp 0x4131b6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00573a68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4132e0
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x0047c1d6]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x0047c1bd]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00479d6f]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x413280
call sym.runtime.printlock
lea rax, [0x0047c1d6]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0047c1bd]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0047d3be]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x41aba0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0057386f], 0
jne 0x41ac90
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41ac83
lea rsi, [0x00505978]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41ac5e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x0047ec59]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x41d0e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d1e6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x41d123
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x41d1db
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x41d1db
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00573a68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x41d1c9
xor eax, eax
jmp 0x41d1d3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x41d111
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge