joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f31ad
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov dword [rsi + 0xf0], 0xa
movdqu xmm1, xmmword [rdi]
movdqa xmmword [rsi], xmm1
aeskeygenassist xmm2, xmm1, 1
call fcn.1400f327b
movdqa xmmword [rsi + 0x10], xmm1
aeskeygenassist xmm2, xmm1, 2
call fcn.1400f327b
movdqa xmmword [rsi + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 4
call fcn.1400f327b
movdqa xmmword [rsi + 0x30], xmm1
aeskeygenassist xmm2, xmm1, 8
call fcn.1400f327b
movdqa xmmword [rsi + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0x10
call fcn.1400f327b
movdqa xmmword [rsi + 0x50], xmm1
aeskeygenassist xmm2, xmm1, 0x20
call fcn.1400f327b
movdqa xmmword [rsi + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0x40
call fcn.1400f327b
movdqa xmmword [rsi + 0x70], xmm1
aeskeygenassist xmm2, xmm1, 0x80
call fcn.1400f327b
movdqa xmmword [rsi + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.1400f327b
movdqa xmmword [rsi + 0x90], xmm1
aeskeygenassist xmm2, xmm1, 0x36
call fcn.1400f327b
movdqa xmmword [rsi + 0xa0], xmm1
mov rdi, rax
mov rsi, r11
ret

Function at 0x1400f32a4
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqu xmm1, xmmword [rdi]
movq xmm3, qword [rdi + 0x10]
movdqa xmmword [rsi], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.1400f33c9
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x10], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x20], xmm6
aeskeygenassist xmm2, xmm3, 2
call fcn.1400f33c9
movdqa xmmword [rsi + 0x30], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.1400f33c9
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x40], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x50], xmm6
aeskeygenassist xmm2, xmm3, 8
call fcn.1400f33c9
movdqa xmmword [rsi + 0x60], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.1400f33c9
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x70], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x80], xmm6
aeskeygenassist xmm2, xmm3, 0x20
call fcn.1400f33c9
movdqa xmmword [rsi + 0x90], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.1400f33c9
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0xa0], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0xb0], xmm6
aeskeygenassist xmm2, xmm3, 0x80
call fcn.1400f33c9
movdqa xmmword [rsi + 0xc0], xmm1
movdqa xmmword [rsi + 0xd0], xmm3
mov rdi, rax
mov rsi, r11
movdqa xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x1400f3408
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
movdqu xmm1, xmmword [rdi]
movdqu xmm3, xmmword [rdi + 0x10]
movdqa xmmword [rsi], xmm1
movdqa xmmword [rsi + 0x10], xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.1400f3512
movdqa xmmword [rsi + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f353b
movdqa xmmword [rsi + 0x30], xmm3
aeskeygenassist xmm2, xmm3, 2
call fcn.1400f3512
movdqa xmmword [rsi + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f353b
movdqa xmmword [rsi + 0x50], xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.1400f3512
movdqa xmmword [rsi + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f353b
movdqa xmmword [rsi + 0x70], xmm3
aeskeygenassist xmm2, xmm3, 8
call fcn.1400f3512
movdqa xmmword [rsi + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f353b
movdqa xmmword [rsi + 0x90], xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.1400f3512
movdqa xmmword [rsi + 0xa0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f353b
movdqa xmmword [rsi + 0xb0], xmm3
aeskeygenassist xmm2, xmm3, 0x20
call fcn.1400f3512
movdqa xmmword [rsi + 0xc0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f353b
movdqa xmmword [rsi + 0xd0], xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.1400f3512
movdqa xmmword [rsi + 0xe0], xmm1
mov rdi, rax
mov rsi, r11
ret
Function at 0x140155eb0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140155ff8

Function at 0x140155ff8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140155ff8
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140156067
xor ecx, ecx
call qword [0x14021a3c0]
test rax, rax
je 0x140156067
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140156067
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140156067
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140156067
cmp dword [rcx + 0x84], 0xe
jbe 0x140156067
cmp dword [rcx + 0xf8], 0
je 0x140156067
mov ecx, ebx
call fcn.140155f30
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14015618c
nop
cmp dword [rbp + 0x20], 0
je 0x1401560b5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140155fc4
int3

Function at 0x14015b354
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
test r8, r8
jne 0x14015b374
call fcn.140156b4c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140157450
xor eax, eax
add rsp, 0x28
ret
test rdx, rdx
je 0x14015b35d
test rcx, rcx
jne 0x14015b383
cmp qword [r8], rcx
je 0x14015b35d
add rsp, 0x28
jmp 0x14015b38c
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140221040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r10d, r10d
mov rdi, r8
mov eax, r10d
mov r11, rdx
cmp rax, 0x20
mov r9, rcx
jae 0x14015b4ab
mov byte [rsp + rax + 0x20], r10b
inc rax
cmp rax, 0x20
jl 0x14015b3b6
movzx r8d, byte [r11]
inc r11
mov edx, r8d
mov eax, r8d
shr rdx, 3
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
mov byte [rsp + rdx + 0x20], cl
test r8b, r8b
jne 0x14015b3ca
test r9, r9
jne 0x14015b3f7
mov r9, qword [rdi]
movzx r8d, byte [r9]
mov edx, 1
mov eax, r8d
mov ecx, r8d
and ecx, 7
shr rax, 3
shl edx, cl
mov r11, r9
test byte [rsp + rax + 0x20], dl
je 0x14015b44e
mov rsi, r9
mov bl, r8b
mov r8b, bl
test bl, bl
je 0x14015b44e
lea r9, [rsi + 1]
mov edx, 1
movzx ebx, byte [r9]
mov r11, r9
mov eax, ebx
mov ecx, ebx
and ecx, 7
shr rax, 3
shl edx, cl
mov rsi, r9
mov r8b, bl
test byte [rsp + rax + 0x20], dl
jne 0x14015b41e
mov rbx, r11
test r8b, r8b
je 0x14015b489
mov al, byte [r11]
movzx r8d, al
mov edx, 1
mov ecx, r8d
inc rbx
and ecx, 7
shr r8, 3
shl edx, cl
test byte [rsp + r8 + 0x20], dl
jne 0x14015b483
mov al, byte [rbx]
mov r9, rbx
test al, al
jne 0x14015b459
jmp 0x14015b489
mov byte [r9], r10b
mov r9, rbx
cmp rbx, r11
mov qword [rdi], r9
cmovne r10, r11
mov rax, r10
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f1b20
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call fcn.140144cb4
int3
Function at 0x14015c120
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14015c148
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14015c148
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14016d924
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x14016d985
test byte [rbx + 6], 0xf
jne 0x14016d978
xor edi, edi
cmp word [rbx + 4], di
jne 0x14016d978
cmp word [rbx + 2], di
jne 0x14016d978
cmp word [rbx], di
jne 0x14016d978
lea esi, [rdi + 1]
jmp 0x14016d97d
mov esi, 2
movzx eax, si
jmp 0x14016db7d
xor edi, edi
test cx, cx
jne 0x14016d9a0
mov rcx, rbx
call fcn.14016dd74
movzx ecx, ax
cmp di, ax
jl 0x14016db7a
movsx edx, cx
test esi, esi
jle 0x14016d9d0
sub ebp, edx
cmp ebp, esi
jg 0x14016d9d0
movsd xmm0, qword [0x140207cd0]
cmp word [rbx + 6], di
jge 0x14016d9c2
xorps xmm0, xmmword [0x140175f50]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x14016db7d
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x14016d9fd
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x14016db7d
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, reloc.WS2_32.dll_recv
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x14016db6f
test ebp, ebp
jns 0x14016db6f
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x14016da92
movzx edx, word [rbx + 4]
mov eax, 0xfff0
movzx r8d, word [rbx + 2]
sub ax, bp
shr ax, 4
add ax, si
movzx ecx, ax
movzx eax, cx
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], r8w
movzx r8d, dx
movzx edx, r11w
mov r11d, edi
sub rcx, rsi
jne 0x14016da64
mov word [rbx + 4], dx
mov word [rbx + 2], r8w
neg bp
je 0x14016db11
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x14016db27
jne 0x14016db46
test byte [rbx], sil
je 0x14016db46
add word [rbx], si
jne 0x14016db46
add word [rbx + 2], si
jne 0x14016db46
add word [rbx + 4], si
jne 0x14016db46
add r11w, si
mov word [rbx + 6], r11w
jmp 0x14016d9f5
cmp r11w, r15w
jne 0x14016d9f5
cmp word [rbx + 4], di
jne 0x14016d9f5
cmp word [rbx + 2], di
jne 0x14016d9f5
movzx eax, word [rbx]
neg ax
sbb ax, ax
jmp 0x14016db7d
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x143f6d108
Capabilities:
Encode data using xor

Disassembly:
push r11
pushfq
movabs r11, 0x19269425662d7f3e
mov r11b, 0x8c
not r11w
and ax, 0x2694
sbb dword [rcx - 0x4d], eax
mov word [rsi + 0x41], fs
not ebx
push r11
add byte [rsp], 0x11
mov qword [rsp + 0x18], 0xfffffffffe1af645
mov r11, qword [rsp + 0x10]
xor byte [rsp], 0x32
mov byte [rsp], 0x8a
jb 0x143f6d11e
setno byte [rsp]
cmp qword [rsp], 0x788b9e9c
setae byte [rsp]
shl byte [rsp], 0x1b
xor dword [rsp], 0x2933ffac
test dword [rsp], 0xa292fb8c
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.143fa570f
pushfq
call fcn.143e58ba1
jrcxz 0x143f6d110
sbb edx, ecx
stc
shl dword [rbx + rbp - 0x36f687b2], 1
leave
lodsb al, byte [rsi]
sub ecx, dword [rsi + 0x78]
jns 0x143f6d18e
mov esp, 0x61784e2b
fldcw word [rbx + rbp - 0x764e87b2]
cld
sub ecx, dword [rsi + 0x78]
mov dword [rcx + 0x784e2bc4], esi
cmp dword [rcx - 0x34], ecx
sub ecx, dword [rsi + 0x78]
stc
imul ecx, dword [rbx + rbp], 0x5171784e
in eax, dx
jg 0x143f6d1bf
mov dh, 0x99
cdq
lodsb al, byte [rsi]
mov esi, 0x29000001
ja 0x143f6d1dd
enter 0xffffffffffffc50f, 0x46
std
or eax, 0x8ecfc1b8
std
or eax, 0xd65b39b8
std
or eax, 0xfe9d3bb8
std
or eax, 0x4ec71bb8
std
or eax, 0x3e75d9b8
std
or eax, 0xc6b183b8
std
or eax, 0xb6574bb8
std
or eax, 0xbeb559b8
std
mov edi, 0x1b886029
sar edx, 1
ficomp dword [rdi + 0x19784e28]
fcmovu st(0), st(7)
sub byte [rsi + 0x78], cl
push 0x1f
sub byte [rsi + 0x78], cl
retf 0x9ffa
invalid

Function at 0x143feb43f
Capabilities:
Encode data using xor

Disassembly:
bswap ebp
mov ecx, dword [rsp + rdx - 0x47f0]
call fcn.143fa9ae1
sal rbp, 0x82
rol ecx, 1
rol bx, 0x44
inc bpl
movsx eax, bl
not ecx
xor bpl, bpl
xor ecx, 0xd595593d
ror edx, 0xdb
setae dl
jae 0x143faa190

Function at 0x143feb599
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r9, [r9 + rcx*2 + 4]
rol word [rsp + rcx], 0x4d
xor ebp, r11d
pop rax
not ebp
jmp 0x143fa3b3a
inc ebp
movzx r8d, cl
bswap ebp
jmp 0x143fd3b26
jmp 0x143f9aa5a
lea rbx, [r8 + rcx - 0x4e478d7b]
rol rdx, 4
call fcn.143fe97a4
mov r11, qword [rsp + rax + 0x2cfe42e1]
lea rbx, [r8 + r10*8 + 0x26966d0a]
movsxd rcx, ecx
neg r10
sar eax, 0x61
cmove r8, rbx
add rdi, rcx
shl ebp, 0xca
mov rsi, qword [rsi + r8 - 1]
mov qword [rsp + r8 + 0x17], rbp
push rax
setbe byte [rsp + r8*2 + 0x21]
pop r8
pop r8
pop rax
pop rbx
pop rdx
pop r10
pop rbx
pop rbx
pop r10
js fcn.143fb389e
mov edx, 0xae93989e
mov r10d, edx
mov rbp, qword [rsi]
sar r10d, 0x96
movsx ecx, dx
mov ebx, edx
mov ebx, dword [rbp + riz]
lea rbp, [rdx*2 - 0x52f8d0d5]
ja 0x143fe55b4
mov ebx, 0xc48655a8
add bx, 0xd63b
lea rdx, [rbx*8 - 0x3bdf75f8]
mov rdx, qword [rsi]
mov eax, ebx
shl ebx, 0x99
mov rax, qword [rsi + 8]
movzx r10d, bl
mov ebp, ebx
add r10d, r10d
xor r10, qword [rsi + r10*2 + 0x10]
push rbp
add rsi, 8
div r10
sal qword [rsp], 0x37
mov qword [rsi], rdx
add qword [rsp], 0xffffffffa51471b9
xchg byte [rsp + 2], bpl
mov qword [rsi + 8], rax
lea rdx, [rbx + 0x55036415]
dec qword [rsp]
movzx ecx, bx
mov ebp, dword [rcx + r9]
jp 0x143f97452
mov edx, 0xae894d09
movsx ecx, dx
lea r8, [rdx + rcx*4 - 0x376daefd]
mov rdx, qword [r9 + rcx - 0x4d09]
xor rdx, r11
neg rdx
jmp 0x143fd9f38
Function at 0x144113e62
Capabilities:
Encode data using xor

Disassembly:
movsx edx, bpl
sal rax, cl
not r10d
xor r10d, 0xbb26770a
lea r10d, [r10 + rbp*2 + 0x653063be]
bswap rbx
mov qword [rsp + r8*2 - 0x70], 0xffffffff84b1f932
mov qword [rsp + rbp - 0x34aca238], r11
xor dword [rsp + rbp*2 - 0x69594470], r10d
pop r11
movsxd r10, r10d
inc dx
sar r8w, 0x2f
adc rdi, r10
inc bp
mov cx, word [rsi + rbp*2 - 0x6959446c]
push rax
shr word [rsp + rbp*2 - 0x69594471], 0xe1
movsx r10d, word [rsp + r8*2]
lea rsi, [rsi + r8*4 + 8]
lea rbp, [rbp*2 - 0x32432056]
shr edx, 0x2e
jbe 0x14410f881
mov r10d, 0xc8bf72ba
mov bp, word [rsi]
call fcn.14413a585
mov r10d, dword [r9]
mov ebp, 0x8da169ad
add r9, 4
movzx r8d, bp
lea rax, [r8*2 + 0x721e8012]
xor bp, r8w
xor r10d, r11d
lea rbp, [r8 + rbp + 0x492d99b7]
and r8w, ax
bswap r10d
call fcn.14412eb3f

Function at 0x1441284cc
Capabilities:
Encode data using xor

Disassembly:
push r10
xor dword [rsp + r8*2 + 0x10], ecx
movzx r11d, r10b
mov qword [rsp + rdx - 0x2a3ae9e], r8
mov r11, qword [rsp + rdx*2 - 0x5475d3c]
inc ax
movsx ebx, r10w
movsxd rcx, ecx
neg rax
jbe 0x1440fed40

Function at 0x1441366e5
Capabilities:
Encode data using xor

Disassembly:
push r11
setge cl
xor dword [rsp + r8], eax
movzx r11d, dl
inc bl
rol rbx, cl
pop r11
rol ebp, 0xdd
sar bpl, 0x86
xor r8w, r11w
dec r8w
mov qword [rsp + rbx*4], rbx
and edx, dword [rsp + rbx*4 + 4]
not r8w
jb 0x14412e559
setge dl
sbb r8w, 0x7032
shl ebx, 0x16
or rcx, 0xffffffffcf18a88a
call fcn.1440f7c4f
xor ebp, r11d
inc ebp
movzx r8d, ax
call fcn.1441121ba
mov r8d, dword [rsi]
movzx r10d, byte [r9]
xor r10b, r11b
mov ecx, 0xb2a7ee8a
call fcn.1441111ea
Function at 0x6f8d6f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6f8d710b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call dbg.runtime.stdcall3
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x6f8d6fce
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x6f8d6fe1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x6f8d7005
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x6f8d7019
cmp rbx, 0x1000
jae 0x6f8d6fd8
nop
jmp 0x6f8d7089
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x6f8d702d
xor edx, edx
jmp 0x6f8d7080
mov rcx, qword [sym.VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call dbg.runtime.stdcall3
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x6f8d700f
jmp 0x6f8d6ff5
call dbg.runtime.getlasterror
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call dbg.runtime.printlock
lea rax, [0x6fb601bd]
mov ebx, 0x18
nop dword [rax + rax]
call dbg.runtime.printstring
mov rax, qword [rsp + 0x38]
call dbg.runtime.printuint
lea rax, [0x6fb60295]
mov ebx, 0x19
nop dword [rax + rax]
call dbg.runtime.printstring
mov rax, qword [rsp + 0x30]
call dbg.runtime.printuint
call dbg.runtime.printnl
call fcn.6f8f8360
lea rax, [0x6fb626f0]
mov ebx, 0x21
call dbg.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp dbg.runtime.sysUnusedOS
Function at 0x6f8d7140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6f8d736a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call dbg.runtime.stdcall4
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x6f8d71bb
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x6f8d71ce
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x6f8d71f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x6f8d7204
cmp rbx, 0x1000
jae 0x6f8d71c5
jmp 0x6f8d728e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x6f8d7216
xor esi, esi
jmp 0x6f8d7280
mov rax, qword [sym.VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call dbg.runtime.stdcall4
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x6f8d71fa
jmp 0x6f8d71e2
call dbg.runtime.getlasterror
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x6f8d7309
call dbg.runtime.printlock
lea rax, [0x6fb606c8]
mov ebx, 0x19
call dbg.runtime.printstring
mov rax, qword [rsp + 0x68]
call dbg.runtime.printuint
lea rax, [0x6fb60295]
mov ebx, 0x19
nop
call dbg.runtime.printstring
mov eax, dword [rsp + 0x34]
call dbg.runtime.printuint
call dbg.runtime.printnl
call fcn.6f8f8360
lea rax, [0x6fb5cea8]
mov ebx, 0xd
call dbg.runtime.throw
cmp eax, 0x5af
je 0x6f8d72b3
call dbg.runtime.printlock
lea rax, [0x6fb606c8]
mov ebx, 0x19
call dbg.runtime.printstring
mov rax, qword [rsp + 0x38]
call dbg.runtime.printuint
lea rax, [0x6fb60295]
mov ebx, 0x19
nop dword [rax]
call dbg.runtime.printstring
mov eax, dword [rsp + 0x34]
call dbg.runtime.printuint
call dbg.runtime.printnl
call fcn.6f8f8360
lea rax, [0x6fb61f61]
mov ebx, 0x1f
call dbg.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp dbg.runtime.sysUsedOS
Function at 0x6f8dfa40
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x6fcd4091], 0
jne 0x6f8dfb2f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x6f8dfb25
lea rbx, [0x6fca64f0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x6f8dfb07
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call dbg.runtime.panicIndexU
lea rax, [0x6fb6435a]
mov ebx, 0x2c
nop dword [rax + rax]
call dbg.runtime.throw
nop
int3

Function at 0x6f8e2280
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6f8e2381
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x6f8e22c0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x6f8e2371
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call dbg.runtime.(*scavengeIndex).find
nop dword [rax]
test rax, rax
je 0x6f8e2371
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x6f8e23c0]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call dbg.runtime.systemstack
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x6f8e235f
xor eax, eax
jmp 0x6f8e2369
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x6f8e22b2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp dbg.runtime.(*pageAlloc).scavenge