joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400879b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140052fd0
lea rcx, [rsp + 0x48]
call fcn.140052fd0
call fcn.14005c0a0
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140052ec0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140087a1f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140053060
lea rcx, [rsp + 0x78]
call fcn.140053060
mov eax, dword [rsp + 0x24]
jmp 0x140087ab0
call fcn.14005c0a0
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140052ec0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140087a66
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140053060
lea rcx, [rsp + 0x78]
call fcn.140053060
mov eax, dword [rsp + 0x2c]
jmp 0x140087ab0
lea rcx, [rsp + 0x48]
call fcn.140053390
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140053390
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140053060
lea rcx, [rsp + 0x78]
call fcn.140053060
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub rsp, 0xc8
mov dword [rsp + 0x2c], 0x94
lea rcx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [rsp + 0x30], 6
jne 0x40102b
cmp dword [rsp + 0x34], 1
sete al
add rsp, 0xc8
ret

Function at 0x4011f0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x290
mov rbx, rcx
mov esi, edx
lea rcx, str.2.zal_c555e82a_d912_4028_a0ad_96d6d121e25a.
lea rdx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4012e6
lea r10, [rsp + 0x4c]
lea rdx, [0x004030b6]
mov rcx, r10
call fcn.004013c0
lea rdx, [rsp + 0x17c]
mov rcx, r10
call fcn.00401370
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, 1
mov rcx, r10
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, qword [sym.imp.KERNEL32.dll_FindClose]
cmp rax, 0xffffffffffffffff
mov r13, rax
jne 0x401290
mov rcx, r12
call rdi
jmp 0x4012e6
mov r8d, esi
lea r9, [rsp + 0x48]
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r13
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call rdi
test esi, esi
je 0x4012e6
mov r8d, dword [rsp + 0x48]
xor eax, eax
cmp r8d, eax
jle 0x4012ea
mov dl, byte [rbx + rax]
lea rcx, [rbx + rax]
inc rax
cmp dl, 0xa
je 0x4012e1
cmp dl, 0xd
jne 0x4012c8
mov byte [rcx], 0
jmp 0x4012ea
xor eax, eax
jmp 0x4012ef
mov eax, 1
add rsp, 0x290
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret

Function at 0x401420
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xd0
xor edx, edx
mov r8d, 0x68
lea r9, [rsp + 0x68]
mov r10, rcx
mov rcx, r9
call fcn.00401320
lea r11, [rsp + 0x50]
xor edx, edx
mov r8d, 0x18
mov rcx, r11
mov dword [rsp + 0x68], 0x68
mov dword [rsp + 0xa4], 1
mov word [rsp + 0xa8], 0
call fcn.00401320
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r9
mov rdx, r10
xor r9d, r9d
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4014d7
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x58]
call rbx
nop
add rsp, 0xd0
pop rbx
ret
Function at 0x140001030
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x85b3b69
mov rbx, rcx
jne 0x140001087
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001087
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001087
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
test rax, rax
je 0x140001087
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x14000108c
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x140001094
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x85b3b69
mov rsi, rcx
je 0x1400010b8
mov eax, 0xc0000001
jmp 0x14000116d
xor ebx, ebx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x30]
mov edi, ebx
lea ecx, [rbx + 0x42]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14000116b
test rdi, rdi
je 0x1400010f0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x42
mov rdi, rax
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x1400010e0
test rdi, rdi
je 0x14000116b
mov r8d, dword [rdi]
test r8d, r8d
je 0x140001160
lea rdx, [rdi + 0x18]
test byte [rdx - 8], 1
je 0x140001155
cmp qword [rdx], 0x200000
jne 0x140001155
mov ecx, dword [0x140001cc0]
mov r9b, byte [0x140001cc4]
cmp dword [rdx + 8], ecx
jne 0x140001155
cmp byte [rdx + 0xc], r9b
je 0x14000117d
inc ebx
add rdx, 0x20
cmp ebx, r8d
jb 0x14000112e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rsi + 8]
mov rax, qword [rdx - 0x10]
mov qword [rcx], rax
jmp 0x14000116b
Function at 0x14000118c
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x85b3b69
mov rdi, rcx
jne 0x140001251
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001251
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001251
call fcn.140001268
mov rcx, qword [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, rbx
mov rsi, qword [rdi + 0x18]
call fcn.140001494
test rax, rax
je 0x140001251
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov rcx, qword [rdi + 0x10]
cmp edx, esi
cmovl esi, edx
and qword [rsp + 0x48], 0
cmp byte [rdi + 0x20], 0
movsxd r8, esi
je 0x140001234
mov rdx, rcx
lea r9, [rsp + 0x48]
mov rcx, rax
call fcn.140001674
jmp 0x14000124d
lea rdx, [rsp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x140001256
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140016cc4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x140021118], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x140021128]
jne 0x140016d11
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140021150], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x140021118], 1
mov ecx, dword [0x140021150]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x140016de6
mov rcx, qword [0x140020444]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140016e11
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140021120]
test rax, rax
je 0x140016d61
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x140021120], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x140016e2c]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140021150]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140020444]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140016e11
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x140460c44
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], rcx
xor cx, cx
mov rcx, qword [r11 + 8]
adc r11, 8
sal word [rsp], 0x82
jns 0x14047ac77
mov edx, 0x87b0930e
mov rdx, qword [rbx]
push 0xffffffffb0243bb8
neg byte [rsp + 1]
add rbx, 8
mov qword [rsp], rdx
jmp 0x14047423c
popfq
jmp 0x1404555d2
jmp 0x140485d22
jmp 0x14047041a
Function at 0x140011377
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc r11w
xchg qword [rsp + 8], rdi
jmp 0x1400113a3

Function at 0x14001138d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rbp, 0xffffffff99b38c8a
bswap r10
mov rdx, 0xffffffff86cf9ad5
call fcn.140011377
mov bpl, 0xe4
bswap rdx
lea rdx, [r9 + riz + 0x80c0]
mov rbp, qword [rsp]
pushfq
lea rdi, [rdi + riz - 0x23]
jmp 0x140011478
bswap r14d
mov r11d, 0x157e2f86
xchg bp, r10w
rdtsc
call fcn.1400113ef

Function at 0x140011c0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 5]
lea rsp, [rsp]
push word [rsp + 1]
jmp 0x140011cb6
mov word [rsp + 1], bx
pop word [rsp]
call 0x140011c5b
push rbx
mov word [rsp], di
jmp 0x140011c96
mov word [rsp + 2], r8w
lea rsp, [rsp + 3]
mov qword [rsp + 0x28], r13
call fcn.140011c80
xor byte [rdx + rbp + 0x2102bc4d], dh
invalid
js 0x140011c4c
mov word [rsp + 1], bx
pop word [rsp]
jmp 0x140011c55

Function at 0x14009b1fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r8d, esp
btc edx, ebx
lea rcx, [r10 + r11]
xchg r10b, cl
bsr dx, r9w
jmp 0x14009b20d
add rsp, 4
lea rsp, [rsp + 0x11]
not al
xchg byte [rsp + 8], al
rdtsc
jmp 0x14009b1e0
add rsp, 0
mov cl, 0x20
mov rax, rsi
mov dword [rsp + 1], r13d
xchg dx, r8w
jmp 0x14009b245
mov byte [rsp + 7], dil
lea r13, [r13 + riz + 0xa61b]
lea rcx, [rdi + riz + 0x35bedfd]
add rsp, 6
jmp 0x14009b22f

Function at 0x14009b49a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 1], esi
cld
mov byte [rsp], bl
push word [rsp + 7]
jmp 0x14009b4b2
jmp 0x14009b484
mov ax, word [rsp + 4]
xchg word [rsp + 5], cx
mov dl, sil
adc rax, r13
jmp 0x14009b4c7
mov r13w, r10w
inc dx
mov r13, rdx
pop word [rsp + 7]
cmc
mov rdx, r15
jmp 0x14009b49c
lea rsp, [rsp + 2]
shl r8b, cl
neg edx
xchg byte [rsp + 5], al
clc
mov cx, 0xdaea
jmp 0x14009b519
setge al
bsf r10d, esp
lea rcx, [rsi + rbp]
mov eax, edx
bsr dx, sp
jmp 0x14009b503

Function at 0x14009b5ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], r10
sub rsp, 7
bts r10d, r8d
jmp 0x14009b626
xchg ecx, eax
mov r13, qword [rsp]
mov ecx, 0x9700262e
push r11w
mov byte [rsp + 3], dil
xchg rcx, r10
jmp 0x14009b610

Function at 0x14009bb33
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [rsp + 0xc], r10w
xchg r8b, dl
pop word [rsp + 0x13]
jmp 0x14009bb56
Function at 0x14000dd80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
test rcx, rcx
jne 0x14000ddba
call fcn.140003f88
and dword [rax], 0
call fcn.140003f68
and qword [rsp + 0x20], 0
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call fcn.140003e98
mov eax, ebx
jmp 0x14000de0a
test edx, 0xfffffff9
jne 0x14000dd8d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000dde3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003fa8
call fcn.140003f68
mov eax, dword [rax]
jmp 0x14000de0a
test al, 0x10
jne 0x14000de08
test al, 1
je 0x14000de08
test bl, 2
je 0x14000de08
call fcn.140003f88
mov dword [rax], 5
call fcn.140003f68
mov dword [rax], 0xd
jmp 0x14000ddda
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140001928
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001972
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001972
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001972
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001972
cmp dword [rcx + 0x84], 0xe
jbe 0x140001972
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001974
xor al, al
add rsp, 0x28
ret
Function at 0x180c63108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180c6328f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180c63139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c6311f
add dl, dl
jne 0x180c63146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c631a6
xor eax, eax
add dl, dl
jne 0x180c63155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180c6325d
add dl, dl
jne 0x180c63166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c63173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c63180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c6318d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180c6319a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180c6312e
mov eax, 1
add dl, dl
jne 0x180c631b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180c631c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c631ab
sub eax, ebx
mov ebx, 1
jne 0x180c631fc
mov ecx, 1
add dl, dl
jne 0x180c631de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180c631eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c631d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c6312e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180c63218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180c63225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180c6320d
cmp eax, 0x7d00
jae 0x180c6324b
cmp eax, 0x500
jb 0x180c63246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c6312e
cmp eax, 0x7f
ja 0x180c6324e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180c6312e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180c63282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180c6312e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x413400
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41358b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b2688]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413465
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413474
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413493
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4134a3
cmp rbx, 0x1000
jae 0x41346b
jmp 0x41350d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4134b5
xor edx, edx
jmp 0x413504
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b2688]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413499
jmp 0x413488
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b2688]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004859d5]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00485de1]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00487923]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x4135c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4137e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b2688]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413633
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x413642
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x413665
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x413675
cmp rbx, 0x1000
jae 0x413639
nop
jmp 0x4136f8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41368d
xor esi, esi
jmp 0x4136ea
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b2688]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41366b
jmp 0x413656
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b2688]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x413780
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x00485dfa]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x00485de1]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004830b9]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x413720
call sym.runtime.printlock
lea rax, [0x00485dfa]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00485de1]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00487365]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x41b040
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005b248f], 0
jne 0x41b130
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41b123
lea rsi, [0x00544598]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41b0fe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x00488d12]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x41d580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d686
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x41d5c3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x41d67b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x41d67b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b2688]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x41d669
xor eax, eax
jmp 0x41d673
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x41d5b1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge