joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015cb0
Capabilities:
Hash data using murmur3

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rdx
sar rdx, 0x3f
mov rbp, rcx
shr rdx, 0x3e
mov r12, rsi
lea rax, [rsi + rdx]
and eax, 3
sub rax, rdx
sub r12, rax
cmp rsi, 3
jle 0x140015c97
mov ebx, dword [rcx]
mov rcx, qword [0x1400b8c70]
call fcn.14008ac80
cmp byte [rax], 0
jne 0x140015c79
xor edi, edi
mov ecx, 4
jmp 0x140015b89
cmp rsi, rcx
jle 0x140015c70
mov ebx, dword [rbp + rcx]
add rcx, 4
imul eax, ebx, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, edi
rol eax, 0xd
lea edi, [rax + rax*4 - 0x19ab949c]
cmp r12, rcx
jg 0x140015b78
mov rdx, rsi
sar rdx, 0x3f
shr rdx, 0x3e
lea rax, [rsi + rdx]
and eax, 3
sub rax, rdx
test rax, rax
jle 0x140015ca0
lea r9, [rax - 1]
mov r8, r9
add r8, rcx
js 0x140015c89
cmp rsi, r8
jle 0x140015c89
movzx edx, byte [rbp + r8]
test r9, r9
je 0x140015c29
sub rax, 2
mov r8, rax
add r8, rcx
js 0x140015c89
cmp r8, rsi
jge 0x140015c89
movzx r8d, byte [rbp + r8]
shl edx, 8
or edx, r8d
test rax, rax
je 0x140015c29
test rcx, rcx
js 0x140015c86
cmp rsi, rcx
jle 0x140015c86
movzx eax, byte [rbp + rcx]
shl edx, 8
or edx, eax
imul ebx, edx, 0xcc9e2d51
rol ebx, 0xf
mov rcx, qword [0x1400b8c70]
call fcn.14008ac80
cmp byte [rax], 0
jne 0x140015c79
imul eax, ebx, 0x1b873593
xor edi, esi
xor eax, edi
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
jmp 0x140015c7b
lea rdx, [rsi - 1]
call fcn.14000c0d0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rcx
lea rdx, [rsi - 1]
mov rcx, r8
call fcn.14000c0d0
jmp 0x140015c79
xor ecx, ecx
xor edi, edi
jmp 0x140015ba9
xor ebx, ebx
jmp 0x140015c32
sub rsp, 0x28
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
test rdx, rdx
js 0x140015cd8
lea rcx, [rax + 8]
test rax, rax
cmove rcx, rax
add rsp, 0x28
jmp 0x140015b20
lea rax, [rdx - 1]
mov r8, rdx
xor ecx, ecx
mov rdx, rax
call fcn.14000ee20
xor eax, eax
add rsp, 0x28
ret
Function at 0x140051710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r14
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test rdx, rdx
lea rbp, [rdx + 7]
mov rsi, rcx
mov r14, rdx
cmovns rbp, rdx
mov ebx, r8d
sar rbp, 3
cmp rdx, 7
jle 0x140051815
mov rcx, qword [0x1400b8c70]
call fcn.14008ac80
cmp byte [rax], 0
jne 0x140051808
xor r8d, r8d
lea rcx, [0x14009e2c0]
nop dword [rax + rax]
mov eax, dword [rsi + r8*8]
xor eax, ebx
mov ebx, dword [rsi + r8*8 + 4]
add r8, 1
mov edx, ebx
movzx r9d, bl
movzx edi, bh
shr ebx, 0x10
shr edx, 0x18
movzx ebx, bl
mov edx, dword [rcx + rdx*4]
xor edx, dword [rcx + r9*4 + 0xc00]
movzx r9d, al
xor edx, dword [rcx + r9*4 + 0x1c00]
mov r9d, eax
shr r9d, 0x18
xor edx, dword [rcx + r9*4 + 0x1000]
xor edx, dword [rcx + rdi*4 + 0x800]
movzx edi, ah
shr eax, 0x10
movzx eax, al
xor edx, dword [rcx + rbx*4 + 0x400]
xor edx, dword [rcx + rdi*4 + 0x1800]
mov ebx, dword [rcx + rax*4 + 0x1400]
xor ebx, edx
cmp rbp, r8
jg 0x140051760
shl rbp, 3
cmp r14, rbp
jle 0x140051808
add rbp, rsi
lea rcx, [0x14009e2c0]
add rsi, r14
nop dword [rax]
movzx edx, byte [rbp]
add rbp, 1
xor edx, ebx
shr ebx, 8
movzx edx, dl
xor ebx, dword [rcx + rdx*4]
cmp rbp, rsi
jne 0x1400517f0
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r14
ret
xor ebp, ebp
jmp 0x1400517d7
Function at 0x14006d390
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movdqu xmm6, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
movd xmm0, r8d
lea rax, [rdx - 0x40]
pxor xmm0, xmm6
cmp rax, 0x3f
jle 0x14006d5d0
lea r8, [rdx - 0x80]
movdqu xmm4, xmmword [0x1400b2690]
lea rax, [rcx + 0x40]
mov rdx, r8
and rdx, 0xffffffffffffffc0
lea rdx, [rcx + rdx + 0x80]
nop dword [rax]
movdqu xmm7, xmm3
movdqu xmm6, xmm2
movdqu xmm1, xmm5
add rax, 0x40
movdqu xmm8, xmm0
pclmulqdq xmm7, xmm4, 0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm8, xmm4, 0
pclmulqdq xmm5, xmm4, 0x11
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm3, xmm4, 0x11
pclmulqdq xmm2, xmm4, 0x11
pxor xmm0, xmm8
pxor xmm3, xmm7
pxor xmm2, xmm6
movdqu xmm8, xmmword [rax - 0x40]
pxor xmm1, xmm5
movdqu xmm7, xmmword [rax - 0x30]
movdqu xmm6, xmmword [rax - 0x20]
movdqu xmm5, xmmword [rax - 0x10]
pxor xmm0, xmm8
pxor xmm3, xmm7
pxor xmm2, xmm6
pxor xmm5, xmm1
cmp rax, rdx
jne 0x14006d3f0
mov rax, r8
shr rax, 6
lea rdx, [rax + 2]
shl rax, 6
mov r9, rax
mov rax, r8
shl rdx, 6
sub rax, r9
movdqu xmm1, xmmword [0x1400b2680]
movdqu xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pclmulqdq xmm0, xmm1, 0x11
pxor xmm0, xmm4
pxor xmm3, xmm0
movdqu xmm0, xmm3
pclmulqdq xmm3, xmm1, 0x11
pclmulqdq xmm0, xmm1, 0
pxor xmm3, xmm0
pxor xmm2, xmm3
movdqu xmm3, xmm2
pclmulqdq xmm2, xmm1, 0x11
pclmulqdq xmm3, xmm1, 0
movdqu xmm0, xmm2
pxor xmm0, xmm3
pxor xmm0, xmm5
cmp rax, 0xf
jle 0x14006d551
movdqu xmm2, xmm0
movdqu xmm7, xmmword [rcx + rdx]
pclmulqdq xmm0, xmm1, 0x11
pclmulqdq xmm2, xmm1, 0
pxor xmm0, xmm2
pxor xmm0, xmm7
cmp rax, 0x1f
jle 0x14006d551
movdqu xmm2, xmm0
movdqu xmm7, xmmword [rcx + rdx + 0x10]
pclmulqdq xmm0, xmm1, 0x11
pclmulqdq xmm2, xmm1, 0
pxor xmm0, xmm2
pxor xmm0, xmm7
cmp rax, 0x2f
jle 0x14006d551
movdqu xmm2, xmm0
movdqu xmm3, xmmword [rcx + rdx + 0x20]
pclmulqdq xmm0, xmm1, 0x11
pclmulqdq xmm2, xmm1, 0
pxor xmm0, xmm2
pxor xmm0, xmm3
movdqu xmm2, xmm0
psrldq xmm0, 8
movups xmm6, xmmword [rsp]
movdqu xmm3, xmmword [0x1400b26c0]
pclmulqdq xmm2, xmm1, 0x10
movups xmm7, xmmword [rsp + 0x10]
movups xmm8, xmmword [rsp + 0x20]
pxor xmm2, xmm0
movdqu xmm1, xmm2
movdqu xmm0, xmm2
movdqu xmm2, xmmword [0x1400b26a0]
psrldq xmm0, 4
pand xmm1, xmm2
pclmulqdq xmm1, xmmword [0x1400b26b0], 0
pxor xmm1, xmm0
movdqu xmm0, xmm1
pand xmm0, xmm2
pclmulqdq xmm0, xmm3, 0x10
pand xmm0, xmm2
pclmulqdq xmm0, xmm3, 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
add rsp, 0x38
ret
mov edx, 0x40
jmp 0x14006d492
Function at 0x14006d5e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rbx
test rdx, rdx
mov eax, r8d
lea r8, [rdx + 7]
mov r9, rcx
cmovns r8, rdx
mov r10, rdx
xor r11d, r11d
lea rcx, [0x1400b26e0]
sar r8, 3
cmp rdx, 7
jle 0x14006d6b0
nop
mov ebx, dword [r9 + r11*8 + 4]
xor eax, dword [r9 + r11*8]
add r11, 1
mov esi, ebx
movzx edx, bl
shr esi, 0x18
mov edx, dword [rcx + rdx*4 + 0xc00]
xor edx, dword [rcx + rsi*4]
movzx esi, al
xor edx, dword [rcx + rsi*4 + 0x1c00]
mov esi, eax
shr esi, 0x18
xor edx, dword [rcx + rsi*4 + 0x1000]
movzx esi, bh
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [rcx + rsi*4 + 0x800]
xor edx, dword [rcx + rbx*4 + 0x400]
movzx ebx, ah
shr eax, 0x10
movzx eax, al
xor edx, dword [rcx + rbx*4 + 0x1800]
xor edx, dword [rcx + rax*4 + 0x1400]
mov eax, edx
cmp r8, r11
jg 0x14006d610
shl r8, 3
cmp r10, r8
jle 0x14006d6a8
add r8, r9
lea rcx, [0x1400b26e0]
add r9, r10
movzx edx, byte [r8]
add r8, 1
xor edx, eax
shr eax, 8
movzx edx, dl
xor eax, dword [rcx + rdx*4]
cmp r9, r8
jne 0x14006d690
pop rbx
pop rsi
ret
xor r8d, r8d
jmp 0x14006d67e
Function at 0x140086440
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x1400b8c70]
mov rbx, rcx
nop dword [rax]
cmp word [rbx], 0x5a4d
jne 0x14008648d
movsxd rdx, dword [rbx + 0x3c]
lea eax, [rdx - 0x41]
cmp eax, 0x3be
ja 0x14008648d
mov rcx, rbx
call fcn.140086190
mov rcx, rsi
mov rdi, rax
call fcn.14008ac80
cmp byte [rax], 0
jne 0x1400864aa
cmp dword [rdi], 0x4550
je 0x1400864b4
mov rcx, rbx
mov edx, 1
call fcn.1400861a0
mov rcx, rsi
mov rbx, rax
call fcn.14008ac80
cmp byte [rax], 0
je 0x140086458
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, rbx
jmp 0x1400864ac

Function at 0x140089d90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140093d70
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140093d70
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140089e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400c3814]
mov rbx, rcx
test esi, esi
jle 0x140089f30
mov rax, qword [0x1400c3818]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140089e4b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140089ed5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140089e30
mov rcx, rbx
call fcn.14008a870
mov rdi, rax
test rax, rax
je 0x140089f52
mov rax, qword [0x1400c3818]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14008a9b0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400c3818]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140089f37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140089ece
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140089ee0
add dword [0x1400c3814], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400c3818]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140089ece
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140089d90
nop dword [rax]
xor esi, esi
jmp 0x140089e58
mov rax, qword [0x1400c3818]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140089d90
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140089d90
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14008a4e0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400c3880]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400c3860]
test rbx, rbx
je 0x14008a53c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14008a533
test eax, eax
jne 0x14008a533
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14008a518
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14008a870
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400b8c00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14008a890
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14008a898
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14008a890
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14008a8ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14008a8e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14008a890
add rax, 0x28
cmp rax, r9
jne 0x14008a8d0
xor eax, eax
ret

Function at 0x14008a8f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b8c00]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14008a90f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14008a918
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14008a90f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14008a9b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b8c00]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14008a9cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14008a9d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14008ac80
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x1400b8bd0]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x14008acb8
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14008ad20
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x14008ad30
mov esi, dword [0x1400c3908]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x14008ad88
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x14008add0
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x14008aca7
mov rcx, rbx
call fcn.14008abe0
mov qword [rsi + r12*8 + 8], rax
jmp 0x14008aca7
call fcn.14008abe0
mov qword [rbx + 0x10], rax
jmp 0x14008aca7
mov r10d, dword [rsi]
test r10d, r10d
je 0x14008ae61
mov r9d, dword [0x140095bb0]
test r9d, r9d
je 0x14008ae89
lea rcx, [0x1400c3920]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x14008ae6e
mov eax, dword [rsi]
test eax, eax
je 0x14008acc1
lea rcx, [0x1400c3920]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14008acc1
lea rcx, [r12 + 0x21]
mov edx, 8
lea rdi, [r12 + 0x20]
call sub.msvcrt.dll_calloc
mov rsi, rax
test rax, rax
je 0x14008aec4
mov qword [rax], rdi
mov ecx, dword [0x1400c3908]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14008acfb
call r13
jmp 0x14008acfb
lea rdi, [rbp + rbp]
lea rax, [r12 + 0x20]
mov rcx, rsi
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call sub.msvcrt.dll_realloc
mov rsi, rax
test rax, rax
je 0x14008aec4
mov qword [rax], rdi
sub rdi, rbp
lea rcx, [rax + rbp*8 + 8]
xor edx, edx
lea r8, [rdi*8]
call fcn.1400943e8
jmp 0x14008adab
lea rcx, [0x1400c3920]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14008aebc
lea rdx, [0x14008ab90]
mov ecx, eax
mov dword [0x1400c3908], eax
call fcn.140094510
test eax, eax
jne 0x14008aec4
mov dword [0x140095bb0], 1
mov edx, dword [rsi]
test edx, edx
jne 0x14008ad4c
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x14008acc1
mov rax, qword [0x1400c3900]
lea r12, [rax + 1]
mov qword [0x1400c3900], r12
mov qword [rbx + 0x10], r12
jmp 0x14008ad66
lock add dword [0x140095bb4], 1
je 0x14008ae19
mov r8d, dword [0x140095bb0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
lea rdi, [0x140095bb0]
test r8d, r8d
jne 0x14008ae57
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x14008aeb0
jmp 0x14008ae57
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14008ae49
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
cmp qword [rcx], rdx
jae 0x14008aee0
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x14008aeea
mov qword [rcx + 8], r8
test r9, r9
je 0x14008aef4
cmp qword [rcx], rdx
je 0x14008aef8
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x416620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4167ab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00619f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416685
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416694
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4166b3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4166c3
cmp rbx, 0x1000
jae 0x41668b
jmp 0x41672d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4166d5
xor edx, edx
jmp 0x416724
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00619f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4166b9
jmp 0x4166a8
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00619f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004cde51]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004ce442]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d0d3d]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x4167e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416a06
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00619f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416853
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416862
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416885
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416895
cmp rbx, 0x1000
jae 0x416859
nop
jmp 0x416918
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4168ad
xor esi, esi
jmp 0x41690a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00619f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41688b
jmp 0x416876
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00619f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4169a0
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004ce45b]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004ce442]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004ca2db]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416940
call sym.runtime.printlock
lea rax, [0x004ce45b]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004ce442]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d0478]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x4207e0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00619d74], 0
jne 0x4208d0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x4208c3
lea rsi, [0x005abe78]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x42089e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x004d2d33]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x422d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422e26
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x422d63
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x422e1b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x422e1b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00619f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x422e09
xor eax, eax
jmp 0x422e13
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x422d51
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge