joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a4e7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rax, [rsp + r15]
xchg rdi, rax
jmp 0x2a4ecd
mov di, r10w
neg rdx
pop rdi
mov r9, 0xffffffff9bf1c09a
xchg qword [rsp + 7], r12
jmp 0x2a4f17
mov rdi, r10
lea rdx, [rbx + rdi]
lea r9, [rax + rdi]
jmp 0x2a4f7a
mov rax, 0xffffffff9d4720a1
sub rsp, 0xa
mov di, 0x7477
bsr rax, r14
rdtsc
xchg dil, r14b
jmp 0x2a4f01
xchg dword [rsp + 3], eax
mov r14, rdi
cld
and dx, r12w
add rsp, 0x18
jmp 0x2a4fae
xor edi, 0xe69df01a
not r9
pop word [rsp + 6]
mov rdx, qword [rsp + 0xf]
mov rdx, 0xffffffffec3d2b69
mov cl, 0xdd
jmp 0x2a4f63
rdtsc
mov r14b, r15b
cmp r14b, r15b
mov rax, 0xffffffffc16e78c9
jmp 0x2a4fe5
mov edx, r12d
mov r14b, r13b
mov rcx, r8
mov dword [rsp], r13d
mov cl, byte [rsp + 5]
jmp 0x2a4f98
xchg word [rsp + 3], r14w
neg r14w
not rax
xchg word [rsp + 3], r9w
jmp 0x2a5091
mov dil, byte [rsp + 5]
bswap edx
mov r9w, word [rsp + 1]
shr rcx, 0x1b
lea rsp, [rsp + 5]
push rsi
jmp 0x2a5052
pop word [rsp + 4]
rdtsc
neg r9w
xchg byte [rsp + 4], dl
bt di, r10w
stc
jmp 0x2a4ffe
inc ecx
add rsp, 0xb
mov r9, qword [rsp]
neg edi
jmp 0x2a506d
mov r12w, word [rsp + 1]
bts cx, dx
bswap r14d
not r9w
sub rsp, 0x1e
add rsp, 0x16
jmp 0x2a503c
push word [rsp + 2]
lea rsp, [rsp + 7]
mov al, 0x18
lea r9, [rdi + r10]
mov r9, qword [rsp]
call fcn.002a51a5
invalid
push word [rsp + 3]
lea rax, [rdi + riz - 0x25]
mov rdx, 0x74edc09
mov qword [rsp], rcx
bsf r9d, r14d
mov r9w, 0x1541
jmp 0x2a5025
Function at 0x2a9657
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 1], r12d
not rcx
jmp 0x2a9765
seto bl
xchg qword [rsp], rbx
xchg qword [rsp + 0x11], rax
mov dx, 0x9840
mov r8, rdi
push word [rsp + 0x15]
jmp 0x2a969a
push r10
mov word [rsp + 0xd], r8w
add sil, 0x6f
lea rax, [rdi + r9]
cpuid
setp bl
jmp 0x2a96bc

Function at 0x2a99b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bpl, cl
xchg ebx, r8d
add rsp, 8
mov dx, cx
jmp 0x2a9a12
mov r13, rsp
mov r8, 0xffffffff93be2f76
mov bx, word [rsp]
jmp 0x2a9a44
and r8w, r8w
mov r8w, cx
mov bp, word [rsp]
btc r8d, esi
mov esi, r8d
mov rbp, 0x59d44aed
jmp 0x2a99fc
stc
lea rbp, [rsi + rsi]
mov ecx, 0x5ec9cc80
bts ax, bx
bswap edx
jmp 0x2a9a81
bswap rcx
xchg r13, rax
cld
lea rcx, [rax + r13]
cpuid
cpuid
jmp 0x2a9a2e
add rsp, 0
xchg r13b, bl
mov r8d, dword [rsp]
xchg bl, sil
cpuid
mov bpl, 0x16
jmp 0x2a9a6b

Function at 0x2a9f5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r8d, 0xfb243161
not bp
jmp 0x2aa072
bt si, r14w
xchg byte [rsp + 6], cl
sub rsp, 7
not bl
neg rbx
xchg dword [rsp + 2], ebx
jmp 0x2a9f83
neg r8b
mov r13, 0xffffffffd0672455
add rsp, 7
cmp r8w, bx
xchg ebx, edx
mov r8, 0x67492b2a
jmp 0x2a9f99
xchg byte [rsp + 0xb], cl
lea rbp, [r14 + riz + 0x95]
adc r8d, r11d
pop word [rsp + 4]
lea rdx, [r13 + r13]
mov r13w, word [rsp + 1]
jmp 0x2a9fcb
mov r8d, 0xbcc359a2
cpuid
lea rbx, [r9 + riz]
xchg qword [rsp + 1], rbp
cmc
mov word [rsp + 1], r11w
jmp 0x2a9ffb

Function at 0x2aa3ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, 0xc37f44
lea rsp, [rsp + 0xe]
sub rsp, 0x1f
jmp 0x2aa3b1
mov dword [rsp + 0xa], r9d
mov dword [rsp + 0x16], r15d
lea rax, [r10 + r15]
bswap rbp
jmp 0x2aa36d
push ax
sub cl, 0x98
pop qword [rsp + 0xe]
rdtsc
sub rsp, 3
not edx
jmp 0x2aa383
xchg dword [rsp + 0x26], ebx
mov rsi, qword [rsp + 0x16]
neg ax
push qword [rsp + 0x22]
jmp 0x2aa436
setle bl
xchg r8, rsi
pop ax
not r8w
jmp 0x2aa39c
mov bx, word [rsp + 0x2d]
mov esi, 0xdf901247
cpuid
pop r8
xchg qword [rsp + 0x1d], r8
pop qword [rsp + 0x11]
jmp 0x2aa411
mov rbx, 0x61e77ea
pop word [rsp + 7]
bswap r8d
bswap rdx
cld
setb r8b
jmp 0x2aa3d9
xchg edx, r8d
xchg dl, al
push word [rsp + 6]
push rcx
mov byte [rsp + 4], r12b
xchg cx, dx
jmp 0x2aa463
add rsp, 3
sbb dx, si
mov ax, r13w
mov r8, qword [rsp + 0x25]
shr cx, cl
not ebx
jmp 0x2aa3f8
pop word [rsp + 0x13]
rdtsc
xchg dword [rsp + 0x10], edx
xchg r13b, dl
jmp 0x2aa4bb
sub sil, 0xe0
adc rax, 0x740f1563
lea r8, [r13 + riz + 0x1a]
lea r13, [rsi + rbp]
mov dx, word [rsp + 0x13]
cmc
jmp 0x2aa44d
xchg dx, bp
pop r13
call fcn.002aa498
Function at 0x401018
Capabilities:
Parse pe header

Disassembly:
push rcx
add al, 0
xor ecx, ecx
mov dword [rax], 1
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x45106
add al, 0
mov dword [rax], 1

Function at 0x401028
Capabilities:
Parse pe header

Disassembly:
push rcx
add al, 0
xor ecx, ecx
mov dword [rax], 1
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x45106
add al, 0
mov dword [rax], 1

Function at 0x401038
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00446140]
mov dword [rax], 1
add byte [rcx], al
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x450cc
push rax
add al, 0
mov dword [rax], 1
mov rax, qword [0x00445fb0]
cmp word [rax], 0x5a4d
jne 0x401067

Function at 0x401040
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00446140]
mov dword [rax], 1
add byte [rcx], al
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x450cc
push rax
add al, 0
mov dword [rax], 1
mov rax, qword [0x00445fb0]
cmp word [rax], 0x5a4d
jne 0x401067
Function at 0x40ec90
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov eax, 0x8178
call fcn.00436960
sub rsp, rax
mov rdi, rcx
mov r8d, 2
mov edx, 0xffffffe0
call sub.msvcrt.dll_fseek
cmp eax, 0xffffffff
je 0x40eeab
lea rcx, [rsp + 0x40]
mov r9, rdi
mov r8d, 0x20
mov edx, 1
call sub.msvcrt.dll_fread
cmp rax, 0x20
jne 0x40eeab
movabs rdx, 0x5845474154455041
cmp qword [rsp + 0x40], rdx
jne 0x40eeab
mov ebp, dword [rsp + 0x48]
cmp ebp, 0x3e8
je 0x40ed14
cmp ebp, 0x7d0
jne 0x40eeab
mov esi, dword [rsp + 0x4c]
cmp esi, 0x20
jbe 0x40eeab
mov edx, esi
neg edx
mov r8d, 2
mov rcx, rdi
call sub.msvcrt.dll_fseek
cmp eax, 0xffffffff
je 0x40eeab
lea rbx, [rsp + 0x170]
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
sub rsi, 0x20
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rbx
call sub.msvcrt.dll_fread
cmp rsi, rax
jne 0x40eeab
mov ecx, dword [rsp + 0x50]
lea esi, [rcx - 1]
test ecx, ecx
je 0x40ee8c
cmp ebp, 0x7d0
sbb r12d, r12d
and r12d, 5
mov dword [rsp + 0x3c], r12d
mov r8, rbx
lea r14, [rsp + 0x60]
mov edi, dword [r8]
mov ebp, dword [r8 + 4]
lea r15, [r8 + 8]
mov rdx, r15
mov rcx, r14
call sub.msvcrt.dll_strcpy
mov r8, r14
mov r9d, dword [r8]
add r8, 4
lea r10d, [r9 - 0x1010101]
not r9d
and r10d, r9d
mov r11d, r10d
and r11d, 0x80808080
je 0x40edb6
mov eax, r11d
shr eax, 0x10
and r10d, 0x8080
cmovne eax, r11d
lea rbx, [r8 + 2]
cmovne rbx, r8
mov edx, eax
add dl, al
sbb rbx, 3
sub rbx, r14
lea r15, [r15 + rbx + 1]
mov ecx, dword [0x00457ae0]
test ecx, ecx
je 0x40ee4f
lea r13, [0x00457b00]
xor r12d, r12d
jmp 0x40ee22
add r12d, 1
add r13, 0x28
cmp r12d, ecx
jae 0x40ee4f
cmp rbx, qword [r13 + 8]
jne 0x40ee15
mov r8, rbx
mov rdx, r14
mov rcx, qword [r13]
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
je 0x40eea7
mov ecx, dword [0x00457ae0]
add r12d, 1
add r13, 0x28
cmp r12d, ecx
jb 0x40ee22
mov ebx, edi
test edi, edi
je 0x40eea2
lea r9d, [rdi - 1]
cmp byte [r15 + r9], 0
je 0x40ee63
mov r9, rbx
mov dword [rsp + 0x28], ebp
mov edi, dword [rsp + 0x3c]
mov dword [rsp + 0x20], edi
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.0040e185
lea r8, [r15 + rbx]
sub esi, 1
cmp esi, 0xffffffff
jne 0x40ed9d
xor eax, eax
add rsp, 0x8178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
jmp 0x40ee63
mov ebx, edi
jmp 0x40ee7c
mov eax, 0xffffffff
jmp 0x40ee8e
Function at 0x4358e0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00438180
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00438180
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x435950
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00476014]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x435af8
mov rax, qword [0x00476018]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x43599c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x435a27
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x435980
mov rcx, r12
call fcn.004366b0
mov rbp, rax
test rax, rax
je 0x435b32
mov rax, qword [0x00476018]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.004367e0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00476018]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x435b41
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x435a20
sub eax, 4
and eax, 0xfffffffb
jne 0x435ab0
add dword [0x00476014], 1
cmp ebx, 8
jae 0x435a58
test bl, 4
jne 0x435b00
test ebx, ebx
je 0x435a49
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x435b20
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x435a49
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x435a8a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00476018]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x435a20
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004358e0
nop dword [rax]
xor edi, edi
jmp 0x4359a7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x435a49
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x435a49
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.004358e0
mov rax, qword [0x00476018]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.004358e0
nop
nop dword [rax]
Function at 0x436320
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00476300]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004762e0]
test rbx, rbx
je 0x436374
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x43636b
test r12, r12
je 0x43636b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x436350
lea rcx, [0x00476300]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4366b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x00445fb0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x436729
mov rcx, r10
call fcn.00436580
test eax, eax
je 0x436729
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x436726
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x43671d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x436729
add r8, 0x28
cmp r8, r9
jne 0x436708
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call fcn.140178000
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1400087ec
add rsp, 0x28
jmp 0x140008188
Function at 0x415680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41580b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060c680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4156e5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4156f4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415713
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415723
cmp rbx, 0x1000
jae 0x4156eb
jmp 0x41578d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415735
xor edx, edx
jmp 0x415784
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060c680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415719
jmp 0x415708
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060c680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004f7794]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004f7caf]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004f9ed7]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x415840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415a66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060c680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4158b3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4158c2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4158e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4158f5
cmp rbx, 0x1000
jae 0x4158b9
nop
jmp 0x415978
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41590d
xor esi, esi
jmp 0x41596a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060c680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4158eb
jmp 0x4158d6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060c680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415a00
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004f7cc8]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004f7caf]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004f473e]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4159a0
call sym.runtime.printlock
lea rax, [0x004f7cc8]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004f7caf]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004f97a0]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x41ee60
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0060c451], 0
jne 0x41ef47
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41ef3a
lea rbx, [0x005de838]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41ef20
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x004fbb8f]
mov ebx, 0x2c
call sym.runtime.throw
nop
int3

Function at 0x421220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421326
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x421263
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42131b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42131b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060c680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x421309
xor eax, eax
jmp 0x421313
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x421251
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x42db00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42dc10
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
nop
test dil, dil
je 0x42db55
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov eax, 6
call sym.runtime.stopTheWorld
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
movzx edi, byte [rsp + 0x80]
mov qword [rsp + 8], 0
nop
test rbx, rbx
jne 0x42db6d
test dil, dil
jmp 0x42dbfb
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.Stack.func1]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov rax, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x48], dil
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060c680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x80]
test al, al
je 0x42dc05
nop dword [rax]
call sym.runtime.startTheWorld
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.Stack