joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rbp, qword [rsp + 0x80]
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rsi, rcx
mov rbx, r9
mov rcx, rdx
mov r9, rbp
mov rdx, r8
lea r8, [rsp + 0x20]
call dbg.visit_type_str
test al, al
je 0x1400152e6
mov rcx, rsi
mov rdx, qword [rsp + 0x20]
mov r8, rbp
call qword [rbx + 8]
mov rcx, qword [rsp + 0x20]
call sym.g_free
mov rax, qword [rsp + 0x28]
sub rax, qword [rdi]
jne 0x1400152f9
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__stack_chk_fail
nop
nop

Function at 0x140015300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rbp, qword [rsp + 0x90]
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rbx, rdx
mov rsi, r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [r9]
mov rdx, qword [rsp + 0x30]
mov byte [rsp + 0x2f], al
test rdx, rdx
je 0x140015368
mov rcx, rbp
call sym.error_propagate
mov rax, qword [rsp + 0x38]
sub rax, qword [rdi]
jne 0x14001537d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9, rbp
lea r8, [rsp + 0x2f]
mov rdx, rsi
mov rcx, rbx
call dbg.visit_type_bool
jmp 0x14001534e
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop

Function at 0x140015390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rdi, qword [rsp + 0x80]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, r9
mov rcx, rdx
mov r9, rdi
mov rdx, r8
lea r8, [rsp + 0x27]
call dbg.visit_type_bool
test al, al
je 0x1400153dc
movzx edx, byte [rsp + 0x27]
mov r8, rdi
mov rcx, rbx
call qword [rbp + 8]
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x1400153ef
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]

Function at 0x140015400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r12, qword [rsp + 0xa0]
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rsi, rdx
mov rdi, r8
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
mov rbx, r9
call qword [r9 + 8]
mov rdx, qword [rsp + 0x40]
mov dword [rsp + 0x3c], eax
test rdx, rdx
je 0x140015470
mov rcx, r12
call sym.error_propagate
mov rax, qword [rsp + 0x48]
sub rax, qword [rbp]
jne 0x14001548a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov qword [rsp + 0x20], r12
mov r9, qword [rbx]
lea r8, [rsp + 0x3c]
mov rdx, rdi
mov rcx, rsi
call dbg.visit_type_enum
jmp 0x140015455
call sym.__stack_chk_fail
nop
Function at 0x140030240
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r12, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rdi, rcx
mov ebp, edx
mov r13d, r8d
call sym.getenv
mov qword [rsp + 0x20], 0
mov rbx, rax
test rax, rax
je 0x1400302f2
mov r14, qword [sym.imp.msvcrt.dll__errno]
call r14
lea rdx, [rsp + 0x20]
mov r8d, 0xa
mov rcx, rbx
mov dword [rax], 0
call sym.strtol
mov esi, eax
cmp qword [rsp + 0x20], rbx
je 0x1400302f2
test eax, eax
js 0x1400302e0
cmp eax, ebp
jg 0x1400302e0
call r14
mov eax, dword [rax]
test eax, eax
jne 0x1400302e0
mov rax, qword [rsp + 0x28]
sub rax, qword [r12]
jne 0x1400302f7
mov eax, esi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r8d, ebp
mov rdx, rdi
lea rcx, str._s_not_in__0___d_
call dbg.warn_report
mov esi, r13d
jmp 0x1400302bb
call sym.__stack_chk_fail
nop
nop dword [rax]

Function at 0x140030cc0
Capabilities:
Get system information on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rdi]
mov qword [rsp + 0x68], rax
xor eax, eax
mov rbp, rcx
mov rsi, rdx
test r9b, r9b
jne 0x140030d70
mov rdx, rcx
mov r9d, 4
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rax, qword [0x14009f0d0]
mov eax, dword [rax]
test eax, eax
jne 0x140030d80
test rbx, rbx
je 0x140030d1d
test rsi, rsi
jne 0x140030d40
mov rax, qword [rsp + 0x68]
sub rax, qword [rdi]
jne 0x140030e07
mov rax, rbx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea r13, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, r13
call r12
movsxd rbp, dword [rsp + 0x58]
mov rcx, r13
call r12
movsxd rax, dword [rsp + 0x34]
cmp eax, ebp
cmovl rax, rbp
mov qword [rsi], rax
jmp 0x140030d1d
lea rcx, str.Skipping_reservation_of_swap_space_is_not_supported.
xor ebx, ebx
call dbg.error_report
jmp 0x140030d1d
mov rax, qword [0x14009e780]
cmp word [rax], 0
je 0x140030d13
mov rax, qword [0x14009ed50]
mov eax, dword [rax]
test ah, 0x80
je 0x140030d13
mov rax, qword [str.Y3_v_]
cmp byte [rax], 0
je 0x140030df0
lea rcx, [rsp + 0x30]
xor edx, edx
call sym.gettimeofday
movsxd r13, dword [rsp + 0x34]
movsxd r12, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x28], rbx
lea rcx, str._d__zu._06zu:qemu_anon_ram_alloc_size__zu_ptr__p_n
mov qword [rsp + 0x20], rbp
mov edx, eax
mov r9, r13
mov r8, r12
call dbg.qemu_log
jmp 0x140030d13
mov r8, rbx
mov rdx, rbp
lea rcx, str.qemu_anon_ram_alloc_size__zu_ptr__p_n
call dbg.qemu_log
jmp 0x140030d13
call sym.__stack_chk_fail
nop
nop dword [rax]
Function at 0x140030fc0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor r8d, r8d
xor edx, edx
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
movsxd rbx, ecx
mov dword [rsp + 0x24], 0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x140031020
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140031032
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rbx, rax
call dbg.socket_error
mov dword [rbx], eax
jmp 0x140031007
call sym.__stack_chk_fail
nop
nop dword [rax + rax]

Function at 0x140031040
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov edx, 0x8004667e
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov dword [rsp + 0x24], 1
movsxd rcx, ecx
lea r8, [rsp + 0x24]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x140031090
jne 0x1400310a0
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbx]
jne 0x1400310a9
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
call dbg.socket_error
neg eax
jmp 0x140031078
call sym.__stack_chk_fail
nop
nop

Function at 0x1400310b0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov edx, 0x8004667e
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov dword [rsp + 0x24], 1
movsxd rcx, ecx
lea r8, [rsp + 0x24]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x140031100
jne 0x140031110
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x140031117
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
call dbg.socket_error
jmp 0x1400310e8
call sym.__stack_chk_fail
nop
nop dword [rax]

Function at 0x140031220
Capabilities:
Get common file path

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x140
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23
mov rax, qword [rsi]
mov qword [rsp + 0x138], rax
xor eax, eax
mov rbx, rcx
lea rdi, [rsp + 0x40]
mov ecx, 0x1e
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov byte [rdi + 4], 0
lea rdi, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1400312b3
mov rdx, rdi
mov r8, rbx
lea rcx, [0x14009151e]
call sym.g_strdup_printf
mov rdx, qword [rsp + 0x138]
sub rdx, qword [rsi]
jne 0x1400312ce
add rsp, 0x140
pop rbx
pop rsi
pop rdi
ret
mov r9d, eax
lea r8, str.CSIDL_COMMON_APPDATA_unavailable:__ld
mov edx, 8
xor ecx, ecx
call sym.g_log
call sym.abort
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x140031450
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rbx]
jne 0x140031485
add rsp, 0x60
pop rbx
ret
call sym.__stack_chk_fail
nop
nop dword [rax + rax]

Function at 0x140031540
Capabilities:
Connect socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
test eax, eax
js 0x140031560
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140031590
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x70
jmp 0x140031555

Function at 0x1400316e0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
js 0x140031700
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x1400317b0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rsp + 0x70]
movsxd rcx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
test eax, eax
js 0x1400317e0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140031840
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_getsockname]
mov ebx, eax
test eax, eax
js 0x140031860
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140031880
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test eax, eax
js 0x1400318a0
movsxd rax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
movsxd rax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400318c0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
movsxd rcx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov ebx, eax
test eax, eax
js 0x1400318f8
movsxd rax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
movsxd rax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140031920
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
js 0x140031940
movsxd rax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
movsxd rax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140031960
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov ebx, eax
test eax, eax
js 0x140031998
movsxd rax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov rsi, rax
call dbg.socket_error
mov dword [rsi], eax
movsxd rax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x1400319c0
Capabilities:
Get hostname
Get memory capacity
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf0
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
pxor xmm0, xmm0
xor r9d, r9d
mov r8d, 1
mov rax, qword [rdi]
mov qword [rsp + 0xe8], rax
xor eax, eax
mov rbp, rdx
movaps xmmword [rsp + 0x40], xmm0
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
lea r12, [rsp + 0x40]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
movaps xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140031a98
call sym.getpid
lea rsi, [rsp + 0x60]
mov edx, pe_nt_image_headers64
lea r8, str._lld_n
mov rcx, rsi
movsxd r9, eax
call sym.__mingw_snprintf
mov rdx, rsi
xor r9d, r9d
mov rcx, rbx
mov r8d, eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
test esi, esi
je 0x140031ac8
mov rdx, qword [rsp + 0xe8]
sub rdx, qword [rdi]
jne 0x140031af4
add rsp, 0xf0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rax, str.Failed_to_create_PID_file
mov r8d, 0x247
mov rcx, rbp
mov qword [rsp + 0x20], rax
lea r9, global___func__.10
lea rdx, str..._util_oslib_win32.c
call dbg.error_setg_internal
xor eax, eax
jmp 0x140031a79
lea rax, str.Failed_to_write_PID_file
mov r8d, 0x24f
mov rcx, rbp
mov qword [rsp + 0x20], rax
lea r9, global___func__.10
lea rdx, str..._util_oslib_win32.c
call dbg.error_setg_internal
xor eax, eax
jmp 0x140031a79
call sym.__stack_chk_fail
nop
nop word [rax + rax]
Function at 0x140031b00
Capabilities:
Get hostname
Get memory capacity

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
lea rdi, [rsp + 0x40]
mov rbx, rcx
lea rdx, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x10
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
xor eax, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x140031b70
mov edx, dword [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], 0
call sym.g_utf16_to_utf8
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rsi]
jne 0x140031ba6
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, str.failed_close_handle
mov rcx, rbx
lea r9, global___func__.202
mov dword [rsp + 0x20], eax
mov r8d, 0x25b
lea rdx, str..._util_oslib_win32.c
mov qword [rsp + 0x28], rdi
call dbg.error_setg_win32_internal
xor eax, eax
jmp 0x140031b55
call sym.__stack_chk_fail
nop
nop dword [rax]

Function at 0x140031bb0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, eax
xor eax, eax
test edx, edx
je 0x140031be6
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rbx]
jne 0x140031bf6
add rsp, 0x70
pop rbx
ret
call sym.__stack_chk_fail
nop
nop
nop
nop
nop
Function at 0x1400393b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x34], r9d
movzx eax, byte [0x1400b4601]
test al, al
jne 0x1400393ed
call dbg.qsp_init__slowpath
lea rcx, [0x140083f60]
lea rbp, [rsp + 0x40]
call dbg.__emutls_get_address
lea rdx, [rsp + 0x20]
lea rdi, [0x1400b4620]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x20]
imul r8d, eax, 0x85ebca77
imul r10d, dword [rsp + 0x30], 0xc2b2ae3d
mov qword [rsp + 0x40], rax
shr rax, 0x20
imul r9d, edx, 0x85ebca77
shr rdx, 0x20
imul ecx, eax, 0x85ebca77
add r8d, 0x24234429
imul eax, edx, 0x85ebca77
rol r8d, 0xd
add r9d, 1
imul r8d, r8d, 0x9e3779b1
rol r9d, 0xd
sub ecx, 0x7a143588
add eax, 0x61c88650
imul edx, r9d, 0x9e3779b1
rol ecx, 0xd
rol eax, 0xd
imul ecx, ecx, 0x9e3779b1
rol r8d, 1
imul eax, eax, 0x9e3779b1
rol edx, 0xc
lea edx, [r10 + rdx + 0x1c]
rol ecx, 7
ror eax, 0xe
add eax, edx
mov rdx, rbp
add eax, r8d
imul r8d, dword [rsp + 0x34], 0xc2b2ae3d
add eax, ecx
mov rcx, rdi
ror eax, 0xf
imul eax, eax, 0x27d4eb2f
add r8d, eax
ror r8d, 0xf
imul r8d, r8d, 0x27d4eb2f
ror r8d, 0xf
imul r8d, r8d, 0x27d4eb2f
mov eax, r8d
shr eax, 0xf
xor r8d, eax
imul r8d, r8d, 0x85ebca77
mov eax, r8d
shr eax, 0xd
xor r8d, eax
imul r8d, r8d, 0xc2b2ae3d
mov eax, r8d
mov ebx, r8d
shr eax, 0x10
xor ebx, eax
mov r8d, ebx
call dbg.qht_lookup
test rax, rax
je 0x140039520
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rsi]
jne 0x140039530
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, ebx
mov rdx, rbp
mov rcx, rdi
call dbg.qsp_entry_create
jmp 0x140039503
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]
Function at 0x140039540
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r14d, 0x3b9aca00
lea r11, [rsp + 0x50]
mov r12, rdx
mov r13d, r8d
mov rbp, rcx
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rcx, r11
mov qword [rsp + 0x28], r11
lea rbx, [rsp + 0x30]
mov rdi, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea r15, [rsp + 0x40]
call rdi
mov rax, r14
mul qword [rsp + 0x50]
mov rcx, r15
mov r8, rax
mov rax, qword [0x14009ec30]
mov r9, rdx
mov edx, dword [rax]
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x30], rdx
mov rdx, rbx
mov qword [rsp + 0x38], 0
call dbg.__divti3
mov r8d, r13d
mov rdx, r12
mov rcx, rbp
movq rsi, xmm0
call dbg.qemu_mutex_lock_impl
mov rcx, qword [rsp + 0x28]
call rdi
mov rdi, qword [0x14009ec30]
mov rax, r14
mul qword [rsp + 0x50]
mov ecx, dword [rdi]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rdx
mov rdx, rbx
mov qword [rsp + 0x30], rcx
mov rcx, r15
mov qword [rsp + 0x40], rax
call dbg.__divti3
mov rdx, r12
xor r9d, r9d
mov r8d, r13d
mov rcx, rbp
movq rbx, xmm0
call dbg.qsp_entry_get
sub rbx, rsi
add rbx, qword [rax + 0x18]
mov qword [rax + 0x18], rbx
mov rsi, qword [rax + 0x10]
lea rdx, [rsi + 1]
mov qword [rax + 0x10], rdx
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsp + 0x58]
sub rax, qword [rsi]
jne 0x140039667
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.__stack_chk_fail
nop
nop dword [rax]
Function at 0x140039670
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov ebp, 0x3b9aca00
mov r15, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea r10, [rsp + 0x60]
mov rdi, r9
mov rsi, rcx
mov r12, rdx
mov rax, qword [rbx]
mov qword [rsp + 0x68], rax
xor eax, eax
mov rcx, r10
mov qword [rsp + 0x38], r10
lea r13, [rsp + 0x50]
mov dword [rsp + 0xd0], r8d
lea r14, [rsp + 0x40]
call r15
mov rbx, qword [0x14009ec30]
mov rax, rbp
mul qword [rsp + 0x60]
mov ecx, dword [rbx]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], rdx
mov rdx, r14
mov qword [rsp + 0x40], rcx
mov rcx, r13
mov qword [rsp + 0x50], rax
call dbg.__divti3
mov r9, rdi
mov rdx, r12
mov rcx, rsi
mov eax, dword [rsp + 0xe0]
mov r8d, dword [rsp + 0xd0]
movq rbx, xmm0
mov dword [rsp + 0x20], eax
call dbg.qemu_cond_timedwait_impl
mov rcx, qword [rsp + 0x38]
mov r12d, eax
call r15
mov rcx, qword [0x14009ec30]
mov rax, rbp
mul qword [rsp + 0x60]
mov ecx, dword [rcx]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], rdx
mov rdx, r14
mov qword [rsp + 0x40], rcx
mov rcx, r13
mov qword [rsp + 0x50], rax
call dbg.__divti3
mov r8d, dword [rsp + 0xe0]
mov rdx, rdi
mov rcx, rsi
mov r9d, 3
movq rbp, xmm0
call dbg.qsp_entry_get
sub rbp, rbx
add rbp, qword [rax + 0x18]
mov qword [rax + 0x18], rbp
mov rsi, qword [rax + 0x10]
lea rdx, [rsi + 1]
mov qword [rax + 0x10], rdx
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsp + 0x68]
sub rax, qword [rdi]
jne 0x1400397bb
mov eax, r12d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400397d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r12d, 0x3b9aca00
mov r13, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea r11, [rsp + 0x50]
mov rdi, r8
mov rsi, rcx
mov ebp, r9d
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rcx, r11
mov qword [rsp + 0x28], r11
lea r14, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
lea r15, [rsp + 0x30]
call r13
mov rax, r12
mul qword [rsp + 0x50]
mov rcx, rax
mov rax, qword [0x14009ec30]
mov rbx, rdx
mov edx, dword [rax]
mov qword [rsp + 0x40], rcx
mov rcx, r14
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rdx
mov rdx, r15
mov qword [rsp + 0x38], 0
call dbg.__divti3
mov rdx, qword [rsp + 0x20]
mov r8, rdi
mov r9d, ebp
mov rcx, rsi
movq rbx, xmm0
call dbg.qemu_cond_wait_impl
mov rcx, qword [rsp + 0x28]
call r13
mov rcx, qword [0x14009ec30]
mov rax, r12
mul qword [rsp + 0x50]
mov ecx, dword [rcx]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rdx
mov rdx, r15
mov qword [rsp + 0x30], rcx
mov rcx, r14
mov qword [rsp + 0x40], rax
call dbg.__divti3
mov rdx, rdi
mov rcx, rsi
mov r8d, ebp
mov r9d, 3
movq r12, xmm0
call dbg.qsp_entry_get
sub r12, rbx
add r12, qword [rax + 0x18]
mov qword [rax + 0x18], r12
mov rsi, qword [rax + 0x10]
lea rdx, [rsi + 1]
mov qword [rax + 0x10], rdx
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsp + 0x58]
sub rax, qword [rdi]
jne 0x140039906
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.__stack_chk_fail
nop
nop dword [rax]