joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4117c0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411917
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rsp + 0x30], ecx
test rbx, rbx
je 0x4118a2
cmp qword [rbx], 0
je 0x4118a2
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
movzx ecx, byte [rbx + 8]
test cl, 4
je 0x411817
lea rax, [0x005194c5]
mov ebx, 0x21
call sym.runtime.fatal
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
cmp byte [rbx + 9], 0
jne 0x411826
mov rcx, qword [rbx + 0x10]
jmp 0x4118c0
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
mov r9, qword [rcx + 0x18]
mov rdx, rcx
mov ecx, esi
mov r10d, 1
shl r10, cl
lea rcx, [r10 - 1]
mov rsi, rcx
and rcx, rax
imul rcx, r8
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x41189c
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x411882
shr rsi, 1
and rsi, rax
imul rsi, r8
movzx edx, byte [r9 + rsi]
add edx, 0xfffffffe
add rsi, r9
cmp dl, 3
jb 0x41189c
mov rcx, rsi
mov rax, rdi
nop
jmp 0x4118c0
lea rax, [0x00683e60]
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
mov rcx, qword [rdx]
test rcx, rcx
je 0x4118ce
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x4118e4
lea rax, [0x00683e60]
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x4118b1
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x4118dd
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x4118dd
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x28]
mov ebx, 1
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp sym.runtime.mapaccess2_fast32
Function at 0x4120c0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41221f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x30], rcx
nop word [rax + rax]
test rbx, rbx
je 0x4121b1
cmp qword [rbx], 0
je 0x4121b1
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
movzx ecx, byte [rbx + 8]
test cl, 4
je 0x412121
lea rax, [0x005194c5]
mov ebx, 0x21
call sym.runtime.fatal
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
cmp byte [rbx + 9], 0
jne 0x412130
mov rcx, qword [rbx + 0x10]
jmp 0x4121cd
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
mov r9, qword [rcx + 0x18]
mov rdx, rcx
mov ecx, esi
mov r10d, 1
shl r10, cl
lea rcx, [r10 - 1]
mov rsi, rcx
and rcx, rax
imul rcx, r8
add rcx, qword [rdx + 0x10]
nop dword [rax + rax]
test r9, r9
je 0x4121ac
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x412191
shr rsi, 1
and rsi, rax
imul r8, rsi
movzx edx, byte [r9 + r8]
add edx, 0xfffffffe
lea rbx, [r9 + r8]
cmp dl, 3
jb 0x4121ac
mov rcx, rbx
mov rax, rdi
jmp 0x4121cd
lea rax, [0x00683e60]
add rsp, 0x10
pop rbp
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
mov rcx, qword [rdx]
test rcx, rcx
je 0x4121db
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x4121ef
lea rax, [0x00683e60]
add rsp, 0x10
pop rbp
ret
inc rbx
add rdx, 8
cmp rbx, 8
jae 0x4121be
mov rsi, qword [rdx]
cmp qword [rsp + 0x30], rsi
jne 0x4121e8
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x4121e8
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x48]
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.mapaccess1_fast64
Function at 0x412260
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4123cc
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x30], rcx
nop word [rax + rax]
test rbx, rbx
je 0x412350
cmp qword [rbx], 0
je 0x412350
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
movzx ecx, byte [rbx + 8]
test cl, 4
je 0x4122c1
lea rax, [0x005194c5]
mov ebx, 0x21
call sym.runtime.fatal
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
cmp byte [rbx + 9], 0
jne 0x4122d0
mov rcx, qword [rbx + 0x10]
jmp 0x41236e
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
mov r9, qword [rcx + 0x18]
mov rdx, rcx
mov ecx, esi
mov r10d, 1
shl r10, cl
lea rcx, [r10 - 1]
mov rsi, rcx
and rcx, rax
imul rcx, r8
add rcx, qword [rdx + 0x10]
nop dword [rax + rax]
test r9, r9
je 0x41234b
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x412331
shr rsi, 1
and rsi, rax
imul rsi, r8
movzx edx, byte [r9 + rsi]
add edx, 0xfffffffe
add rsi, r9
cmp dl, 3
jb 0x41234b
mov rcx, rsi
mov rax, rdi
jmp 0x41236e
lea rax, [0x00683e60]
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
mov rcx, qword [rdx]
test rcx, rcx
je 0x41237c
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x412392
lea rax, [0x00683e60]
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
inc rbx
add rdx, 8
cmp rbx, 8
jae 0x41235f
mov rsi, qword [rdx]
nop dword [rax + rax]
cmp qword [rsp + 0x30], rsi
jne 0x41238b
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x41238b
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x48]
mov ebx, 1
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.mapaccess2_fast64
Function at 0x414440
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414645
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
call sym.runtime.printlock
call sym.runtime.printlock
lea rax, [0x005132d3]
mov ebx, 0x11
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x58]
call sym.runtime.printhex
call sym.runtime.printunlock
mov rax, qword [rsp + 0x50]
nop dword [rax]
test rax, rax
je 0x41456a
nop
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x414620
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x005146b2]
mov ebx, 0x14
call sym.runtime.printstring
call sym.runtime.printunlock
movzx eax, byte [rsp + 0x27]
movzx eax, al
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x70]
mov qword [rsp + 0x30], rdx
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x28], rcx
nop
call sym.runtime.printlock
lea rax, [0x00511eef]
mov ebx, 0xd
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call sym.runtime.printhex
lea rax, [0x00511a38]
mov ebx, 0xc
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call sym.runtime.printhex
lea rax, [0x00511a44]
mov ebx, 0xc
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call sym.runtime.printuint
call sym.runtime.printunlock
call sym.runtime.printlock
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x60]
nop
test rax, rax
jne 0x4145a5
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf1], 2
lea rax, [0x0051d2ba]
mov ebx, 0x3e
nop dword [rax]
call sym.runtime.throw
call sym.runtime.printlock
lea rax, [0x005184f7]
mov ebx, 0x1e
call sym.runtime.printstring
mov rax, qword [rsp + 0x60]
call sym.runtime.printhex
lea rax, [0x005102da]
mov ebx, 1
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printhex
lea rax, [0x0051032a]
mov ebx, 2
call sym.runtime.printstring
call sym.runtime.printunlock
lea rax, [0x0051074b]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
call sym.runtime.gcDumpObject
jmp 0x414585
call sym.runtime.printlock
lea rax, [0x005166a2]
mov ebx, 0x19
call sym.runtime.printstring
call sym.runtime.printunlock
nop dword [rax + rax]
jmp 0x4144db
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime.badPointer
Function at 0x414ba0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414c52
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
shr rbx, 3
lea rdx, [rbx + 7]
shr rdx, 3
mov qword [rsp + 0x20], rdx
lea rsi, [rdx + 1]
mov qword [rsp + 0x18], rsi
mov ebx, 1
lea rcx, [0x00685830]
mov rax, rsi
call sym.runtime.persistentalloc
mov rcx, qword [rsp + 0x18]
cmp rcx, 0x40000000
ja 0x414c47
mov rdx, qword [rsp + 0x20]
cmp rdx, rcx
jae 0x414c3f
mov qword [rsp + 0x28], rax
test byte [rax], al
mov byte [rdx + rax], 0xa1
mov rbx, rax
mov rax, qword [rsp + 0x40]
call sym.runtime.runGCProg
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + rbx]
cmp cl, 0xa1
jne 0x414c2e
add rsp, 0x30
pop rbp
ret
lea rax, [0x0051733b]
mov ebx, 0x1b
call sym.runtime.throw
mov rax, rdx
call sym.runtime.panicIndex
mov edx, 0x40000000
call sym.runtime.panicSliceAlenU
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.progToPointerMask
Function at 0x415e60
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415fdb
push rbp
mov rbp, rsp
sub rsp, 0x48
test rdi, rdi
je 0x415fac
movzx edx, byte [rcx + 0x17]
nop
test dl, 0x40
je 0x415f8b
movzx edx, byte [rsi + 0x62]
shr dl, 1
test dl, dl
jne 0x415fc9
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rsi
mov rax, qword [rcx + 8]
shr rax, 6
add rax, 7
and rax, 0xfffffffffffffff8
add rax, 0x202f
and rax, 0xffffffffffffe000
shr rax, 0xd
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
mov qword [rsp + 0x40], 0
lea rdx, [sym.runtime.heapSetType.func1]
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + 0x18]
add rdx, 0x30
cmp dword [0x00682e70], 0
je 0x415f5b
call sym.runtime.gcWriteBarrier2
mov qword [r11], rdx
mov rsi, qword [rax + 0x20]
mov qword [r11 + 8], rsi
mov qword [rsp + 0x28], rax
mov qword [rax + 0x20], rdx
mov byte [rax + 0x14], 0x10
mov rcx, qword [rcx + 0x20]
mov rbx, qword [rax + 0x20]
add rcx, 4
mov rax, rcx
call sym.runtime.runGCProg
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
cmp dword [0x00682e70], 0
je 0x415fa3
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rdx, qword [rdi]
mov qword [r11 + 8], rdx
mov qword [rdi], rcx
mov rcx, qword [rsi + 0x68]
jmp 0x415fc0
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, rsi
call sym.runtime._mspan_.writeHeapBitsSmall
mov rcx, rax
mov rax, rcx
add rsp, 0x48
pop rbp
ret
lea rax, [0x00518f75]
mov ebx, 0x20
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp sym.runtime.heapSetType
Function at 0x416800
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4168bc
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [0x00614c60]
mov edx, dword [rax + 0x488]
nop
cmp edx, ecx
je 0x416856
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x41685c
mov qword [rsp + 0x28], rax
call sym.runtime._mcache_.releaseAll
mov rax, qword [rsp + 0x28]
call sym.runtime.stackcache_clear
mov ecx, dword [0x00614c60]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
add rsp, 0x18
pop rbp
ret
add rsp, 0x18
pop rbp
ret
mov dword [rsp + 0x14], ecx
mov dword [rsp + 0x10], edx
call sym.runtime.printlock
lea rax, [0x00511efc]
mov ebx, 0xd
call sym.runtime.printstring
mov eax, dword [rsp + 0x10]
mov eax, eax
call sym.runtime.printuint
lea rax, [0x00518515]
mov ebx, 0x1e
call sym.runtime.printstring
mov eax, dword [rsp + 0x14]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00511a50]
mov ebx, 0xc
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime._mcache_.prepareForSweep
Function at 0x4170a0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417246
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x48], rdi
movzx edx, byte [rdi]
nop word [rax + rax]
test dl, sil
je 0x417152
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
nop
cmp rdx, 0x40
jae 0x417145
lea rsi, [0x00614cf8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx esi, ax
shr rcx, 0x16
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x10c0]
test byte [rdx], al
add rdx, rsi
mov bl, byte [rdx]
test dil, bl
je 0x417139
mov eax, 1
add rsp, 0x20
pop rbp
ret
lock or byte [rdx], dil
xor eax, eax
add rsp, 0x20
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
call sym.runtime.printlock
call sym.runtime.printlock
lea rax, [0x0051d029]
mov ebx, 0x39
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
call sym.runtime.printlock
lea rax, [0x0051603d]
mov ebx, 0x18
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printhex
lea rax, [0x005102da]
mov ebx, 1
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x40]
call sym.runtime.printhex
lea rax, [0x0051032a]
mov ebx, 2
nop dword [rax + rax]
call sym.runtime.printstring
call sym.runtime.printunlock
lea rax, [0x00510534]
mov ebx, 4
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
call sym.runtime.gcDumpObject
lea rax, [0x0051037b]
mov ebx, 3
mov rcx, qword [rsp + 0x30]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call sym.runtime.gcDumpObject
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf1], 2
lea rax, [0x00518b26]
mov ebx, 0x1f
nop dword [rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp sym.runtime.setCheckmark
Function at 0x4173a0
Capabilities:
Access peb ldr_data
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41752b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417405
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417414
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417433
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417443
cmp rbx, 0x1000
jae 0x41740b
jmp 0x4174ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417455
xor edx, edx
jmp 0x4174a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417439
jmp 0x417428
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00516055]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005166bb]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005194e6]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x417560
Capabilities:
Access peb ldr_data
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417786
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4175d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4175e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417605
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417615
cmp rbx, 0x1000
jae 0x4175d9
nop
jmp 0x417698
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41762d
xor esi, esi
jmp 0x41768a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41760b
jmp 0x4175f6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417720
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x005166d4]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x005166bb]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00511ebb]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4176c0
call sym.runtime.printlock
lea rax, [0x005166d4]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005166bb]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00518b45]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x4177c0
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x48], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x417814
add rsp, 0x30
pop rbp
ret
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call sym.runtime.printlock
lea rax, [0x00516055]
mov ebx, 0x18
call sym.runtime.printstring
mov rax, qword [rsp + 0x48]
call sym.runtime.printuint
lea rax, [0x005166bb]
mov ebx, 0x19
nop
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00518f95]
mov ebx, 0x20
call sym.runtime.throw
nop
int3
Function at 0x41a180
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41a247
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp rbx, 0x4000
ja 0x41a235
cmp rbx, 8
mov edx, 8
cmovb rbx, rdx
mov qword [rax], rbx
cmp dword [0x00682e70], 0
je 0x41a1d4
call sym.runtime.gcWriteBarrier4
mov qword [r11], rcx
mov rdx, qword [rax + 8]
mov qword [r11 + 8], rdx
mov qword [r11 + 0x10], rdi
mov rdx, qword [rax + 0x10]
mov qword [r11 + 0x18], rdx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdi
movups xmmword [rax + 0x18], xmm15
mov dword [rax + 0x28], 0
test rbx, rbx
je 0x41a230
mov rcx, rax
mov eax, 0x4000
xor edx, edx
div rbx
imul rax, rbx
mov dword [rcx + 0x2c], eax
mov qword [rcx + 0x30], 0
cmp dword [0x00682e70], 0
je 0x41a222
call sym.runtime.gcWriteBarrier2
mov qword [r11], rsi
mov rax, qword [rcx + 0x38]
mov qword [r11 + 8], rax
mov qword [rcx + 0x38], rsi
mov byte [rcx + 0x40], 1
add rsp, 0x10
pop rbp
ret
call sym.runtime.panicdivide
lea rax, [0x00518fb5]
mov ebx, 0x20
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp sym.runtime._fixalloc_.init