joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011c6e0
Capabilities:
Resolve dns

Disassembly:
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14011c70f
nop dword [rax]
cmp dword [rcx], edx
je 0x14011c703
ja 0x14011c70f
mov rcx, qword [rcx + 0x268]
test rcx, rcx
jne 0x14011c6f0
ret
lea rdx, [rcx + 0x280]
jmp fcn.14011c340
ret

Function at 0x140120ef0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebx, edx
mov rcx, qword [0x14024c908]
test rcx, rcx
jne 0x140120f38
xor r9d, r9d
lea rdx, [0x1401b5220]
xor r8d, r8d
lea rcx, [0x14024c908]
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jns 0x140120f31
lea r8, str.BCryptOpenAlgorithmProvider__:__ld
jmp 0x140120f61
mov rcx, qword [0x14024c908]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x140120f5a
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea r8, str.BCryptGenRandom__:__ld
mov r9d, eax
lea rdx, str.mongoc
xor ecx, ecx
call fcn.1400cf640
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140124560
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov rsi, rdx
test r8, r8
je 0x1401246de
lea r14, [0x1401bafc0]
cmp rdx, 2
jbe 0x140124629
lea r10d, [rbx + 4]
nop dword [rax + rax]
movzx edx, byte [rcx + 1]
sub rsi, 3
movzx r11d, byte [rcx]
movzx eax, dl
movzx r9d, byte [rcx + 2]
and dl, 0xf
shr al, 4
movzx r8d, r11b
and r8b, 3
shl dl, 2
shl r8b, 4
add rcx, 3
add r8b, al
movzx eax, r9b
shr al, 6
add dl, al
cmp r10, rbp
ja 0x1401246de
and r9d, 0x3f
mov eax, r11d
shr rax, 2
add r10, 4
movzx eax, byte [rax + r14]
mov byte [rbx + rdi], al
movzx eax, r8b
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 1], al
movzx eax, dl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 2], al
movzx eax, byte [r9 + r14]
mov byte [rbx + rdi + 3], al
add rbx, 4
cmp rsi, 2
ja 0x1401245a0
test rsi, rsi
je 0x1401246d1
xor r8b, r8b
mov word [rsp + 0x51], 0
xor r9b, r9b
mov byte [rsp + 0x50], r8b
xor dl, dl
test rsi, rsi
je 0x14012466c
mov rdx, rcx
mov r8, rsi
lea rcx, [rsp + 0x50]
call fcn.140146140
movzx r9d, byte [rsp + 0x52]
movzx edx, byte [rsp + 0x51]
movzx r8d, byte [rsp + 0x50]
movzx eax, dl
shr r9b, 6
movzx ecx, r8b
shr al, 4
and r8b, 3
shr cl, 2
and dl, 0xf
shl r8b, 4
shl dl, 2
add r8b, al
lea rax, [rbx + 4]
add dl, r9b
cmp rax, rbp
ja 0x1401246de
movzx eax, cl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi], al
movzx eax, r8b
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 1], al
cmp rsi, 1
jne 0x1401246bc
mov al, 0x3d
jmp 0x1401246c4
movzx eax, dl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 2], al
mov byte [rbx + rdi + 3], 0x3d
add rbx, 4
cmp rbx, rbp
jae 0x1401246de
mov byte [rbx + rdi], 0
mov eax, ebx
jmp 0x1401246e3
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140127f60
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r10, r8
mov r11, rdx
mov r9d, eax
test r8, r8
je 0x140127f98
sub r11, rcx
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r11 + rcx]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or r9d, r8d
sub r10, 1
jne 0x140127f80
test r9d, r9d
setne al
ret

Function at 0x14012b820
Capabilities:
Decrypt data via sspi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x80
mov rax, qword [0x14023c9c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r9, qword [rcx + 0x40]
xor ebp, ebp
mov rbx, rcx
mov esi, ebp
test r9, r9
je 0x14012b9b0
mov qword [rsp + 0x98], rdi
nop dword [rax]
test esi, esi
jne 0x14012b9a8
mov r8, qword [rbx + 0x50]
lea edx, [rsi + 1]
lea rcx, [rsp + 0x30]
call fcn.14012e3f0
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call fcn.14012e3f0
xor r9d, r9d
lea rcx, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call fcn.14012e3f0
xor r9d, r9d
lea rcx, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call fcn.14012e3f0
lea r8d, [rsi + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14012e400
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
call sub.Secur32.dll_DecryptMessage
mov esi, eax
test eax, eax
je 0x14012b901
cmp eax, 0x90321
je 0x14012b901
cmp eax, 0x90317
je 0x14012b901
cmp eax, 0x80090318
je 0x14012b998
mov dword [rbx + 0x68], 1
jmp 0x14012b998
cmp dword [rsp + 0x44], 1
jne 0x14012b947
mov rax, qword [rbx + 0x38]
lea rcx, [rbx + 0x38]
sub rax, qword [rbx + 0x48]
mov edi, dword [rsp + 0x40]
cmp rax, rdi
jae 0x14012b929
lea rdx, [rbx + 0x58]
mov r8d, edi
call fcn.14012ee80
test rdi, rdi
je 0x14012b947
mov rcx, qword [rbx + 0x58]
mov r8, rdi
add rcx, qword [rbx + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140146140
add qword [rbx + 0x48], rdi
cmp dword [rsp + 0x64], 5
jne 0x14012b97e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14012b97e
mov r8d, eax
mov rax, qword [rbx + 0x40]
cmp rax, r8
jbe 0x14012b982
mov rcx, qword [rbx + 0x50]
mov rdx, rcx
sub rdx, r8
add rdx, rax
call fcn.140146140
mov eax, dword [rsp + 0x60]
mov qword [rbx + 0x40], rax
jmp 0x14012b982
mov qword [rbx + 0x40], rbp
cmp esi, 0x90317
jne 0x14012b998
mov byte [rbx + 0x6c], 1
cmp byte [rbx + 0x6d], bpl
jne 0x14012b998
mov byte [rbx + 0x6d], 1
mov rax, qword [rbx + 0x40]
mov r9d, eax
test rax, rax
jne 0x14012b860
mov rdi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140088190
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x14012c0e0
Capabilities:
Encrypt data via sspi

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x98
mov rax, qword [0x14023c9c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, qword [rcx + 0x88]
mov rdi, r8
mov r15, rdx
mov rbp, rcx
test rbx, rbx
je 0x14012c272
cmp dword [rbx + 0x20], 0
mov qword [rsp + 0xd8], rsi
jne 0x14012c148
mov rcx, qword [rbx + 0x10]
lea r8, [rbx + 0x18]
mov edx, 4
call sub.Secur32.dll_QueryContextAttributesA
test eax, eax
je 0x14012c148
mov rax, 0xffffffffffffffff
jmp 0x14012c24d
mov eax, dword [rbx + 0x20]
mov ecx, dword [rbx + 0x1c]
cmp rdi, rax
mov qword [rsp + 0x90], r14
cmova rdi, rax
mov eax, dword [rbx + 0x18]
add rax, rdi
add rcx, rax
call fcn.1400c5f80
mov r9d, dword [rbx + 0x18]
lea rcx, [rsp + 0x40]
mov r8, rax
mov edx, 7
mov r14, rax
call fcn.14012e3f0
mov r8d, dword [rbx + 0x18]
lea rcx, [rsp + 0x50]
add r8, r14
mov r9d, edi
mov edx, 1
call fcn.14012e3f0
mov r8d, dword [rbx + 0x18]
lea rcx, [rsp + 0x60]
mov r9d, dword [rbx + 0x1c]
add r8, rdi
add r8, r14
mov edx, 6
call fcn.14012e3f0
xor r9d, r9d
lea rcx, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
call fcn.14012e3f0
mov r8d, 4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14012e400
mov rcx, qword [rsp + 0x58]
mov r8, rdi
mov rdx, r15
call fcn.140146140
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
call sub.Secur32.dll_EncryptMessage
test eax, eax
jne 0x14012c22a
mov r8d, dword [rsp + 0x60]
mov rdx, r14
add r8d, dword [rsp + 0x40]
mov rcx, rbp
add r8d, dword [rsp + 0x50]
mov edi, r8d
call fcn.14012f7b0
mov rbx, rax
jmp 0x14012c231
mov rbx, 0xffffffffffffffff
mov rcx, r14
call fcn.1400c5f70
mov r14, qword [rsp + 0x90]
cmp rdi, rbx
jne 0x14012c24a
mov ebx, dword [rsp + 0x50]
mov rax, rbx
mov rsi, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140088190
add rsp, 0x98
pop r15
pop rdi
pop rbp
pop rbx
ret
mov ecx, 2
call fcn.14008fab0
mov rcx, rax
lea r8, str.C:Userslxrs_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_stream_tls_secure_channel.c
lea rax, str.secure_channel
mov r9d, 0xfc
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str._mongoc_stream_tls_secure_channel_write
mov qword [rsp + 0x20], rax
call fcn.140009138
call fcn.14009594c
int3
Function at 0x140133d90
Capabilities:
Get outbound credentials handle via credssp

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rbx, qword [rsp + 0xd0]
xor r14d, r14d
mov esi, r9d
mov rdi, r8
mov qword [rbx + 0x58], r14
mov qword [rbx + 0x60], r14
mov dword [rbx + 0x70], 0x80000001
mov dword [rbx + 0x68], edx
mov word [rbx + 0x6c], r14w
call fcn.1400959b4
mov qword [rbx + 0x50], rax
test rax, rax
je 0x140133eb9
mov qword [rsp + 0x90], rbp
mov rcx, rax
mov ebp, 0x2f
mov edx, ebp
call fcn.14008a608
test rax, rax
jne 0x140133e12
mov rcx, qword [rbx + 0x50]
lea edx, [rbp + 0x11]
call fcn.14008a608
test rax, rax
je 0x140133e12
mov word [rax], bp
mov rdx, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0x90]
test rdi, rdi
je 0x140133e60
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x7c], 2
test rdx, rdx
lea rax, [rbx + 0x30]
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x50]
cmove rcx, r14
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rdx, str.kerberos
mov qword [rsp + 0x20], rcx
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
test eax, eax
je 0x140133ec0
lea rdx, str.AcquireCredentialsHandle
mov ecx, eax
call fcn.1401348a0
mov eax, 0xffffffff
jmp 0x140133ec9
mov byte [rbx + 0x6c], 1
mov eax, 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x140134200
Capabilities:
Decrypt data via sspi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov dword [rsp + 0x24], 2
mov rdi, rcx
mov dword [rsp + 0x20], ebp
mov rcx, qword [rcx + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rbx, rdx
test rcx, rcx
je 0x14013424b
call fcn.1400c5f70
mov qword [rdi + 0x58], rbp
mov dword [rdi + 0x70], 0x80000001
cmp byte [rdi + 0x6d], bpl
je 0x1401342ea
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140134730
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1401342ea
mov eax, dword [rsp + 0x60]
lea rcx, [rdi + 0x40]
mov ebx, 1
mov dword [rsp + 0x30], eax
lea r9, [rdi + 0x70]
mov dword [rsp + 0x44], ebx
xor r8d, r8d
mov dword [rsp + 0x34], 0xa
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], ebp
call sub.Secur32.dll_DecryptMessage
test eax, eax
jne 0x1401342c4
mov edx, dword [rsp + 0x40]
test edx, edx
je 0x1401342d7
mov rcx, qword [rsp + 0x48]
call fcn.1401347f0
mov qword [rdi + 0x58], rax
test rax, rax
jne 0x1401342d7
jmp 0x1401342d2
lea rdx, [0x14015bc98]
mov ecx, eax
call fcn.1401348a0
mov ebx, 0xffffffff
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1401342e6
call fcn.1400c5f70
mov eax, ebx
jmp 0x1401342ef
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1401347f0
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor r9d, r9d
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x14013486f
mov ecx, dword [rsp + 0x50]
call fcn.1400c5f80
mov rbx, rax
test rax, rax
je 0x14013486f
lea rax, [rsp + 0x50]
mov r9, rbx
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x140134867
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.1400c5f70
lea r9, str.CryptBinaryToString_failed.
xor ecx, ecx
lea r8, [0x14014d924]
lea rdx, str.mongoc
call fcn.1400cf640
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401394d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401394f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401394f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001070
Capabilities:
Check for outputdebugstring error
Check for peb beingdebugged flag
Patch process command line
Print debug messages

Disassembly:
sub rsp, 0x88
mov rax, qword [0x18025b018]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x18000119d
test byte [rax + 0xbc], 0x70
jne 0x18000119d
mov ecx, 0x457
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [0x180250344]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x457
jne 0x18000119d
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x80], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.ntdll.dll
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1800010fd
xor edi, edi
jmp 0x180001110
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rbx, rax
xor edx, edx
lea rax, [rsp + 0x68]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call rdi
mov rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x70]
add rdx, 0x50
mov qword [rsp + 0x60], 0xffffffffffffffff
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test byte [rsp + 0x60], 4
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x90]
jne 0x18000119d
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180243c50
add rsp, 0x88
ret
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180243c50
add rsp, 0x88
ret
Function at 0x1802461e4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1802460bb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1802460bb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1802460bb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1802460bb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1802460bb
cmp dword [rcx + 0x84], 0xe
jbe 0x1802460bb
cmp dword [rcx + 0xf8], 0
je 0x1802460bb
mov ecx, ebx
call fcn.18024615c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180245f4c
cmp dword [rbp + 0x20], 0
je 0x180246108
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180246110
int3
xor r8d, r8d
xor edx, edx
jmp 0x180246054
Function at 0x4163c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41654b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005d9078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416425
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416434
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416453
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416463
cmp rbx, 0x1000
jae 0x41642b
jmp 0x4164cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416475
xor edx, edx
jmp 0x4164c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005d9078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416459
jmp 0x416448
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005d9078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004b46dd]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004b4a45]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004b68b2]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x416580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4167a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005d9078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4165f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416602
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416625
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416635
cmp rbx, 0x1000
jae 0x4165f9
nop
jmp 0x4166b8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41664d
xor esi, esi
jmp 0x4166aa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005d9078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41662b
jmp 0x416616
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005d9078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416740
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004b4a5e]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004b4a45]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004b1dc8]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4166e0
call sym.runtime.printlock
lea rax, [0x004b4a5e]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004b4a45]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004b6153]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x420580
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005d8e72], 0
jne 0x420670
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x420663
lea rsi, [0x0056af78]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x42063e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x004b871c]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x422ac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422bc6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x422b03
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x422bbb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x422bbb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005d9078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x422ba9
xor eax, eax
jmp 0x422bb3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x422af1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge