joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140268800
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov r14, r9
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea r15, [rsp + 0xb0]
mov r8d, SysStringByteLen
mov rcx, r15
mov dl, 0xaa
call fcn.140235e90
mov rcx, r15
call fcn.140172a40
mov dword [r15 + 0x80], 0x80
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
je 0x140268a7d
cmp byte [rsi + 0x10c], 1
jne 0x14026892c
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov r8, qword [rdi + 0x10]
mov qword [rdx + 8], r8
mov dword [rdx], ebx
lea r9, [rsp + 0x90]
mov qword [r9 + 0x10], rax
movaps xmm0, xmmword [0x1402825c0]
movaps xmmword [r9], xmm0
lea r15, [rsp + 0x50]
movups xmmword [r15 + 0x28], xmm0
movups xmmword [r15 + 0x18], xmm0
movups xmmword [r15 + 8], xmm0
lea r8, [rsp + 0x3c]
mov dword [r8], 0xaaaaaaaa
mov rax, qword [rsp + 0x138]
mov qword [r15], rax
mov dword [r15 + 8], 0x80
mov qword [r15 + 0x10], rdx
mov dword [r15 + 0x18], 1
mov qword [r15 + 0x28], r9
mov dword [r15 + 0x30], 0
mov dword [r15 + 0x20], 0x18
mov rax, qword [rsi + 0x110]
mov qword [rsp + 0x20], 0
mov rdx, r15
xor r9d, r9d
call qword [0x14030c820]
mov ebp, eax
mov rcx, rsi
mov rdx, r15
call fcn.140268d60
test ebp, ebp
jne 0x140268954
mov ebp, dword [rsp + 0x3c]
jmp 0x140268954
lea rax, [rsp + 0x130]
mov r8, qword [rax + 8]
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recvfrom]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1402689e1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1402689c6
test rdi, rdi
je 0x140268984
mov eax, 1
lock xadd dword [rdi + 8], eax
cmp eax, 0x7fffffff
je 0x140268a80
mov rcx, qword [rsi + 0xa8]
mov qword [rsi + 0xa8], rdi
test rcx, rcx
je 0x1402689ae
lock dec dword [rcx + 8]
jne 0x1402689ae
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x14030c820]
mov dword [rsi + 0xb8], ebx
mov rcx, rsi
call fcn.1402692d0
mov ebp, 0xffffffff
jmp 0x140268a5b
mov ecx, eax
call fcn.140172b60
mov ebp, eax
mov rcx, rsi
mov edx, eax
xor r8d, r8d
xor r9d, r9d
call fcn.140268d00
jmp 0x140268a5b
movaps xmm0, xmmword [0x1402825c0]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
mov dword [rcx + 0x10], 0xaaaaaaaa
call fcn.1401c2010
test ebp, ebp
js 0x140268a3e
mov r8d, dword [rsp + 0x130]
mov rdx, qword [rsp + 0x138]
lea rbx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400734c0
test al, al
je 0x140268a39
test r14, r14
je 0x140268a40
mov eax, dword [rsp + 0x60]
mov dword [r14 + 0x10], eax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [r14], xmm0
jmp 0x140268a40
mov ebp, 0xffffff94
xor ebx, ebx
mov r8, qword [rdi + 0x10]
mov rcx, rsi
mov edx, ebp
mov r9, rbx
call fcn.140268d00
lea rcx, [rsp + 0x50]
call fcn.1401c2000
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401f08b0
mov eax, ebp
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
int3
int3
Function at 0x140268a90
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov r14, r9
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea r15, [rsp + 0xa0]
mov r8d, SysStringByteLen
mov rcx, r15
mov dl, 0xaa
call fcn.140235e90
mov rcx, r15
call fcn.140172a40
test r14, r14
je 0x140268b3e
lea r8, [rsp + 0x120]
mov r15, qword [r8 + 8]
mov rcx, r14
mov rdx, r15
call fcn.140073450
test al, al
jne 0x140268b4c
add rsi, 0xe0
mov ebp, 0xffffff94
mov rcx, rsi
mov edx, 0x5c
mov r8d, 0xffffff94
call fcn.1400731c0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401f08b0
mov eax, ebp
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rsp + 0x120], 0
xor r15d, r15d
mov eax, dword [rsi + 0x120]
test eax, eax
jne 0x140268c17
mov eax, dword [rsp + 0x120]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rsi + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x140268b98
mov r8, qword [rbx + 0x10]
mov rcx, rsi
mov edx, ebp
mov r9, r14
call fcn.140268dd0
jmp 0x140268b1c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140268bbb
mov ecx, eax
call fcn.140172b60
mov ebp, eax
mov rcx, rsi
mov edx, eax
xor r8d, r8d
xor r9d, r9d
jmp 0x140268b91
test rbx, rbx
je 0x140268bd5
mov eax, 1
lock xadd dword [rbx + 8], eax
cmp eax, 0x7fffffff
je 0x140268cee
mov rcx, qword [rsi + 0xb0]
mov qword [rsi + 0xb0], rbx
test rcx, rcx
je 0x140268bff
lock dec dword [rcx + 8]
jne 0x140268bff
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x14030c820]
mov dword [rsi + 0xbc], edi
mov rcx, rsi
call fcn.1402692d0
mov ebp, 0xffffffff
jmp 0x140268b1c
movabs rdx, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x10], rdx
lea r8, [rsp + 0x70]
mov qword [r8], rdx
mov rdx, qword [rbx + 0x10]
mov qword [r8 + 8], rdx
mov dword [r8], edi
movaps xmm0, xmmword [0x1402825c0]
lea rdx, [rsp + 0x38]
movups xmmword [rdx + 0x28], xmm0
movups xmmword [rdx + 0x18], xmm0
movups xmmword [rdx + 8], xmm0
lea r9, [rsp + 0x34]
mov dword [r9], 0xaaaaaaaa
mov r10d, dword [rsi + 0x10]
mov r11, qword [rsp + 0x128]
mov qword [rdx], r11
mov r11d, dword [rsp + 0x120]
mov dword [rdx + 8], r11d
mov qword [rdx + 0x10], r8
mov dword [rdx + 0x18], 1
mov qword [rdx + 0x28], rcx
xor r8d, r8d
mov dword [rdx + 0x30], r8d
cmp r10d, 0x17
mov dword [rdx + 0x20], 0x18
mov qword [rcx], reloc.WS2_32.dll_sendto
mov r10d, 0x29
cmovne r10d, r8d
mov dword [rcx + 8], r10d
mov dword [rcx + 0xc], 0x32
mov dword [rcx + 0x10], eax
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x118]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
call qword [0x14030c820]
mov ebp, eax
test eax, eax
jne 0x140268b80
mov ebp, dword [rsp + 0x34]
jmp 0x140268b80
int3
Function at 0x1402715a0
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1402715df
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1402715af
mov dword [rsi], 7
jmp 0x1402715af
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400fe4a0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1402715bb
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1402715bb
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140271691
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x1402715b1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402715af
Function at 0x402c50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0044a940]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0044a968]
test rbx, rbx
je 0x402ca4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rdi
mov rbp, rax
call rsi
test eax, eax
jne 0x402c9b
test rbp, rbp
je 0x402c9b
mov rax, qword [rbx + 8]
mov rcx, rbp
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402c80
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x0044a940]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x1800010a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000768f
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, [0x140009065]
call sub.msvcrt.dll_getenv
jmp 0x14000776f
lea rcx, [0x140009069]
lea rdx, [0x140009061]
mov r8, rax
mov rax, qword [str.wtvmjpb]
call rax
mov rsi, rax
lea rdi, [0x140009069]
lea r12, [0x1400078e7]
push r12
push rbx
push r12
push rbp
mov rbp, rsp
sub rsp, 0x150
cmp ecx, 0x3fca1bc1
jo 0x1400077ca
add r11, r8
mov ebx, 0x6d0c
add edx, ecx
mov r11, qword [rbp - 0x7d]
xor rbx, 0x743c
mov ebx, dword [rbp - 0x60]
or ecx, dword [rbp - 0x10e]
mov ecx, 0x4a54
movzx ecx, bh
mov rax, qword [rbp - 0xe2]
mov dword [rbp - 0x94], ebx
movzx ebx, ax
mov eax, ecx
mov r8, qword [rbp - 0x9d]
movzx ecx, bl
mov qword [rbp - 0x1a], rbx
lea ecx, [0x140008004]
mov dword [str.funNqiJHtJnKkkcavTbfbk_RvFu_TwwT6Op_eag7Q6kHqaV_b_BsfGWJm], eax
mov r8, qword [rbp - 0x4a]
mov edx, dword [rbp - 0x86]
xor dx, 0x7008
movzx ecx, dx
mov r8, qword [rbp - 0xb3]
cmp eax, 0xba6e64a4
js 0x1400078a3
movzx ebx, bl
sub rdx, r9
mov eax, 0x181f
mov rbx, qword [rbp - 0xe7]
xor qword [rbp - 0x5a], r8
or r11, qword [0x140008008]
mov r8, qword [rbp - 0xa0]
mov ecx, 0x1a58
mov ebx, eax
and edx, ebx
mov rdx, qword [rbp - 0x1b]
or ebx, dword [rbp - 0x102]
mov qword [rbp - 0x117], r9
mov r8, qword [rbp - 0x133]
xor rcx, qword [rbp - 0xaf]
lea ecx, [rbp - 0x69]
mov r10, qword [rbp - 0x36]
or eax, 0xb302
mov dword [rbp - 0x2d], edx
mov r12, rcx
mov qword [rbp - 0xfa], r11
mov eax, ecx
sub ah, 0x83
mov qword [rbp - 0xe1], r9
add r9, 0x581
mov r9, qword [0x14000800b]
mov rbx, rbx
mov eax, dword [rbp - 0x52]
mov qword [0x140008006], rdx
mov ecx, dword [rbp - 0xd9]
mov bx, dx
test ecx, eax
jne 0x1400078d8
mov qword [rbp - 0xd3], r9
mov r9, r11
mov rdx, r9
mov qword [rbp - 0xf], rbx
mov dword [rbp - 0x27], eax
lea r11, [0x14000800b]
leave
pop r12
pop rbx
ret
Function at 0x140001160
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r9d, r9d
lea rdx, [0x1400010b0]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x140004668], rax
test rax, rax
jne 0x1400011c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____SetWindowsHookExA_failed._Error:_0x_lx_n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001260
add rsp, 0x68
ret
lea rcx, str.___KeyboardProcHook_Installed__n
call fcn.140001010
xor r9d, r9d
lea rdx, [0x140001130]
xor r8d, r8d
lea ecx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x140004660], rax
test rax, rax
je 0x14000119c
lea rcx, str.___MouseProcHook_Installed__n
call fcn.140001010
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x14000123d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001260
add rsp, 0x68
ret
call fcn.140001140
int3

Function at 0x140001b20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b6a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b6c
xor al, al
add rsp, 0x28
ret
Function at 0x413b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413d0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006b6680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413be5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413bf4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413c13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413c23
cmp rbx, 0x1000
jae 0x413beb
jmp 0x413c8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413c35
xor edx, edx
jmp 0x413c84
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006b6680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413c19
jmp 0x413c08
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006b6680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x005591f2]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005598e5]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0055cbca]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x413d40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413f66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006b6680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413db3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x413dc2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x413de5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x413df5
cmp rbx, 0x1000
jae 0x413db9
nop
jmp 0x413e78
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x413e0d
xor esi, esi
jmp 0x413e6a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006b6680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x413deb
jmp 0x413dd6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006b6680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x413f00
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x005598fe]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x005598e5]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0055492a]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x413ea0
call sym.runtime.printlock
lea rax, [0x005598fe]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005598e5]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0055c0f3]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x41dfa0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x006b6431], 0
jne 0x41e090
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41e083
lea rsi, [0x006887d8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41e05e
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1258]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1258], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x0055f8d6]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x4204a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4205a6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4204e3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42059b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42059b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006b6680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x420589
xor eax, eax
jmp 0x420593
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4204d1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x42d940
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42da90
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp dword [0x006b6abc], 0
je 0x42da5e
mov qword [rax + 0x20], 0
cmp qword [rax + 0x10], 0
jbe 0x42da85
mov rdx, qword [rax + 8]
mov qword [rdx], 0xffffffffffffffff
mov edx, dword [0x006b6a90]
test edx, edx
jne 0x42d9c7
mov rcx, qword [rax + 0x10]
cmp rcx, 1
jbe 0x42da76
mov rdx, qword [rax + 8]
lea rbx, [sym.runtime._LostContendedRuntimeLock]
inc rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rax + 0x10]
cmp rcx, 2
jbe 0x42da6c
mov rax, qword [rax + 8]
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
lea rdx, [sym.runtime._mLockProfile_.captureStack.func1]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
nop
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006b6680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx + 0x10]
cmp rdx, rax
jle 0x42da58
jbe 0x42da64
mov rcx, qword [rcx + 8]
mov qword [rcx + rax*8], 0
add rsp, 0x50
pop rbp
ret
add rsp, 0x50
pop rbp
ret
mov rcx, rdx
call sym.runtime.panicIndex
mov eax, 2
call sym.runtime.panicIndex
mov eax, 1
nop dword [rax + rax]
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
nop
jmp sym.runtime._mLockProfile_.captureStack