joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e280
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40280f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408ea0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c1e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4027e0
cmp byte [0x0059826f], 0
je 0x45e295
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45b2e0
jmp 0x4027e0

Function at 0x45e2a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00598520]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0059826f], 0
je 0x45e2d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00598860]
aesenc xmm0, xmmword [0x00598870]
aesenc xmm0, xmmword [0x00598880]
movq rax, xmm0
ret
jmp 0x4090a0

Function at 0x45e2e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00598520]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0059826f], 0
je 0x45e316
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00598860]
aesenc xmm0, xmmword [0x00598870]
aesenc xmm0, xmmword [0x00598880]
movq rax, xmm0
ret
jmp 0x409100

Function at 0x45fd00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005987e0]
mov qword [rsp + 8], rdx
lea r8d, [0x00598284]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045e1c0
add rsp, 0x30
ret

Function at 0x460240
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46026c
call fcn.0045e1c0
shl rcx, 3
add rcx, 0x1480
mov qword [0x00598440], rcx
ret
Function at 0x180001c1b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18000e038]
jne 0x1800015ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1800015c6
repz ret
ror rcx, 0x10
jmp 0x180001b74
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18000f200]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18000f2f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180001bf9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18000f200]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180001c1b
mov rax, qword [rsp + 0x88]
mov qword [0x18000f2f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18000f298], rax
mov rax, qword [0x18000f2f8]
mov qword [0x18000f170], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18000f280], rax
mov dword [0x18000f160], 0xc0000409
mov dword [0x18000f164], 1
mov rax, qword [0x18000e038]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000e040]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18000f1f8], eax
mov ecx, 1
call fcn.180003fd8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000a2d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18000f1f8], 0
jne 0x180001ca2
mov ecx, 1
call fcn.180003fd8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180003124
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180002f98
Function at 0x180005858
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1800028cc
xor ebx, ebx
mov rdi, rax
cmp qword [0x18000fec0], rbx
jne 0x18000595e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180005a33
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180005a33
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18000fec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18000fec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18000fed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18000fee0], rax
test rax, rax
je 0x180005955
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18000fed8], rax
jmp 0x180005965
mov rax, qword [0x18000fed8]
jmp 0x18000596c
mov rax, qword [0x18000fed8]
mov r11, qword [0x18000fee0]
cmp rax, rdi
je 0x1800059d4
cmp r11, rdi
je 0x1800059d4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18000fee0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800059d4
test rax, rax
je 0x1800059d4
call rsi
test rax, rax
je 0x1800059ce
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800059ce
test byte [rsp + 0x38], 1
jne 0x1800059d4
bts ebp, 0x15
jmp 0x180005a12
mov rcx, qword [0x18000fec8]
cmp rcx, rdi
je 0x180005a12
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180005a12
call rax
mov rbx, rax
test rax, rax
je 0x180005a12
mov rcx, qword [0x18000fed0]
cmp rcx, rdi
je 0x180005a12
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180005a12
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18000fec0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180005a33
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180005a35
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x41b100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b290
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41b165
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x41b180
add rsp, 0x48
pop rbp
ret
call sym.runtime.add
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x41b19f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x41b1af
cmp rbx, 0x1000
jae 0x41b16b
jmp 0x41b21a
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41b1c2
xor edx, edx
nop
jmp 0x41b211
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x41b1a5
jmp 0x41b194
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00582319]
mov ebx, 0x18
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005827db]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00584e69]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x41b2c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b4ea
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41b333
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41b35a
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call sym.runtime.add
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x41b37c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x41b38c
cmp rbx, 0x1000
jae 0x41b339
jmp 0x41b40e
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41b39e
xor esi, esi
jmp 0x41b400
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41b382
jmp 0x41b36e
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x41b489
call sym.runtime.printlock
lea rax, [0x005827f4]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
call sym.runtime.printuint
lea rax, [0x005827db]
mov ebx, 0x19
nop dword [rax]
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0057ed61]
mov ebx, 0xd
call sym.runtime.throw
cmp eax, 0x5af
je 0x41b431
call sym.runtime.printlock
lea rax, [0x005827f4]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005827db]
mov ebx, 0x19
nop dword [rax]
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005845c9]
mov ebx, 0x1f
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUsedOS
Function at 0x428480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428586
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4284c3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42857b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42857b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x428569
xor eax, eax
jmp 0x428573
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4284b1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge

Function at 0x436500
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x436609
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rax + 0x108], 0
lea rax, [0x006d4370]
call sym.runtime_internal_atomic._Int32_.Load
test eax, eax
je 0x4365dd
mov qword [rsp + 0x10], 0
lea rax, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [sym.runtime._mLockProfile_.captureStack.func1]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, r14
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 3
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x4365d7
jae 0x4365fe
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rax, [sym.runtime._LostContendedRuntimeLock]
inc rax
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime._mLockProfile_.captureStack
Function at 0x436e60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x436fa8
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x98], dil
test dil, dil
jne 0x436e8d
xor edx, edx
xor esi, esi
jmp 0x436ed4
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rax
mov eax, 6
call sym.runtime.stopTheWorld
mov rcx, qword [rsp + 0x90]
movzx edi, byte [rsp + 0x98]
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], 0
nop dword [rax]
test rbx, rbx
jne 0x436eed
test dil, dil
jmp 0x436f91
mov qword [rsp + 0x18], rsi
mov byte [rsp + 0x17], dl
lea rdx, [rsp + 0x80]
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rsi, [sym.runtime.Stack.func1]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
mov rax, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov byte [rsp + 0x60], dil
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x98]
test al, al
movzx edx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x18]
je 0x436f9d
mov eax, edx
mov rbx, rsi
call sym.runtime.startTheWorld
mov rax, qword [rsp + 0x20]
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime.Stack
Function at 0x454a00
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x78
mov rcx, r14
test rcx, rcx
je 0x454a4b
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x454a4b
mov qword [rsp + 0x70], rcx
mov rax, rdi
call sym.runtime.__DISPATCHER_CONTEXT_.ctx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
jmp 0x454a5b
mov eax, 1
add rsp, 0x78
pop rbp
ret
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime._context_.ip
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x454b3f
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x68]
call sym.runtime._context_.ip
mov rcx, qword [rsp + 0x60]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x68]
lea rdi, [rsp + 0x50]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call sym.runtime.stdcall8.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx], rcx
ja 0x454b3f
cmp qword [rdx + 8], rcx
ja 0x454a56
mov eax, 1
add rsp, 0x78
pop rbp
ret

Function at 0x463be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463ca2
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x68]
call sym.runtime.stringStructOf
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
lea rdx, [rcx + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
mov rax, rdx
mov rcx, rsi
call sym.runtime._traceMap_.put
test bl, bl
je 0x463c9c
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._traceStringTable_.put.func1]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime._traceStringTable_.put
Function at 0x466c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x466caf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x471300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d3d6d], 0
je 0x47130e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x471320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d3d6d], 0
je 0x471335
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x471340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d3d6d], 0
je 0x471375
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006d43c0]
aesenc xmm0, xmmword [0x006d43d0]
aesenc xmm0, xmmword [0x006d43e0]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x471380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d3d6d], 0
je 0x4713b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006d43c0]
aesenc xmm0, xmmword [0x006d43d0]
aesenc xmm0, xmmword [0x006d43e0]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback