joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14045daa8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
btr ax, cx
or al, r12b
cmp al, cl
mov qword [rsp + 0x10], rdx
xor ah, 4
bswap ax
mov qword [rsp + 8], rcx
shr ax, 0x2d
sub rsp, 0x88
movsx ecx, dx
mov rax, qword [rsp + 0x90]
jmp 0x14045daea
mov ecx, dword [rax + 0x28]
jmp 0x14045daf2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], 0
jmp 0x14045db0b
mov qword [rsp + 0x48], 0
cqo
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
movzx rax, bp
movzx ecx, cx
cwde
mov rax, qword [rsp + 0xa8]
cdq
not rcx
xchg r8d, edx
mov qword [rsp + 0x30], rax
movsxd r9, edi
setp r9b
mov rax, qword [rsp + 0xb0]
setnp dl
mov ch, 8
cwd
mov qword [rsp + 0x28], rax
movsx rdx, r9w
cwde
bswap ax
mov rax, qword [rsp + 0xa0]
xchg dx, cx
mov cx, 0xc60c
movzx r9d, r9w
mov qword [rsp + 0x20], rax
cdqe
xchg r9b, r8b
rdtsc
mov rax, qword [rsp + 0x90]
bswap dx
mov r9, qword [rax + 0x20]
movzx edx, bp
mov r8d, 0x1e
mov edx, dword [rsp + 0x60]
mov rax, qword [rsp + 0x90]
movsxd rcx, r12d
xchg cl, cl
bswap cx
mov rcx, qword [rax]
jmp 0x14045dbbb
call fcn.14001ff48
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
cmc
mov qword [rsp + 0x70], rax
adc rax, r14
test si, 0x9532
mov eax, dword [rsp + 0x70]
clc
stc
cmp r11w, sp
add rsp, 0x88
jmp 0x14045dbee
ret

Function at 0x14045e6f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
btr r8w, dx
cbw
mov r8, rcx
bts eax, esp
or al, r14b
sbb al, 0x91
mov eax, 0x5a4d
cmc
test r13w, 0x3306
cmp word [0x140000000], ax
jmp 0x14045e71e
jne 0x14045e82a
movsxd rcx, dword [0x14000003c]
shl dh, cl
stc
cdq
lea rdx, [0x140000000]
jmp 0x14045e73f
lea rcx, [rcx + rdx]
cmp ax, 0x9db8
cmp dword [rcx], 0x4550
jmp 0x14045e752
jne 0x14045e82a
mov eax, 0x20b
test r8b, sil
cmc
cmp word [rcx + 0x18], ax
jmp 0x14045e76a
jne 0x14045e82a
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
rcl ax, cl
bts r9w, r8w
shr r9b, cl
add rdx, rcx
btr eax, 0x16
sub r9, rsp
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
stc
mov qword [rsp], rdx
clc
cmp rdx, r9
je 0x14045e7e6
mov ecx, dword [rdx + 0xc]
test edx, 0x5124ea28
test ax, r11w
cmp r8, rcx
jmp 0x14045e7c0
jb 0x14045e7dd
mov eax, dword [rdx + 8]
add eax, ecx
test r8b, 0x28
cmp r8, rax
jmp 0x14045e7d7
jb 0x14045e7e9
add rdx, 0x28
jmp 0x14045e79d
sub edx, edx
clc
test rdx, rdx
jmp 0x14045e7f1
jne 0x14045e803
xor al, al
jmp 0x14045e7fe
jmp 0x14045e839
cmp dword [rdx + 0x24], 0
jmp 0x14045e80c
jge 0x14045e81e
sub al, al
jmp 0x14045e819
jmp 0x14045e839
mov al, 1
jmp 0x14045e825
jmp 0x14045e839
xor al, al
jmp 0x14045e831
jmp 0x14045e839
add rsp, 0x18
ret
Function at 0x14045fea1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
or ax, ax
btc ax, bx
btr bx, 0xbc
push rbp
bt bx, 8
mov rbp, rsp
sub rsp, 0x20
or al, spl
bsr ax, cx
mov rax, qword [0x1400d9018]
shr bl, 0x3b
bts bx, cx
movabs rbx, 0x2b992ddfa232
cmp r15, rax
jmp 0x14045fee6
cmp rax, rbx
jmp 0x14045feee
jne 0x14045ffc9
and qword [rbp + 0x18], 0
movsx ecx, r10w
movsxd rcx, r15d
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045ff13
mov qword [rbp + 0x10], rax
jmp 0x14045ff1c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
clc
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cmp r12b, r15b
lea rcx, [rbp + 0x20]
test r9b, r14b
jmp 0x14045ff40
xor qword [rbp + 0x10], rax
jmp 0x14045ff49
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
test r15b, 0xe
lea rcx, [rbp + 0x10]
cmp r14d, edx
shl rax, 0x20
xor rax, qword [rbp + 0x20]
cmc
cmp r15b, 0xb0
xor rax, qword [rbp + 0x10]
rcl bpl, cl
cmp r12b, 0x93
sub bp, r12w
xor rax, rcx
adc cl, 0x24
bsf cx, r14w
movabs rcx, 0xffffffffffff
sar bpl, 0x90
movsx rbp, cx
btc bp, 1
and rax, rcx
movabs rcx, 0x2b992ddfa233
dec ebp
cmp rax, rbx
cmove rax, rcx
sal bh, 0xad
cmovg ebx, r14d
shl bl, 0x17
mov qword [0x1400d9018], rax
test bp, r10w
rcr bh, 0xbd
mov rbx, qword [rsp + 0x48]
movsx bp, dl
dec rbp
not rax
dec bpl
test r8, 0xffffffffac11dc01
btc ebp, 0x99
mov qword [0x1400d9010], rax
setp bpl
add rsp, 0x20
movsxd rbp, r10d
jmp 0x140460001
pop rbp
jmp 0x140460007
ret
Function at 0x1404605b2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmp spl, r8b
cmc
test r14b, sil
mov qword [rsp + 0x10], rbp
cmp bp, r10w
mov qword [rsp + 0x18], rsi
mov bpl, cl
movsx esi, cx
bt bp, ax
push rdi
sar sil, cl
bswap rdi
inc bpl
sub rsp, 0x20
xor bpl, al
adc dil, spl
movzx rdi, cx
mov edi, dword [rcx + 0xc]
shld bp, r8w, 0x31
adc bpl, spl
mov esi, edx
add ebp, 0x49abe01d
movzx rbp, r14w
setge bpl
test edi, edi
mov bp, 0xdca2
not rbp
movsxd rbp, ecx
mov rbp, rcx
jmp 0x14046061e
je 0x140460693
lea ebx, [rdi - 1]
movsx edi, r12w
movsx rdi, di
mov edi, ebx
jmp 0x140460636
call fcn.140462f62
lea rdx, [rbx + rbx*4]
add cl, dil
movzx ecx, bp
btc ecx, r15d
mov rax, qword [rax + 0x60]
movsx ecx, r9w
cmp bpl, 0x24
lea rcx, [rax + rdx*4]
cmovne eax, ebx
cmp bl, r15b
movsxd rax, dword [rbp + 0x10]
test r11b, 0x98
stc
add rax, rcx
cmp esi, dword [rax + 4]
jmp 0x140460673
jle 0x140460687
cmp esi, dword [rax + 8]
jmp 0x140460681
jle 0x1404606a2
test ebx, ebx
jmp 0x14046068e
jmp 0x14046061e
sub eax, eax
btr di, 0xad
movzx ebx, r10w
cmovns bx, sp
mov rbx, qword [rsp + 0x30]
rol bp, cl
bt ebp, 0xa6
mov rbp, qword [rsp + 0x38]
bsf di, r11w
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
mov di, 0xb097
xchg di, di
seta dil
pop rdi
ret
Function at 0x1404606ce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
sub r11d, r15d
mov qword [rax + 8], rbx
rol r11d, cl
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
cmovno bp, bp
mov qword [rax + 0x20], rdi
add bpl, 0x3f
push r14
movsx di, r8b
mov bl, byte [rcx]
shrd r11w, dx, 0x29
adc si, sp
jmp 0x140460706
lea r10, [rcx + 1]
sub dil, r9b
mov byte [rdx], bl
add r11w, r13w
shr r11b, 0x8d
stc
mov esi, r9d
or dil, 0xb6
lea r14, [0x140000000]
xor bpl, r11b
btc edi, ebx
mov rbp, r8
cmp sil, al
mov r11, rdx
sub dil, 0x30
bswap di
movsx di, bpl
mov rdi, rcx
cmc
test ah, 0x22
test r15b, r10b
test bl, 4
jmp 0x140460753
je 0x1404607ae
movzx ecx, byte [r10]
rol rax, 0xb3
and ecx, 0xf
clc
ror ah, 0x24
movsx rax, byte [rcx + r14 + 0xc08f0]
test r11b, spl
stc
cmp r12d, 0x20936cbb
mov cl, byte [rcx + r14 + 0xc0900]
test di, 0x714
sub r10, rax
shl ah, cl
btr ax, 0xb9
ror ax, cl
mov eax, dword [r10 - 4]
test cx, si
shr eax, cl
jmp 0x1404607ab
mov dword [rdx + 4], eax
test bl, 8
jmp 0x1404607b6
je 0x1404607cb
mov eax, dword [r10]
cmp r15w, r13w
add r10, 4
cmc
mov dword [rdx + 8], eax
test bl, 0x10
jmp 0x1404607d3
je 0x1404607f2
mov eax, dword [r10]
movsx r8d, r10w
bsf r8, rax
add r10, 4
mov r8w, 0x3d1b
mov dword [rdx + 0xc], eax
rcr al, cl
movsxd rax, dword [r10]
lea r8, [r10 + 4]
test r8w, 0xbd97
test r15d, r12d
clc
xor r9d, r9d
test r9b, r13b
clc
cmp byte [rsp + 0x30], r9b
jne 0x1404608c0
test bl, 2
jmp 0x14046081d
je 0x1404608c0
lea rdx, [rax + rbp]
shr r10b, cl
shr cl, 0xbf
lahf
movzx ecx, byte [rdx]
test rcx, 0xffffffffc6ad8a86
btr r10w, di
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc08f0]
mov cl, byte [rcx + r14 + 0xc0900]
sub rdx, rax
add r10b, 0x27
sub r10d, 0xabbf56aa
mov r10d, dword [rdx - 4]
cmp dl, dil
shr r10d, cl
mov dword [r11 + 0x10], r9d
cmp dil, r14b
test r10d, r10d
je 0x1404608c7
mov eax, dword [rdx]
cmp bp, r13w
neg ecx
mov ecx, dword [rdx + 4]
test r9b, 0xab
stc
lea rdx, [rdx + 8]
cmp eax, 0x8eb2e926
cmp eax, esi
jmp 0x140460899
je 0x1404608b7
inc r9d
test rcx, 0xffffffff8934942f
cmp r9d, r10d
jb 0x140460879
jmp 0x1404608c7
mov dword [r11 + 0x10], ecx
jmp 0x1404608c7
mov dword [rdx + 0x10], eax
clc
cmp bl, r12b
test bl, 1
jmp 0x1404608cf
je 0x140460916
movzx ecx, byte [r8]
cdqe
and ecx, 0xf
movsx rdx, byte [rcx + r14 + 0xc08f0]
mov cl, byte [rcx + r14 + 0xc0900]
sub r8, rdx
xadd bl, dl
mov edx, dword [r8 - 4]
sete bh
bsr r14d, r15d
shr edx, cl
adc bp, 0x518a
sbb al, 2
mov dword [r11 + 0x14], edx
seto bpl
rcl r14b, 0x9b
clc
mov rbx, qword [rsp + 0x10]
sub r8, rdi
cwde
mov rbp, qword [rsp + 0x18]
mov r14b, 0xaa
cwde
movsx esi, r10w
mov rax, r8
jmp 0x140460939
mov rsi, qword [rsp + 0x20]
movzx r14d, di
movzx r14, r14w
cmovns r14d, r9d
mov rdi, qword [rsp + 0x28]
movzx r14w, sil
pop r14
jmp 0x14046095b
ret
Function at 0x140460aec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
stc
mov qword [rsp + 0x18], rbp
cmp sil, 0xbc
push rsi
test bl, r8b
bsf rsi, r11
bsr rsi, rsp
push rdi
add rsi, r10
rol dil, 0xa2
push r12
push r14
shrd r12w, r14w, 0x1c
push r15
sub rsp, 0x20
not r15b
movzx di, bpl
mov esi, dword [r8 + 0xc]
movsxd rdi, eax
xchg dil, r12b
not r14b
mov r12, rcx
movzx r14, r15w
movsx rcx, si
mov rcx, r8
jmp 0x140460b50
mov rdi, r9
movzx r14w, spl
mov r14, r8
mov r15b, 0x8c
mov r15, rdx
jmp 0x140460b66
call fcn.140034df6
mov r10, qword [r12]
or bp, r12w
movzx bp, spl
mov ebp, eax
test r13w, bp
clc
test r13w, 0xd2b4
mov qword [rdi], r10
test esi, esi
jmp 0x140460b8f
je 0x140460ca2
movsxd rax, dword [r14 + 0x10]
bsf bx, bx
bt bx, r12w
test cl, 3
lea ecx, [rsi - 1]
mov esi, ecx
sbb bh, ah
movsx ebx, di
lea rcx, [rcx + rcx*4]
btr ebx, 0x95
mov bl, 0xbe
lea rbx, [rax + rcx*4]
add rbx, qword [r15 + 8]
cmp dh, 0x16
cmp ebp, dword [rbx + 4]
jmp 0x140460bcc
jle 0x140460b88
cmp ebp, dword [rbx + 8]
jmp 0x140460bda
jg 0x140460b88
mov rcx, qword [r15]
adc dx, dx
lea rdx, [rsp + 0x50]
cmp r9w, si
xor r8d, r8d
jmp 0x140460bf7
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
sub ecx, ecx
neg r9
add r8, qword [rsp + 0x50]
sal r10, 0xac
cmp al, bpl
mov r9d, dword [rbx + 0xc]
xor r10d, 0x38350c90
cmp r15w, 0x9186
mov r10d, dword [rax]
test r9d, r9d
jmp 0x140460c2e
je 0x140460c74
lea rdx, [r8 + 0xc]
movsxd rax, dword [rdx]
jmp 0x140460c47
cmp rax, r10
jmp 0x140460c4f
je 0x140460c74
inc ecx
add rdx, 0x14
cmp r10, 0x7d9efeb2
test r13b, 0x2a
cmp ecx, r9d
jmp 0x140460c6e
jb 0x140460c38
cmp ecx, r9d
jae 0x140460b88
mov rax, qword [r12]
clc
shl si, cl
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
rcl bpl, 0x84
sal sil, 0x88
mov rcx, qword [rcx + rax]
mov qword [rdi], rcx
bts r12, r11
stc
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
sal r12, cl
cmp sil, 0
movsx edi, cx
add rsp, 0x20
movzx edi, r14w
bswap di
movzx si, bl
pop r15
movzx r14d, dx
pop r14
jmp 0x140460cdb
pop r12
pop rdi
cmovne rsi, r9
movsx esi, r12w
pop rsi
jmp 0x140460cec
ret
Function at 0x14046225b
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
cmc
jmp 0x140462274
mov qword [rsp + 0x10], rsi
or rsi, r8
shrd si, r11w, 0x97
mov qword [rsp + 0x18], rdi
cmp dil, r11b
push r14
bsf si, dx
rcl r14b, cl
mov sil, 0x14
sub rsp, 0x20
shl r14b, cl
xor r14b, 0x3f
cmp byte [rcx + 8], 0
mov r14, rdx
jmp 0x1404622b5
mov rsi, rcx
jmp 0x1404622bd
je 0x140462358
mov rax, qword [rcx]
stc
test rax, rax
jmp 0x1404622cf
je 0x140462358
or rdi, 0xffffffffffffffff
inc rdi
cmp r14b, bl
clc
cmc
cmp byte [rax + rdi], 0
jne 0x1404622d9
lea rcx, [rdi + 1]
jmp 0x1404622f4
call fcn.14006caed
mov rbx, rax
cmp sil, 0x92
test rax, rax
jmp 0x140462308
je 0x14046234b
mov r8, qword [rsi]
cqo
lea rdx, [rdi + 1]
movsxd rcx, ebp
movzx cx, r15b
jmp 0x140462324
mov rcx, rax
call fcn.140477e4f
mov rax, rbx
shr cx, cl
mov byte [r14 + 8], 1
cmovno ecx, r12d
mov qword [r14], rax
xor ebx, ebx
cmovno cx, bx
mov cx, 0xb004
setae ch
mov rcx, rbx
call fcn.140033bb0
jmp 0x14046237d
mov rax, qword [rcx]
movsx ebx, r8w
sar si, 0x2e
btc si, 0xa0
mov qword [rdx], rax
shrd r14, rsp, 0x8a
bswap rdi
mov byte [rdx + 8], 0
xchg r14b, bl
rol rbx, cl
mov rbx, qword [rsp + 0x30]
bts r14w, di
seta r14b
stc
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
or r14b, 0x3d
add rsp, 0x20
mov r14b, 8
movsx r14, r8w
bswap r14
pop r14
jmp 0x1404623af
ret

Function at 0x140465e75
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
xor bx, dx
push rdi
neg r9d
sub rsp, 0x20
not edi
movsx r9w, dil
mov rbx, rdx
movzx dx, bh
movsx r9w, sil
lea r9, [0x1400c1948]
cwd
cmovb rdi, r9
movsxd r8, r14d
mov edi, ecx
lea rdx, [0x1400c1948]
mov ecx, 3
lea r8, [0x1400c1940]
jmp 0x140465ec2
call fcn.14009dfbc
mov rdx, rbx
btr ecx, 0x93
mov ecx, edi
test rax, rax
jmp 0x140465ed8
je 0x140465ee9
call qword [0x1400c0448]
jmp 0x140465eef
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
shl dil, 0x84
add rsp, 0x20
jmp 0x140465f01
pop rdi
jmp 0x140465f07
ret
Function at 0x2fc4d99e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4da3e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4da47a
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4da45e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da452
cmp qword [rbp - 0x10], 0
je 0x2fc4da452
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da418
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da47b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da580
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da5a8
mov eax, 0
jmp 0x2fc4da5f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da5d1
mov eax, 0
jmp 0x2fc4da5f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da5f1
mov eax, 0
jmp 0x2fc4da5f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da5fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da67a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da671
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da671
mov rax, qword [rbp - 8]
jmp 0x2fc4da68f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da644
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x416c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006263e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416ce5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416cf4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416d13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416d23
cmp rbx, 0x1000
jae 0x416ceb
jmp 0x416d8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416d35
xor edx, edx
jmp 0x416d84
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006263e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416d19
jmp 0x416d08
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006263e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004e38fd]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004e3d9b]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004e5f97]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x416e40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417066
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006263e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416eb3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416ec2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416ee5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416ef5
cmp rbx, 0x1000
jae 0x416eb9
nop
jmp 0x416f78
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416f0d
xor esi, esi
jmp 0x416f6a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006263e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416eeb
jmp 0x416ed6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006263e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417000
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004e3db4]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004e3d9b]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004e067c]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416fa0
call sym.runtime.printlock
lea rax, [0x004e3db4]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004e3d9b]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004e5814]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS
Function at 0x420e40
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x006261d2], 0
jne 0x420f30
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x420f23
lea rsi, [0x005b82d8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x420efe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicIndexU
lea rax, [0x004e8035]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
int3

Function at 0x423380
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423486
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4233c3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42347b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42347b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006263e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x423469
xor eax, eax
jmp 0x423473
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4233b1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge