joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cae10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.14003b7e0
mov rcx, rax
test rax, rax
je 0x1400cafa5
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
xor ebp, ebp
mov edi, ebp
nop dword [rax + rax]
lea edx, [rdi + 1]
test edx, edx
js 0x1400caf9a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x1400cae7b
lea rcx, [rsp + 0x48]
call fcn.14003b4b4
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 8], 1
jle 0x1400cae93
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.14003b3b8
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov ecx, dword [rbx - 0xc]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
je 0x1400caf1c
test rbx, rbx
jne 0x1400caeae
mov eax, ebp
jmp 0x1400caec2
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14009ff30
test eax, eax
js 0x1400caf9a
cmp eax, dword [rbx - 0xc]
jg 0x1400caf9a
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], bp
cmp edi, dword [rbx - 0x10]
ja 0x1400cae50
lea rcx, [rbx - 0x18]
call fcn.14003b6ac
add rax, 0x18
mov qword [rsi], rax
mov rdi, 0xffffffffffffffff
lock xadd dword [rbx - 8], edi
sub edi, 1
jg 0x1400caf0c
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
call fcn.14003b7e0
nop
mov rcx, rax
test rax, rax
je 0x1400caf8f
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x140144440]
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x1400caf5b
movzx edx, dx
mov rcx, rsi
call fcn.140039b68
jmp 0x1400caf76
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400caf60
mov r8d, eax
mov rcx, rsi
call fcn.14003b514
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400caf0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
jmp 0x1400caf09
mov ecx, 0x80004005
call fcn.1400268b0
int3
mov ecx, 0x80070057
call fcn.1400268b0
nop
mov ecx, 0x80004005
call fcn.1400268b0
int3
Function at 0x140001d30
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x138
mov rax, qword [0x14001d068]
xor rax, rsp
mov qword [rsp + 0x120], rax
call fcn.140002440
test eax, eax
je 0x140001d5f
cmp dword [0x14001fd80], 1
je 0x140001e44
xor eax, eax
mov qword [rsp + 0x130], rbx
lea rcx, [rsp + 0x80]
xor ebx, ebx
xor edx, edx
mov r8d, 0x9c
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov qword [rsp + 0x52], rax
mov word [rsp + 0x40], bx
mov qword [rsp + 0x5a], rax
mov qword [rsp + 0x62], rax
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x72], rax
mov dword [rsp + 0x7a], eax
mov word [rsp + 0x7e], ax
call fcn.140008bb0
lea r8, [rsp + 0x40]
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
cmp eax, 1
jne 0x140001dd5
mov ebx, dword [rsp + 0x94]
mov r8d, ebx
call fcn.140001100
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareElantechOtherSetting
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001e3c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.ScreenOrientationValueToKernel
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400036c0
add rsp, 0x138
ret
Function at 0x140001e60
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x14001d068]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rsi, qword [rbp + 0x270]
xor r15d, r15d
mov ebx, ecx
mov r14, rdx
lea rcx, [rbp - 0x68]
lea r8d, [r15 + 0x60]
xor edx, edx
mov edi, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 0x104
mov dword [rbp - 0x70], 0x68
call fcn.140008bb0
xor eax, eax
lea rdx, [rsp + 0x60]
mov ecx, ebx
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x140001ef3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140001fa6
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
mov r8d, 1
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x140001f1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140001fa6
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
lea rdx, [rbp]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x140001f3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140001fa6
mov rcx, qword [rsp + 0x60]
lea rax, str.winsta0default
xor r9d, r9d
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x78]
mov r8, r14
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x70]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8400
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140001fa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140001fa6
mov dword [rsi], 0x7d01
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140001fbb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r15
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140001fd0
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov qword [rsp + 0x68], r15
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140001fe5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r15
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140001ff8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x80], r15
test edi, edi
je 0x140002008
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000200d
mov eax, 1
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.1400036c0
mov rbx, qword [rsp + 0x360]
add rsp, 0x320
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002380
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
lea rax, [rsp + 0x68]
mov rsi, rcx
lea rdx, str.SystemCurrentControlSetControlElantechOtherSetting
xor edi, edi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000241b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.CustomerDefinition
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rax
or ebx, 0xffffffff
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002414
cmp dword [rsp + 0x50], 4
cmove ebx, dword [rsp + 0x58]
mov dword [rsi], ebx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsi], 0xffffffff
setne dil
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140002440
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x68]
lea rdx, str.SystemCurrentControlSetControlElantechOtherSetting
xor edi, edi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400024df
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.DisableAutoScreenOrientation
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rax
or ebx, 0xffffffff
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400024d4
cmp dword [rsp + 0x50], 4
cmove ebx, dword [rsp + 0x58]
mov dword [0x14001fd80], ebx
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14001fd80], 0xffffffff
setne dil
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x140002c20
Capabilities:
Create service
Persist via windows service

Disassembly:
sub rsp, 0x4b8
mov rax, qword [0x14001d068]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x208
mov dword [rsp + 0x70], 0x22
call fcn.140008bb0
lea rdx, [rsp + 0x290]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140002c9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.1400038fc
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400036c0
add rsp, 0x4b8
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x4c0], rbx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140002cd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.1400038fc
jmp 0x140002dd5
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x80]
mov edx, 0x104
mov qword [rsp + 0x4b0], rdi
call fcn.140004708
lea r8, [rsp + 0x290]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call fcn.140004708
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call fcn.140004708
xor ecx, ecx
lea rax, [0x1400192c0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
lea r9d, [rcx + 4]
mov dword [rsp + 0x30], 1
lea r8, [0x1400192c8]
lea rdx, str.ETDService
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x140002da3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.1400038fc
jmp 0x140002db6
lea rdx, str.ETDService
lea rcx, str._s_is_installed._n
call fcn.1400038fc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x140002dcd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x4b0]
mov rbx, qword [rsp + 0x4c0]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400036c0
add rsp, 0x4b8
ret
Function at 0x140002e00
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14001d068]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
xor edx, edx
xor ecx, ecx
lea r8d, [rax + 1]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x140002e67
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.1400038fc
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400036c0
add rsp, 0x50
pop rdi
ret
lea rdx, str.ETDService
mov r8d, 0x10024
mov rcx, rax
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x140002ea3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.1400038fc
jmp 0x140002f7b
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140002f45
lea rdx, str.ETDService
lea rcx, str.Stopping__s.
call fcn.1400038fc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140002f22
nop
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x140002f26
lea rcx, [0x140019ba4]
call fcn.1400038fc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140002ef0
mov eax, dword [rsp + 0x24]
lea rdx, str.ETDService
lea rcx, [0x140019ba8]
cmp eax, 1
je 0x140002f40
lea rcx, str._n_s_failed_to_stop._n
call fcn.1400038fc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140002f68
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.1400038fc
jmp 0x140002f7b
lea rdx, str.ETDService
lea rcx, str._s_is_removed._n
call fcn.1400038fc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140002f92
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400036c0
add rsp, 0x50
pop rdi
ret
Function at 0x140003210
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
lea rdi, [rcx + 0x428]
lea rsi, [rcx + 0x420]
mov rbx, rcx
xor ebp, ebp
xor edx, edx
xor ecx, ecx
mov qword [rdi], rbp
mov qword [rsi], rbp
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rbx + 0x438], eax
test eax, eax
js 0x140003312
lea r9, [0x140019290]
lea r8d, [rbp + 1]
lea rcx, [0x140019270]
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rbx + 0x438], eax
test eax, eax
js 0x140003312
mov rcx, qword [rdi]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rbp
mov rax, qword [rcx]
mov qword [rsp + 0x30], rbp
lea rdx, str.rootwmi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [rax + 0x18]
mov dword [rbx + 0x438], eax
test eax, eax
js 0x140003312
mov rcx, qword [rsi]
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
lea edx, [rbp + 0xa]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [rbx + 0x438], eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14039fd10]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14039fd20]
mov dword [rax], 1
mov rax, qword [0x14039fd30]
mov dword [rax], 1
mov rax, qword [0x14039fca0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14039fd00]
mov dword [0x1403b600c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14039fe70]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x14039fe50]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [str.____]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140018a80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140018c0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call dbg.runtime.stdcall3
xorps xmm15, xmm15
mov r14, qword [0x14043c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x140018ae5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140018af4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x140018b13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140018b23
cmp rbx, 0x1000
jae 0x140018aeb
jmp 0x140018b8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140018b35
xor edx, edx
jmp 0x140018b84
mov rcx, qword [sym.VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call dbg.runtime.stdcall3
xorps xmm15, xmm15
mov r14, qword [0x14043c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x140018b19
jmp 0x140018b08
call dbg.runtime.getlasterror
xorps xmm15, xmm15
mov r14, qword [0x14043c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call dbg.runtime.printlock
lea rax, [0x140283cae]
mov ebx, 0x18
nop dword [rax]
call dbg.runtime.printstring
mov rax, qword [rsp + 0x38]
call dbg.runtime.printuint
lea rax, [0x140284336]
mov ebx, 0x19
nop dword [rax + rax]
call dbg.runtime.printstring
mov rax, qword [rsp + 0x30]
call dbg.runtime.printuint
call dbg.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x140286ef9]
mov ebx, 0x21
call dbg.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp dbg.runtime.sysUnusedOS
Function at 0x140018c40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140018e66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call dbg.runtime.stdcall4
xorps xmm15, xmm15
mov r14, qword [0x14043c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140018cb3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140018cc2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x140018ce5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x140018cf5
cmp rbx, 0x1000
jae 0x140018cb9
nop
jmp 0x140018d78
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x140018d0d
xor esi, esi
jmp 0x140018d6a
mov rax, qword [sym.VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call dbg.runtime.stdcall4
xorps xmm15, xmm15
mov r14, qword [0x14043c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x140018ceb
jmp 0x140018cd6
call dbg.runtime.getlasterror
xorps xmm15, xmm15
mov r14, qword [0x14043c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x140018e00
nop dword [rax + rax]
call dbg.runtime.printlock
lea rax, [0x14028434f]
mov ebx, 0x19
call dbg.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call dbg.runtime.printuint
lea rax, [0x140284336]
mov ebx, 0x19
call dbg.runtime.printstring
mov eax, dword [rsp + 0x34]
call dbg.runtime.printuint
nop
call dbg.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x14028029c]
mov ebx, 0xd
call dbg.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x140018da0
call dbg.runtime.printlock
lea rax, [0x14028434f]
mov ebx, 0x19
call dbg.runtime.printstring
mov rax, qword [rsp + 0x38]
call dbg.runtime.printuint
lea rax, [0x140284336]
mov ebx, 0x19
call dbg.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call dbg.runtime.printuint
call dbg.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x1402864b4]
mov ebx, 0x1f
nop dword [rax + rax]
call dbg.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp dbg.runtime.sysUsedOS
Function at 0x140022e40
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x14043be19], 0
jne 0x140022f30
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x140022f23
lea rsi, [0x1403cdf18]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x140022efe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call dbg.runtime.panicIndexU
lea rax, [0x140289e2c]
mov ebx, 0x2c
nop dword [rax]
call dbg.runtime.throw
nop
int3

Function at 0x140025380
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140025486
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x1400253c3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x14002547b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call dbg.runtime.(*scavengeIndex).find
test rax, rax
je 0x14002547b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [dbg.runtime.(*pageAlloc).scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call dbg.runtime.systemstack
xorps xmm15, xmm15
mov r14, qword [0x14043c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x140025469
xor eax, eax
jmp 0x140025473
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x1400253b1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp dbg.runtime.(*pageAlloc).scavenge