joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405600
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rax]
mov rsi, qword [rdx]
cmp rbx, rsi
jbe 0x40561d
cmp qword [rdx + 8], rbx
setae dil
jmp 0x40561f
xor edi, edi
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x48], rdx
cmp dword [rax + 0x100], 0
jle 0x405779
test dil, dil
jne 0x405779
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x70], cl
mov qword [rsp + 0x40], rsi
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x18], rcx
lea rsi, [rbx + 0x400]
mov qword [rdx + 8], rsi
lea rsi, [rbx - 0x8000]
mov qword [rdx], rsi
lea rsi, [rbx - 0x6c60]
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], rsi
mov rsi, qword [rax + 0xb8]
mov qword [rsp + 0x38], rsi
mov rdi, qword [rax + 0x48]
mov qword [rsp + 0x30], rdi
call sym.runtime.printlock
lea rax, [0x00510320]
mov ebx, 2
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printint
lea rax, [0x00510b9a]
mov ebx, 8
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
lea rax, [0x00518443]
mov ebx, 0x1e
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
call sym.runtime.printhex
lea rax, [0x00512df0]
mov ebx, 0x10
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x40]
call sym.runtime.printhex
lea rax, [0x005102ee]
mov ebx, 2
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
call sym.runtime.printhex
lea rax, [0x00541104]
mov ebx, 1
nop dword [rax + rax]
call sym.runtime.printstring
call sym.runtime.printunlock
call sym.runtime.printlock
call sym.runtime.printnl
call sym.runtime.printunlock
mov eax, 2
nop
call sym.runtime.exit
mov rax, qword [rsp + 0x60]
movzx ecx, byte [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x68]
cmp byte [rax + 0xe9], 0
je 0x405828
lea rax, [rbx + 0x400]
mov qword [rdx + 8], rax
lea rax, [rbx - 0x8000]
mov qword [rdx], rax
test cl, cl
jne 0x405811
cmp qword [0x005fdb48], 0
je 0x405811
movups xmmword [rsp + 0x20], xmm15
mov rax, qword [0x005fdb48]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call sym.runtime.asmcgocall.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x405809
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
jbe 0x405809
cmp qword [rsp + 0x28], rcx
jb 0x405809
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [rcx + 8], rax
jmp 0x40580e
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
mov rax, qword [rdx]
add rax, 0x13a0
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
add rsp, 0x50
pop rbp
ret
add rsp, 0x50
pop rbp
ret
Function at 0x405840
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x58], r14
mov rdx, qword [r14 + 0x30]
mov rsi, r14
cmp qword [rdx + 0x90], rsi
je 0x40589c
call sym.runtime.printlock
lea rax, [0x00518461]
mov ebx, 0x1e
call sym.runtime.printstring
call sym.runtime.printunlock
mov eax, 2
call sym.runtime.exit
mov rsi, qword [rsp + 0x58]
mov rax, qword [rsi + 0x30]
mov rdx, qword [rax]
mov rbx, qword [rdx + 0x38]
xor ecx, ecx
call sym.runtime.callbackUpdateSystemStack
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0x234]
mov rdx, qword [r14 + 0x30]
mov rsi, r14
nop
mov qword [rdx + 0x128], rsi
mov rdx, qword [r14 + 0x30]
mov qword [r14 + 0xd0], rdx
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x30]
mov qword [rsp + 0x60], rsi
movups xmm0, xmmword [rsi + 0x400]
movups xmmword [rsp + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x410]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x420]
movups xmmword [rsp + 0x38], xmm0
mov rdi, qword [rdx + 0x70]
mov qword [rsp + 0x50], rdi
mov r8, qword [rdx + 0x78]
mov qword [rsp + 0x48], r8
call sym.runtime.exitsyscall
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x30]
mov byte [rsi + 0xe8], 0
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe9], 0
je 0x405940
mov byte [rsi + 0xea], 0
mov rsi, qword [rdx + 0x30]
xor edi, edi
xchg dword [rsi + 0x5f8], edi
cmp byte [rdx + 0xbd], 0
jne 0x405a09
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call sym.runtime.cgocallbackg1
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x30]
mov byte [rsi + 0xe8], 1
call sym.runtime.unlockOSThread
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe9], 0
je 0x4059a1
mov byte [rsi + 0xea], 1
mov rax, qword [rdx + 0x30]
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jne 0x4059f8
call sym.runtime.osPreemptExtEnter
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
nop
call sym.runtime.reentersyscall
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx + 0x30]
movups xmm0, xmmword [rsp + 0x18]
movups xmmword [rcx + 0x400], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx + 0x410], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx + 0x420], xmm0
add rsp, 0x68
pop rbp
ret
lea rax, [0x0051a732]
mov ebx, 0x26
call sym.runtime.throw
lea rax, [0x004f09a0]
lea rbx, [0x005419a0]
call sym.runtime.gopanic
nop
int3
Function at 0x407840
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop word [rax + rax]
nop dword [rax]
cmp qword [rcx + 0x90], rdx
jne 0x4078f9
lea rcx, [rsp + 0x40]
cmp qword [rdx], rcx
jae 0x4078e7
cmp qword [rdx + 8], rcx
jb 0x4078e7
movups xmmword [rsp + 8], xmm15
movups xmmword [rsp + 0x18], xmm15
mov qword [rsp + 0x28], 0
lea rax, [sym.runtime.debugCallCheck.func1]
mov qword [rsp + 0x18], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x18]
mov qword [rsp], rax
nop dword [rax + rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
add rsp, 0x30
pop rbp
ret
lea rax, [0x00517e4f]
mov ebx, 0x1d
add rsp, 0x30
pop rbp
ret
lea rax, [0x00517e4f]
mov ebx, 0x1d
add rsp, 0x30
pop rbp
ret
Function at 0x40c440
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c4f7
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov rdx, rax
xor ebx, ebx
mov rcx, rbx
mov rax, rdx
call sym.runtime.findObject
test rax, rax
jne 0x40c4e5
mov rax, qword [rsp + 0x30]
mov rcx, rax
shl rax, 0x10
or rax, 0x7ffff
sar rax, 0x13
shl rax, 3
nop
nop
cmp rcx, rax
jne 0x40c493
add rsp, 0x20
pop rbp
ret
call sym.runtime.printlock
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
call sym.runtime.printlock
lea rax, [0x00517900]
mov ebx, 0x1c
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
nop dword [rax]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00513861]
mov ebx, 0x12
nop dword [rax + rax]
call sym.runtime.throw
lea rax, [0x00519f75]
mov ebx, 0x24
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.lfnodeValidate

Function at 0x40c940
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ca66
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop dword [rax]
cmp qword [rcx], rdx
jne 0x40ca54
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x18], rdx
mov rax, rcx
call sym.runtime.semacreate
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x38]
lock cmpxchg qword [rbx], rdx
sete dl
nop dword [rax]
test dl, dl
je 0x40c9d4
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x005ed4e8]
cmp qword [rdx], 0
nop word [rax + rax]
jne 0x40ca4a
mov rax, 0xffffffffffffffff
call sym.runtime.semasleep
jmp 0x40c9f2
cmp qword [rbx], 1
jne 0x40c9e1
add rsp, 0x28
pop rbp
nop
ret
lea rax, [0x00517e6c]
mov ebx, 0x1d
call sym.runtime.throw
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
add rsp, 0x28
pop rbp
ret
mov eax, 0x989680
call sym.runtime.semasleep
mov rcx, qword [0x005ed4e8]
mov rcx, qword [rcx]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call sym.runtime.asmcgocall.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x40ca08
jmp 0x40c9f2
lea rax, [0x00513dfd]
mov ebx, 0x13
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.notesleep
Function at 0x40ca80
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x20]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
test cl, cl
je 0x40cb12
mov qword [rsp + 0x30], r14
test rbx, rbx
jge 0x40cade
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x005ed4e8]
cmp qword [rcx], 0
jne 0x40cce3
mov rax, 0xffffffffffffffff
call sym.runtime.semasleep
jmp 0x40cc9a
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x50], rbx
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x50]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40cb3a
cmp qword [rdx], 1
jne 0x40cb23
mov eax, 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x0051849d]
mov ebx, 0x1e
call sym.runtime.throw
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x005ed4e8]
cmp qword [rdx], 0
je 0x40cb6e
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40cb6e
mov ebx, 0x989680
mov rax, rbx
call sym.runtime.semasleep
test eax, eax
jge 0x40cbfc
mov rax, qword [0x005ed4e8]
mov rax, qword [rax]
test rax, rax
je 0x40cbb1
mov qword [rsp], rax
mov qword [rsp + 8], 0
call sym.runtime.asmcgocall.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40cb34
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x40cc17
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov rax, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
cmp rax, rsi
jne 0x40cc40
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
test dil, dil
je 0x40cc17
xor eax, eax
add rsp, 0x38
pop rbp
ret
cmp rax, 1
jne 0x40cc89
mov byte [rdi + 0xe5], 1
mov rax, 0xffffffffffffffff
call sym.runtime.semasleep
test eax, eax
jl 0x40cc78
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x0051c7de]
mov ebx, 0x32
call sym.runtime.throw
lea rax, [0x0051c687]
mov ebx, 0x31
call sym.runtime.throw
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov rax, qword [0x005ed4e8]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call sym.runtime.asmcgocall.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, 0x989680
call sym.runtime.semasleep
test eax, eax
jl 0x40ccb5
jmp 0x40cc9a
Function at 0x40eb80
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40ee11
push rbp
mov rbp, rsp
sub rsp, 0x40
test rax, rax
je 0x40edff
nop dword [rax + rax]
test rbx, rbx
je 0x40ebc5
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40edee
cmp rbx, 0x2000
jbe 0x40ebca
nop dword [rax + rax]
jmp 0x40eddd
mov ebx, 8
cmp rax, 0x10000
jae 0x40ec9b
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40ec15
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40ec15
test byte [rsi], al
add rsi, 0x1218
jmp 0x40ec40
nop
nop
lea rax, [0x00682ed0]
nop
call sym.runtime.lock2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x00682ed8]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
lea r9, [rax + rdi]
mov qword [rsi + 8], rdi
cmp r9, 0x40000
ja 0x40ec73
cmp qword [rsi], 0
jne 0x40ecab
mov eax, 0x40000
lea rbx, [0x00685840]
nop
call sym.runtime.sysAlloc
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
test rax, rax
je 0x40edb0
jmp 0x40ed53
mov rbx, rcx
nop
call sym.runtime.sysAlloc
add rsp, 0x40
pop rbp
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
nop
add rdi, r8
mov dword [rdx + 0xd8], r10d
cmp r9d, 1
jne 0x40ecea
cmp byte [r14 + 0xb1], 0
nop
je 0x40ecea
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdi
lea rdx, [0x00682ed8]
cmp rsi, rdx
jne 0x40ed18
nop
nop
lea rax, [0x00682ed0]
call sym.runtime.unlock2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
lea rdx, [0x00685840]
nop
cmp rcx, rdx
je 0x40ed4a
mov rbx, rax
mov rax, rcx
call sym.runtime._sysMemStat_.add
mov rbx, qword [rsp + 0x50]
neg rbx
lea rax, [0x00685840]
nop
call sym.runtime._sysMemStat_.add
mov rdi, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x40
pop rbp
ret
mov rax, qword [0x00682cc0]
mov rdx, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x38]
lea rsi, [0x00682cc0]
lock cmpxchg qword [rsi], rdx
sete dl
nop dword [rax]
test dl, dl
je 0x40ed53
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x60]
jmp 0x40ecab
lea rdx, [0x00682ed8]
cmp rcx, rdx
je 0x40edcd
lea rax, [0x00518b07]
mov ebx, 0x1f
call sym.runtime.throw
nop
nop
lea rax, [0x00682ed0]
call sym.runtime.unlock2
jmp 0x40edbc
lea rax, [0x00519c48]
mov ebx, 0x23
call sym.runtime.throw
lea rax, [0x0051b57b]
mov ebx, 0x2a
call sym.runtime.throw
lea rax, [0x00516de1]
mov ebx, 0x1a
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestackc.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.persistentalloc1
Function at 0x40f6a0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40f898
push rbp
mov rbp, rsp
sub rsp, 0x28
test rbx, rbx
je 0x40f787
cmp qword [rbx], 0
nop
je 0x40f787
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
movzx esi, byte [rbx + 8]
test sil, 4
je 0x40f6ff
lea rax, [0x005194c5]
mov ebx, 0x21
call sym.runtime.fatal
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov edi, dword [rbx + 0xc]
mov rax, rcx
mov rbx, rdi
call rsi
mov rcx, qword [rsp + 0x40]
movzx esi, byte [rcx + 9]
mov rdi, qword [rsp + 0x38]
movzx r8d, word [rdi + 0x52]
mov r9, qword [rcx + 0x18]
mov rdx, rcx
mov ecx, esi
mov r10d, 1
shl r10, cl
lea rcx, [r10 - 1]
mov rsi, rcx
and rcx, rax
imul rcx, r8
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40f776
movzx r10d, byte [rdx + 8]
test r10b, 8
jne 0x40f75b
shr rsi, 1
and rsi, rax
imul r8, rsi
movzx esi, byte [r9 + r8]
add esi, 0xfffffffe
add r8, r9
cmp sil, 3
jb 0x40f776
mov rcx, r8
shr rax, 0x38
cmp al, 5
jae 0x40f781
add eax, 5
mov byte [rsp + 0x17], al
jmp 0x40f7d4
mov edx, dword [rax + 0x54]
bt edx, 4
jb 0x40f796
xor eax, eax
xor ebx, ebx
jmp 0x40f7a5
mov rax, qword [rax + 0x30]
mov rbx, rcx
nop dword [rax]
call sym.runtime.mapKeyError2
test rax, rax
jne 0x40f7b7
lea rax, [0x00683e60]
add rsp, 0x28
pop rbp
ret
je 0x40f7c0
mov rax, qword [rax + 8]
nop dword [rax]
call sym.runtime.gopanic
movzx esi, word [rdi + 0x52]
lea rsi, [rcx + rsi]
lea rsi, [rsi - 8]
mov rcx, qword [rsi]
test rcx, rcx
je 0x40f7e2
mov qword [rsp + 0x20], rcx
xor edx, edx
jmp 0x40f7f2
lea rax, [0x00683e60]
add rsp, 0x28
pop rbp
ret
inc rdx
cmp rdx, 8
jae 0x40f7c5
movzx esi, byte [rdx + rcx]
nop dword [rax]
cmp al, sil
je 0x40f80c
test sil, sil
jne 0x40f7ef
jmp 0x40f7e2
mov qword [rsp + 0x18], rdx
movzx esi, byte [rdi + 0x50]
imul rsi, rdx
lea rcx, [rsi + rcx]
lea rcx, [rcx + 8]
mov esi, dword [rdi + 0x54]
bt esi, 0
jae 0x40f82d
mov rcx, qword [rcx]
mov rsi, qword [rdi + 0x30]
mov rdx, qword [rsi + 0x18]
mov rsi, qword [rdx]
mov rax, qword [rsp + 0x48]
mov rbx, rcx
call rsi
test al, al
jne 0x40f85c
movzx eax, byte [rsp + 0x17]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x38]
jmp 0x40f7ef
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rcx + 0x50]
movzx ebx, byte [rcx + 0x51]
mov rsi, qword [rsp + 0x18]
imul rsi, rbx
lea rdx, [rsi + rdx*8]
mov rbx, qword [rsp + 0x20]
lea rdx, [rbx + rdx]
lea rdx, [rdx + 8]
mov ecx, dword [rcx + 0x54]
bt ecx, 1
jae 0x40f88f
mov rdx, qword [rdx]
mov rax, rdx
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
jmp sym.runtime.mapaccess1
Function at 0x40f8e0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40fadd
push rbp
mov rbp, rsp
sub rsp, 0x28
test rbx, rbx
je 0x40f9c7
cmp qword [rbx], 0
nop
je 0x40f9c7
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
movzx esi, byte [rbx + 8]
test sil, 4
je 0x40f93f
lea rax, [0x005194c5]
mov ebx, 0x21
call sym.runtime.fatal
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov edi, dword [rbx + 0xc]
mov rax, rcx
mov rbx, rdi
call rsi
mov rcx, qword [rsp + 0x40]
movzx esi, byte [rcx + 9]
mov rdi, qword [rsp + 0x38]
movzx r8d, word [rdi + 0x52]
mov r9, qword [rcx + 0x18]
mov rdx, rcx
mov ecx, esi
mov r10d, 1
shl r10, cl
lea rcx, [r10 - 1]
mov rsi, rcx
and rcx, rax
imul rcx, r8
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40f9b6
movzx r10d, byte [rdx + 8]
test r10b, 8
jne 0x40f99b
shr rsi, 1
and rsi, rax
imul r8, rsi
movzx esi, byte [r9 + r8]
add esi, 0xfffffffe
add r8, r9
cmp sil, 3
jb 0x40f9b6
mov rcx, r8
shr rax, 0x38
cmp al, 5
jae 0x40f9c1
add eax, 5
mov byte [rsp + 0x17], al
jmp 0x40fa14
mov edx, dword [rax + 0x54]
bt edx, 4
jb 0x40f9d6
xor eax, eax
xor ebx, ebx
jmp 0x40f9e5
mov rax, qword [rax + 0x30]
mov rbx, rcx
nop dword [rax]
call sym.runtime.mapKeyError2
test rax, rax
jne 0x40f9f9
lea rax, [0x00683e60]
xor ebx, ebx
add rsp, 0x28
pop rbp
ret
je 0x40fa00
mov rax, qword [rax + 8]
nop
call sym.runtime.gopanic
movzx esi, word [rdi + 0x52]
lea rsi, [rcx + rsi]
lea rsi, [rsi - 8]
mov rcx, qword [rsi]
test rcx, rcx
je 0x40fa22
mov qword [rsp + 0x20], rcx
xor edx, edx
jmp 0x40fa34
lea rax, [0x00683e60]
xor ebx, ebx
add rsp, 0x28
pop rbp
ret
inc rdx
cmp rdx, 8
jae 0x40fa05
movzx esi, byte [rdx + rcx]
nop
cmp al, sil
je 0x40fa4c
test sil, sil
jne 0x40fa31
jmp 0x40fa22
mov qword [rsp + 0x18], rdx
movzx esi, byte [rdi + 0x50]
imul rsi, rdx
lea rcx, [rsi + rcx]
lea rcx, [rcx + 8]
mov esi, dword [rdi + 0x54]
bt esi, 0
jae 0x40fa6d
mov rcx, qword [rcx]
mov rsi, qword [rdi + 0x30]
mov rdx, qword [rsi + 0x18]
mov rsi, qword [rdx]
mov rax, qword [rsp + 0x48]
mov rbx, rcx
call rsi
test al, al
jne 0x40fa9c
movzx eax, byte [rsp + 0x17]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x38]
jmp 0x40fa31
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rcx + 0x50]
movzx esi, byte [rcx + 0x51]
mov rdi, qword [rsp + 0x18]
imul rsi, rdi
lea rdx, [rsi + rdx*8]
mov rsi, qword [rsp + 0x20]
lea rdx, [rsi + rdx]
lea rdx, [rdx + 8]
mov ecx, dword [rcx + 0x54]
bt ecx, 1
jae 0x40facf
mov rdx, qword [rdx]
mov rax, rdx
mov ebx, 1
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.mapaccess2
Function at 0x411640
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411790
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rsp + 0x30], ecx
test rbx, rbx
je 0x411722
cmp qword [rbx], 0
je 0x411722
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
movzx ecx, byte [rbx + 8]
test cl, 4
je 0x411697
lea rax, [0x005194c5]
mov ebx, 0x21
call sym.runtime.fatal
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
cmp byte [rbx + 9], 0
jne 0x4116a6
mov rcx, qword [rbx + 0x10]
jmp 0x411740
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
mov r9, qword [rcx + 0x18]
mov rdx, rcx
mov ecx, esi
mov r10d, 1
shl r10, cl
lea rcx, [r10 - 1]
mov rsi, rcx
and rcx, rax
imul rcx, r8
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x41171d
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x411702
shr rsi, 1
and rsi, rax
imul r8, rsi
movzx edx, byte [r9 + r8]
add edx, 0xfffffffe
lea rbx, [r9 + r8]
cmp dl, 3
jb 0x41171d
mov rcx, rbx
mov rax, rdi
jmp 0x411740
lea rax, [0x00683e60]
add rsp, 0x10
pop rbp
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
mov rcx, qword [rdx]
nop
test rcx, rcx
je 0x41174e
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x411762
lea rax, [0x00683e60]
add rsp, 0x10
pop rbp
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x41172f
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x41175b
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x41175b
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x28]
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp sym.runtime.mapaccess1_fast32