joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e240
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e486
push rbp
mov rbp, rsp
sub rsp, 0x48
test ebx, ebx
je 0x45e263
mov dword [rsp + 0x60], ebx
lea rcx, [0x005e5ea0]
jmp 0x45e272
xor eax, eax
add rsp, 0x48
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x45e2af
mov rdx, qword [rcx + 0x128]
nop
cmp rax, rdx
jb 0x45e26b
mov rsi, qword [rcx + 0x130]
cmp rax, rsi
jae 0x45e26b
movsxd rcx, ebx
lea rax, [rdx + rcx]
nop dword [rax + rax]
cmp rsi, rax
jb 0x45e3fb
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x28], rax
nop
nop
nop
lea rax, [0x005fe140]
nop
call sym.runtime.lock2
mov rbx, qword [0x005fe150]
lea rax, [0x004f6280]
mov ecx, dword [rsp + 0x60]
call sym.runtime.mapaccess2_fast32
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
nop
nop
nop
lea rax, [0x005fe140]
call sym.runtime.unlock2
movzx ecx, byte [rsp + 0x1f]
nop dword [rax]
test cl, cl
jne 0x45e367
call sym.runtime.printlock
lea rax, [0x00513405]
mov ebx, 0x11
call sym.runtime.printstring
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call sym.runtime.printhex
lea rax, [0x00510865]
mov ebx, 6
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
nop dword [rax]
call sym.runtime.printhex
lea rax, [0x00512fa0]
mov ebx, 0x10
call sym.runtime.printstring
call sym.runtime.printunlock
lea rax, [0x005e5ea0]
jmp 0x45e3e5
mov rax, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x30], rdx
call sym.runtime.printlock
lea rax, [0x00510a66]
mov ebx, 7
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printhex
lea rax, [0x00510ce2]
mov ebx, 8
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x248]
test rax, rax
jne 0x45e372
lea rax, [0x0051c0f7]
mov ebx, 0x2e
call sym.runtime.throw
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rsi
call sym.runtime.printlock
lea rax, [0x00513405]
mov ebx, 0x11
call sym.runtime.printstring
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call sym.runtime.printhex
lea rax, [0x0051250a]
mov ebx, 0xe
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
nop dword [rax]
call sym.runtime.printhex
lea rax, [0x00510393]
mov ebx, 3
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00519738]
mov ebx, 0x21
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp sym.runtime.resolveNameOff
Function at 0x460520
Capabilities:
Reference wmi statements

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4605dd
push rbp
mov rbp, rsp
sub rsp, 0x88
lea rax, [rsp + 0x98]
call sym.runtime.gorecover
test rax, rax
jne 0x460555
add rsp, 0x88
pop rbp
ret
cmp dword [rax + 0x10], 0x778cdb8
jne 0x460598
lea rdx, [0x004f09a0]
cmp rax, rdx
jne 0x460598
mov r8, qword [rbx]
mov r9, qword [rbx + 8]
lea rax, [rsp + 0x58]
lea rbx, [0x00519195]
mov ecx, 0x20
lea rdi, [0x005102e6]
mov esi, 2
call sym.runtime.concatstring3
call sym.runtime.throw
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov rax, qword [rsp + 0x78]
call sym.runtime.rtype.string
mov ecx, 0x20
lea rdi, [0x00510a6d]
mov esi, 7
mov r8, rax
mov r9, rbx
lea rax, [rsp + 0x38]
lea rbx, [0x00519195]
call sym.runtime.concatstring3
call sym.runtime.throw
nop
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.preprintpanics.func1

Function at 0x4642a0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46431a
push rbp
mov rbp, rsp
sub rsp, 0x18
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x464305
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor ecx, ecx
call sym.runtime.mallocgc
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jl 0x464300
mov rdx, rax
neg rdx
nop dword [rax + rax]
cmp rcx, rdx
ja 0x4642ee
mov rbx, rcx
add rsp, 0x18
pop rbp
ret
test rax, rax
je 0x4642f8
call sym.runtime.panicunsafeslicelen
call sym.runtime.panicunsafeslicenilptr
nop dword [rax]
call sym.runtime.panicunsafeslicelen
nop
lea rax, [0x004f68e0]
lea rbx, [0x00541a50]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.internal_bytealg.MakeNoZero
Function at 0x468080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00682beb], 0
je 0x46808e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x4680a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00682beb], 0
je 0x4680b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x4680c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00682beb], 0
je 0x4680f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00683240]
aesenc xmm0, xmmword [0x00683250]
aesenc xmm0, xmmword [0x00683260]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x468100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00682beb], 0
je 0x468136
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00683240]
aesenc xmm0, xmmword [0x00683250]
aesenc xmm0, xmmword [0x00683260]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x4697a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x00682e20]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x46983b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret
Function at 0x469a60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x00682e20]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x469af7
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret

Function at 0x469ec0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x469ef4
mov rcx, 0x28
jmp 0x469eff
shl rcx, 3
add rcx, 0x1480
mov qword [0x00682e20], rcx
pop rbp
ret

Function at 0x46cca0
Capabilities:
Reference wmi statements

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp sym.runtime.badmorestackgsignal

Function at 0x46cdc0
Capabilities:
Reference wmi statements

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp sym.runtime.check

Function at 0x46ce20
Capabilities:
Reference wmi statements

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp sym.runtime.newstack
Function at 0x46e4a0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e547
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rsi, qword [rdx + 8]
mov rdi, qword [rsi + 8]
cmp rax, rdi
jae 0x46e533
nop
cmp rbx, rdi
jae 0x46e533
mov rdi, qword [rdx + 0x18]
mov qword [rsp + 0x28], rdi
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
mov qword [rsp + 0x30], rdx
mov rsi, qword [rsi]
imul rax, r8
imul r8, rbx
lea rcx, [rax + rsi]
mov qword [rsp + 0x20], rcx
add rsi, r8
mov qword [rsp + 0x18], rsi
nop
mov rax, rdi
mov rbx, rdx
nop
call sym.internal_reflectlite.typedmemmove
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
call sym.internal_reflectlite.typedmemmove
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
call sym.internal_reflectlite.typedmemmove
add rsp, 0x38
pop rbp
ret
lea rax, [0x004f09a0]
lea rbx, [0x00541630]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.internal_reflectlite.Swapper.func9

Function at 0x46e940
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e9e6
push rbp
mov rbp, rsp
sub rsp, 0x28
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x46e978
nop
cmp rcx, 0x11
jne 0x46e96c
mov rcx, qword [rax + 0x30]
jmp 0x46e9a0
cmp rcx, 0x12
jne 0x46e99c
mov rcx, qword [rax + 0x30]
jmp 0x46e9a0
cmp rcx, 0x15
jne 0x46e984
mov rcx, qword [rax + 0x38]
jmp 0x46e9a0
cmp rcx, 0x16
jne 0x46e990
mov rcx, qword [rax + 0x30]
jmp 0x46e9a0
cmp rcx, 0x17
jne 0x46e99c
mov rcx, qword [rax + 0x30]
jmp 0x46e9a0
xor ecx, ecx
nop
test rcx, rcx
je 0x46e9ae
mov rax, rcx
add rsp, 0x28
pop rbp
ret
call sym.internal_reflectlite.rtype.String
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x005183cb]
call sym.runtime.concatstring2
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004f09a0]
nop dword [rax + rax]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.internal_reflectlite.elem

Function at 0x46ea60
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46eaa6
push rbp
mov rbp, rsp
sub rsp, 0x10
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop
cmp rcx, 0x11
je 0x46ea80
xor eax, eax
nop
test rax, rax
je 0x46ea8f
mov rax, qword [rax + 0x40]
add rsp, 0x10
pop rbp
ret
lea rax, [0x004f09a0]
lea rbx, [0x00541bd0]
nop dword [rax]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.internal_reflectlite.rtype.Len
Function at 0x46ede0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ee12
push rbp
mov rbp, rsp
sub rsp, 0x10
test rax, rax
jne 0x46edfe
test rbx, rbx
jne 0x46edfe
add rsp, 0x10
pop rbp
ret
lea rax, [0x004f09a0]
lea rbx, [0x00541630]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.internal_reflectlite.Swapper.func2

Function at 0x46eee0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ef37
push rbp
mov rbp, rsp
sub rsp, 0x10
mov r12, qword [r14 + 0x20]
test r12, r12
jne 0x46ef4c
test rax, rax
je 0x46ef31
mov rcx, qword [rax]
movzx edx, byte [rcx + 0x17]
and edx, 0x1f
nop
cmp rdx, 0x11
je 0x46ef0f
xor ecx, ecx
test rcx, rcx
je 0x46ef1e
mov rax, qword [rcx + 0x40]
add rsp, 0x10
pop rbp
ret
lea rax, [0x004f09a0]
lea rbx, [0x00541bd0]
call sym.runtime.gopanic
call sym.runtime.panicwrap
nop
mov qword [rsp + 8], rax
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.internal_reflectlite._rtype_.Len
lea r13, [rsp + 0x20]
cmp qword [r12], r13
jne 0x46eef7
mov qword [r12], rsp
jmp 0x46eef7
Function at 0x470960
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470a07
push rbp
mov rbp, rsp
sub rsp, 0x18
lea edx, [rbx + 1]
bt edx, 0
jb 0x47099e
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
lea rax, [0x00518425]
mov ebx, 0x1e
call sym.sync.fatal
mov rax, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x30]
bt ebx, 2
jae 0x4709c4
test byte [rax], al
add rax, 4
mov ebx, 1
mov ecx, 1
call sym.sync.runtime_Semrelease
add rsp, 0x18
pop rbp
ret
mov ebx, dword [rcx]
mov rax, rcx
mov edx, ebx
sar ebx, 3
test ebx, ebx
je 0x470a01
test edx, 7
jne 0x470a01
lea esi, [rdx - 8]
or esi, 2
mov rcx, rax
mov eax, edx
lock cmpxchg dword [rcx], esi
sete dl
test dl, dl
je 0x4709bf
lea rax, [rcx + 4]
xor ebx, ebx
mov ecx, 1
call sym.sync.runtime_Semrelease
add rsp, 0x18
pop rbp
ret
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop
jmp sym.sync._Mutex_.unlockSlow

Function at 0x471b20
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471bf9
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdx, rbx
shl rbx, 0x20
mov rsi, rbx
lock xadd qword [rax], rbx
add rsi, rbx
mov rdi, rsi
shr rsi, 0x20
test esi, esi
jl 0x471be5
test edi, edi
je 0x471b6c
test rdx, rdx
jle 0x471b68
nop dword [rax]
cmp edx, esi
je 0x471bcd
test esi, esi
jmp 0x471b6e
test esi, esi
jmp 0x471b6e
test esi, esi
jg 0x471b88
test edi, edi
je 0x471b88
mov rdx, qword [rax]
cmp rdx, rdi
jne 0x471bba
mov qword [rsp + 0x30], rax
xor edx, edx
xchg qword [rax], rdx
jmp 0x471bb0
add rsp, 0x20
pop rbp
ret
mov dword [rsp + 0x1c], edi
lea rdx, [rax + 8]
xor ebx, ebx
xor ecx, ecx
mov rax, rdx
nop dword [rax]
call sym.sync.runtime_Semrelease
mov edi, dword [rsp + 0x1c]
dec edi
mov rax, qword [rsp + 0x30]
test edi, edi
jne 0x471b8e
add rsp, 0x20
pop rbp
ret
lea rax, [0x004f09a0]
lea rbx, [0x00541970]
call sym.runtime.gopanic
lea rax, [0x004f09a0]
lea rbx, [0x00541970]
nop dword [rax + rax]
call sym.runtime.gopanic
lea rax, [0x004f09a0]
lea rbx, [0x00541960]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.sync._WaitGroup_.Add
Function at 0x47f6a0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f746
push rbp
mov rbp, rsp
sub rsp, 0x28
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x47f6d8
nop
cmp rcx, 0x11
jne 0x47f6cc
mov rcx, qword [rax + 0x30]
jmp 0x47f700
cmp rcx, 0x12
jne 0x47f6fc
mov rcx, qword [rax + 0x30]
jmp 0x47f700
cmp rcx, 0x15
jne 0x47f6e4
mov rcx, qword [rax + 0x38]
jmp 0x47f700
cmp rcx, 0x16
jne 0x47f6f0
mov rcx, qword [rax + 0x30]
jmp 0x47f700
cmp rcx, 0x17
jne 0x47f6fc
mov rcx, qword [rax + 0x30]
jmp 0x47f700
xor ecx, ecx
nop
test rcx, rcx
je 0x47f70e
mov rax, rcx
add rsp, 0x28
pop rbp
ret
call sym.reflect._rtype_.String
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x005183cb]
call sym.runtime.concatstring2
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004f09a0]
nop dword [rax + rax]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect.elem

Function at 0x47f7c0
Capabilities:
Reference wmi statements

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x47f8d5
push rbp
mov rbp, rsp
sub rsp, 0xe0
movups xmmword [rsp + 0xf0], xmm15
lea rdi, [rsp + 0xf8]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046882b
mov rbp, qword [rbp]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop word [rax + rax]
cmp rcx, 0x19
jne 0x47f8a0
call sym.reflect._structType_.Field
mov rcx, qword [rsp]
mov qword [rsp + 0x78], rcx
lea rdi, [rsp + 0x80]
lea rsi, [rsp + 8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00468b8c
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0xf0], rcx
lea rdi, [rsp + 0xf8]
lea rsi, [rsp + 0x80]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00468b8c
mov rbp, qword [rbp]
add rsp, 0xe0
pop rbp
ret
call sym.reflect._rtype_.String
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00519887]
call sym.runtime.concatstring2
nop
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004f09a0]
call sym.runtime.gopanic
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp sym.reflect._rtype_.Field

Function at 0x47f900
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f975
push rbp
mov rbp, rsp
sub rsp, 0x28
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x15
jne 0x47f93b
mov rcx, qword [rax + 0x30]
nop
test rcx, rcx
je 0x47f92e
lea rax, [0x00543420]
jmp 0x47f932
xor eax, eax
xor ecx, ecx
mov rbx, rcx
add rsp, 0x28
pop rbp
ret
nop dword [rax + rax]
call sym.reflect._rtype_.String
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00517e32]
call sym.runtime.concatstring2
nop
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004f09a0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect._rtype_.Key
Function at 0x47f9a0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f9fa
push rbp
mov rbp, rsp
sub rsp, 0x28
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x11
jne 0x47f9c5
mov rax, qword [rax + 0x40]
add rsp, 0x28
pop rbp
ret
call sym.reflect._rtype_.String
mov ecx, 0x1f
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00518a0f]
nop
call sym.runtime.concatstring2
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004f09a0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect._rtype_.Len

Function at 0x47fde0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ff47
push rbp
mov rbp, rsp
sub rsp, 0x20
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046882b
mov rbp, qword [rbp]
test rbx, rbx
jl 0x47ff33
nop dword [rax]
cmp qword [rax + 0x40], rbx
jle 0x47ff33
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov rcx, qword [rax + 0x38]
lea rdx, [rbx + rbx*2]
mov rsi, qword [rcx + rdx*8 + 8]
test rsi, rsi
je 0x47fe55
lea rdi, [0x00543420]
jmp 0x47fe59
xor edi, edi
xor esi, esi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov rax, qword [rcx + rdx*8]
call sym.internal_abi.Name.Name
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 8
setne byte [rsp + 0x90]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 1
jne 0x47fecd
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x30]
call sym.internal_abi.Name.Name
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rdx + rcx*8]
call sym.internal_abi.Name.Tag
test rbx, rbx
je 0x47fee5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx + rcx*8 + 0x10]
mov qword [rsp + 0x70], rcx
lea rax, [0x004f2ba0]
call sym.runtime.newobject
mov rcx, qword [rsp + 0xa0]
mov qword [rax], rcx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov qword [rsp + 0x88], 1
add rsp, 0x20
pop rbp
ret
lea rax, [0x004f09a0]
lea rbx, [0x00541650]
call sym.runtime.gopanic
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp sym.reflect._structType_.Field