joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e0
xor eax, eax
push ebp
push 0x404aa7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040387c
mov esi, eax
test esi, esi
jle 0x404a87
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00403a48
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0xbc
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x404a6d
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00403768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404aae
lea eax, [ebp - 4]
call fcn.00403714
ret

Function at 0x404bbc
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
push 0xa
push 0x404c24
mov eax, dword [0x40a650]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ebx, eax
push ebx
mov eax, dword [0x40a650]
push eax
call sub.KERNEL32.DLL_CreateRemoteThread
mov edi, eax
push ebx
mov eax, dword [0x40a650]
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov esi, eax
test esi, esi
je 0x404c1e
mov edx, edi
dec edx
mov eax, ebp
call fcn.00403b20
mov eax, ebp
call fcn.00403a48
mov ecx, edi
mov edx, esi
call fcn.00404964
push ebx
call sub.KERNEL32.DLL_GetStartupInfoA
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405064
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e0
xor eax, eax
push ebp
push 0x4050ea
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor eax, eax
mov dword [esi], eax
push ebx
mov eax, dword [ebp - 4]
call fcn.004039f0
push eax
mov eax, dword [0x40a650]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ebx, eax
test ebx, ebx
je 0x4050d4
push ebx
mov eax, dword [0x40a650]
push eax
call sub.KERNEL32.DLL_CreateRemoteThread
mov dword [esi], eax
cmp dword [esi], 0
je 0x4050d4
push ebx
mov eax, dword [0x40a650]
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
test eax, eax
je 0x4050d4
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050f1
lea eax, [ebp - 4]
call fcn.00403714
ret
Function at 0x405a94
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004039e0
mov eax, dword [ebp - 8]
call fcn.004039e0
mov eax, dword [ebp + 0xc]
call fcn.004039e0
xor eax, eax
push ebp
push 0x405b76
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00403768
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004039f0
push eax
push esi
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
jne 0x405b53
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004039f0
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
test eax, eax
jne 0x405b4a
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00403b20
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
call fcn.004039f0
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov edx, dword [ebp - 0x14]
dec edx
mov eax, ebx
call fcn.00403b20
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_OpenProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b7d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403738
lea eax, [ebp + 0xc]
call fcn.00403714
ret

Function at 0x4066c0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00406690
mov esi, eax
mov eax, edi
call fcn.004065f0
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.00406690
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [ebp + 8], 0
je 0x406726
push 0xffffffffffffffff
push edi
call sub.KERNEL32.DLL_GetLastError
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateProcessA
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406aac
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x406abb
or edx, 0x200
test eax, 0x20000000
je 0x406aef
test eax, 0x40000000
je 0x406ada
test eax, 0x80000000
je 0x406ad5
or edx, 0x40
jmp 0x406b16
or edx, 0x20
jmp 0x406b16
test eax, 0x80000000
je 0x406ae9
or edx, 0x80
jmp 0x406b16
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x406b07
test eax, 0x80000000
je 0x406b02
or edx, 4
jmp 0x406b16
or edx, 2
jmp 0x406b16
test eax, 0x80000000
je 0x406b13
or edx, 8
jmp 0x406b16
or edx, 1
mov eax, edx
ret
Function at 0x40751c
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004039e0
xor eax, eax
push ebp
push 0x407602
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403714
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
jbe 0x4075e2
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40757e
mov edi, 0x10
jmp 0x407583
mov edi, 0x20
or edi, 4
push edi
mov eax, dword [ebp - 4]
call fcn.004039f0
push eax
push ebx
call sub.advapi32.dll_RegCloseKey
mov edi, eax
test edi, edi
jbe 0x4075dc
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4075cc
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4075c0
lea eax, [ebp - 0x10]
push eax
push 0
push edi
call sub.user32.dll_CharLowerA
jmp 0x4075cc
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call sub.advapi32.dll_RegDeleteValueA
lea eax, [ebp - 0x2c]
push eax
push edi
call sub.user32.dll_CharUpperA
push edi
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.advapi32.dll_RegCreateKeyA
mov edx, esi
mov eax, dword [ebp - 0x28]
call fcn.00407470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407609
lea eax, [ebp - 4]
call fcn.00403714
ret

Function at 0x407614
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e0
xor eax, eax
push ebp
push 0x407693
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
jbe 0x40767d
push 0x10000
mov eax, dword [ebp - 4]
call fcn.004039f0
push eax
push ebx
call sub.advapi32.dll_RegCloseKey
mov esi, eax
test esi, esi
jbe 0x407677
push esi
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
je 0x407671
or edi, 0xffffffff
push esi
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.advapi32.dll_RegCreateKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40769a
lea eax, [ebp - 4]
call fcn.00403714
ret
Function at 0x4076f4
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
cmp dword [ebp - 0x9c], 1
je 0x4077c3
xor eax, eax
push ebp
push 0x4077b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x20
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push 0x4077cc
push 0
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_UnhandledExceptionFilter
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4077c3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403660
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x7c4fec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403830
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_chacha8rand.setup
Function at 0x40d320
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x7c4fec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d4eb
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40d349
mov eax, 0x7000000
jmp 0x40d351
test eax, eax
je 0x40d4c6
mov dword [esp + 0x34], eax
mov ecx, dword [0x7c4fec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x761040]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40d4de
cmp edx, 0x21
jae 0x40d4d2
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x667ae0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x667b30]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40d4a1
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x667b68]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand
Function at 0x4175a0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x7c4fec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41779e
sub esp, 0x18
mov eax, dword [0x7c4f0c]
test eax, eax
jne 0x417787
nop
nop
lea eax, [0x7c4efc]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x7c4f00]
test eax, eax
je 0x4175e8
cmp dword [eax + 8], 0xcc
jne 0x41765e
mov edx, dword [0x7c4f04]
test edx, edx
jne 0x417640
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x7ca0b0]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x7c4f04], eax
mov ecx, dword [0x7c4f08]
mov dword [eax], ecx
mov eax, dword [0x7c4f04]
mov dword [0x7c4f08], eax
movzx eax, byte [0x7c5500]
test al, al
jne 0x417640
xor eax, eax
jmp 0x417758
mov edx, dword [0x7c4f04]
mov ebx, dword [edx + 4]
mov dword [0x7c4f04], ebx
mov ebx, dword [0x7c4f00]
mov dword [edx + 4], ebx
mov dword [0x7c4f00], edx
mov edx, dword [0x7c4f00]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x417737
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime_internal_atomic.Xadd
mov eax, dword [0x7c5120]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x4176b0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x4176f0
call sym.runtime.gcWriteBarrier8
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x7c4efc]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x7c4ef8]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.runtime_internal_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x75c4d4]
movzx ebx, byte [edx + eax]
lea ebp, [0x7c5500]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x417640
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x417741
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x61d7cf]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x42b600
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x7c4fec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42b744
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.spanOfHeap
mov eax, dword [esp + 4]
test eax, eax
je 0x42b72d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x7c4fec]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sym.runtime._mspan_.ensureSwept
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call sym.runtime.lock2
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x42b697
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42b6c2
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x42b6ac
cmp byte [ebp + 6], bl
je 0x42b6b7
cmp esi, edx
ja 0x42b6be
jne 0x42b695
cmp byte [ebp + 6], bl
jbe 0x42b695
jmp 0x42b6be
mov ebx, 1
jmp 0x42b6c4
xor ebx, ebx
jmp 0x42b6c4
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x42b6e2
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call sym.runtime.spanHasSpecials
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x7c4fec]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x42b71d
movzx eax, byte [ebx + 0x65]
test al, al
je 0x42b71d
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x61f89f]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.addspecial
Function at 0x42bbc0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x7c4fec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42bd30
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42bcc0
cmp cl, 1
je 0x42bc52
cmp cl, 2
jne 0x42bd19
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call sym.runtime.mProf_Free
nop
nop
lea eax, [0x791360]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x791304]
sub eax, dword [0x7912e8]
nop
mov dword [0x791304], eax
mov eax, dword [0x7912f4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7912f4], ecx
nop
lea eax, [0x791360]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42bd15
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call sym.runtime.queuefinalizer
nop
nop
lea eax, [0x791360]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x7912dc]
sub eax, dword [0x7912c0]
nop
mov dword [0x7912dc], eax
mov eax, dword [0x7912cc]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7912cc], ecx
nop
lea eax, [0x791360]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42bd15
cmp cl, 3
jne 0x42bccb
mov byte [eax + 8], 1
jmp 0x42bd15
cmp cl, 4
jne 0x42bd19
nop
nop
lea eax, [0x791360]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x791354]
sub eax, dword [0x791338]
nop
mov dword [0x791354], eax
mov eax, dword [0x791344]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x791344], ecx
nop
nop
lea eax, [0x791360]
mov dword [esp], eax
call sym.runtime.unlock2
add esp, 0x14
ret
lea eax, [0x61a642]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.freeSpecial
Function at 0x431950
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x7c4fec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x431a36
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [eax + 0x88], 0
lea ecx, [0x7c54b0]
mov dword [esp], ecx
call sym.runtime_internal_atomic.Loadint32
mov eax, dword [esp + 4]
test eax, eax
je 0x431a12
mov dword [esp + 8], 0
mov ecx, dword [0x7c4fec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x30]
lea edi, [esp + 0x10]
xor eax, eax
call fcn.0046a9f9
lea ecx, [sym.runtime._mLockProfile_.captureStack.func1]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
call sym.runtime.systemstack
mov eax, dword [esp + 8]
cmp eax, 0x20
jge 0x431a0e
jae 0x431a2b
mov ecx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 8], 0
add esp, 0x2c
ret
lea eax, [sym.runtime._LostContendedRuntimeLock]
inc eax
mov ecx, dword [esp + 0x30]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
add esp, 0x2c
ret
mov ecx, 0x20
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._mLockProfile_.captureStack