joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f500
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44f636
push rbp
mov rbp, rsp
sub rsp, 0x48
cmp rcx, rbx
jae 0x44f55d
mov rdx, qword [rax]
mov qword [rsp + 0x30], rdx
mov rsi, rax
mov rax, rbx
mul rdx
jo 0x44f621
movabs rdx, 0x1000000000000
nop dword [rax + rax]
cmp rax, rdx
ja 0x44f621
test rbx, rbx
jl 0x44f621
mov rdx, qword [rsp + 0x30]
imul rcx, rdx
jmp 0x44f56a
mov rcx, qword [rax]
imul rcx, rbx
mov rsi, rax
mov rax, rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x28], rcx
cmp qword [rsi + 8], 0
jne 0x44f5b8
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor ecx, ecx
call sym.runtime.mallocgc
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp rcx, rbx
jae 0x44f607
mov qword [rsp + 0x38], rax
sub rbx, rcx
lea rdx, [rax + rcx]
mov rax, rdx
call sym.runtime.memclrNoHeapPointers
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
jmp 0x44f607
mov qword [rsp + 0x40], rsi
mov rbx, rsi
mov ecx, 1
call sym.runtime.mallocgc
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x44f607
cmp byte [0x0098c4d0], 0
je 0x44f607
mov qword [rsp + 0x38], rax
mov rdx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, rbx
mov rdi, qword [rsp + 0x40]
mov rax, rdx
mov rbx, rsi
call sym.runtime.bulkBarrierPreWriteSrcOnly
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x70]
call sym.runtime.memmove
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbp
ret
nop
lea rax, [0x0068b540]
lea rbx, [0x00756dc0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime.makeslicecopy

Function at 0x44f680
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44f71f
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rsi, rax
mov rax, rdx
mov rdi, rax
mul rcx
jo 0x44f713
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x44f6cf
test rbx, rbx
jl 0x44f6cf
cmp rcx, rbx
jl 0x44f6cf
mov rbx, rsi
mov ecx, 1
call sym.runtime.mallocgc
add rsp, 0x18
pop rbp
ret
mov rax, rdi
mul rbx
jno 0x44f6eb
nop
lea rax, [0x0068b540]
lea rbx, [0x00756dc0]
call sym.runtime.gopanic
movabs rcx, 0x1000000000000
cmp rax, rcx
ja 0x44f6d7
test rbx, rbx
jl 0x44f6d7
nop
lea rax, [0x0068b540]
lea rbx, [0x00756dd0]
call sym.runtime.gopanic
movabs rdx, 0x1000000000000
jmp 0x44f6cf
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.makeslice
Function at 0x452420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45258a
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax], 0
je 0x452578
nop
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x452472
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
cmp rax, rdx
jne 0x452567
mov rsi, r14
cmp rsi, rdx
je 0x452567
cmp ecx, 2
jne 0x452567
cmp qword [rax + 0x70], 0
jne 0x452494
cmp byte [rax + 0xb4], 0
je 0x452486
xor ecx, ecx
jmp 0x452496
nop
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x452496
xor ecx, ecx
test cl, cl
je 0x452556
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x4524bd
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x3f0], 0
jne 0x452545
cmp dword [0x0098c8dc], 0
jg 0x45253f
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov rax, rcx
call sym.runtime.findfunc
test rax, rax
je 0x4524eb
cmp byte [rax + 0x28], 7
jne 0x4524eb
add rsp, 0x10
pop rbp
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rdx, rcx
mov rcx, rdx
shr rdx, 1
cmp rdx, 0x2000
jb 0x452539
mov rsi, qword [rax + 0x38]
sub rbx, rsi
lea rsi, [rbx + 0x320]
shr rcx, 2
nop
cmp rcx, rsi
ja 0x45252b
add rsp, 0x10
pop rbp
ret
mov rbx, rdx
call sym.runtime.copystack
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d9cc5]
mov ebx, 0x1a
call sym.runtime.throw
lea rax, [0x006d7eed]
mov ebx, 0x17
call sym.runtime.throw
lea rax, [0x006d926f]
mov ebx, 0x19
call sym.runtime.throw
lea rax, [0x006db0b9]
mov ebx, 0x1c
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.shrinkstack
Function at 0x4532c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4534a7
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x78], rbx
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x4532fa
add r10, 0x10
lea r11, [rbx + 1]
mov rbx, r10
mov r9, r8
mov r8, rsi
mov rsi, r11
cmp rcx, rsi
jle 0x453331
mov r10, rbx
mov r11, qword [rbx + 8]
test r11, r11
jne 0x453316
mov rbx, rsi
mov rsi, r8
mov r8, r9
jmp 0x4532e6
lea r8, [r9 + r11]
nop word [rax + rax]
cmp r9, r8
jg 0x453495
inc rdi
mov rbx, rsi
jmp 0x4532e6
test rdi, rdi
je 0x4533be
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rdx
cmp rdi, 1
jne 0x45339c
test rax, rax
jne 0x453376
cmp rcx, r8
jbe 0x45348d
mov rsi, r8
shl r8, 4
mov rdi, qword [rdx + r8]
cmp qword [r14], rdi
ja 0x453380
mov r8, qword [r14 + 8]
cmp rdi, r8
jb 0x45339c
jmp 0x453380
mov rsi, r8
nop dword [rax]
cmp rcx, rsi
jbe 0x453485
shl rsi, 4
mov rax, qword [rdx + rsi]
mov rbx, qword [rdx + rsi + 8]
add rsp, 0x60
pop rbp
ret
mov rbx, r9
nop
call sym.runtime.rawstringtmp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x80]
jmp 0x4533e8
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
sub rsi, r9
mov r10, rsi
neg r10
sar r10, 0x3f
and r10, r9
add rdx, 0x10
dec r8
sub r11, r9
add rcx, r10
mov rdi, r11
test r8, r8
jle 0x453471
mov r9, qword [rdx + 8]
mov r10, qword [rdx]
cmp rdi, r9
mov r11, rdi
cmovg rdi, r9
cmp rcx, r10
jne 0x45340c
cmp r11, r9
jmp 0x453469
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x18], r9
mov rax, rcx
mov rbx, r10
mov rcx, rdi
call sym.runtime.memmove
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jae 0x4533c8
jmp 0x453477
add rsp, 0x60
pop rbp
ret
mov rax, r9
mov rcx, r11
nop dword [rax]
call sym.runtime.panicSliceB
mov rax, rsi
call sym.runtime.panicIndex
mov rax, r8
call sym.runtime.panicIndex
lea rax, [0x006db9d5]
mov ebx, 0x1d
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime.concatstrings
Function at 0x456e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x456ff7
movzx edx, byte [rax]
test edx, edx
jne 0x456eb4
nop dword [rax]
test r8b, r8b
jne 0x456eb4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x456ec7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x456fb7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x456fa5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x456f97
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x456f1d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x456f60
mov eax, 1
cmp rax, rbx
ja 0x456f4b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x456f8f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x456f53
mov rcx, r11
mov eax, r12d
jmp 0x456f22
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x456fed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x456fb0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x456ecd
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3
Function at 0x457c60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x457d88
push rbp
mov rbp, rsp
sub rsp, 0x38
cmp qword [rax + 8], 0
jle 0x457d76
cmp qword [rax + 0x10], 0
jl 0x457d65
mov ecx, dword [rax + 0x40]
test ecx, ecx
jne 0x457d50
mov qword [rsp + 0x48], rax
nop
mov ecx, 1
xchg dword [rax + 0x40], ecx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x28], r14
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0xa0]
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx + 0x30]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x30], rdx
test byte [rdx], al
lea rsi, [rdx + 0x22a0]
mov qword [rsp + 0x20], rsi
nop
mov rax, rsi
call sym.runtime.lock2
mov rax, qword [rsp + 0x30]
call sym.runtime.cleantimers
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
call sym.runtime.doaddtimer
nop
nop
mov rax, qword [rsp + 0x20]
call sym.runtime.unlock2
mov rax, qword [rsp + 0x10]
call sym.runtime.wakeNetPoller
mov rcx, qword [rsp + 0x18]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
nop
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x457d4a
cmp byte [r14 + 0xb1], 0
je 0x457d4a
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x38
pop rbp
ret
lea rax, [0x006e0d37]
mov ebx, 0x26
nop dword [rax]
call sym.runtime.throw
lea rax, [0x006de0e0]
mov ebx, 0x21
call sym.runtime.throw
lea rax, [0x006da83f]
mov ebx, 0x1b
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.addtimer

Function at 0x458560
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458a08
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
nop dword [rax]
test rbx, rbx
jle 0x4589f6
test rcx, rcx
jl 0x4589e5
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rsi
jmp 0x4585ba
mov rax, r11
mov edx, dword [rax + 0x40]
mov r10d, edx
cmp r10, 9
ja 0x4587b5
lea r11, [0x0075b0a0]
jmp qword [r11 + r10*8]
call sym.runtime.badTimer
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov r11, qword [rsp + 0x40]
mov r12d, 6
jmp 0x4585b7
lea rax, [0x006de0e0]
mov ebx, 0x21
call sym.runtime.throw
lea rax, [0x006da83f]
mov ebx, 0x1b
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.runtime.modtimer
Function at 0x45b0a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b177
push rbp
mov rbp, rsp
sub rsp, 0x18
lea rdx, [rbx + 7]
nop
and rdx, 0xfffffffffffffff8
cmp qword [rax], 0
nop
je 0x45b0d2
mov rsi, qword [rax + 8]
add rsi, rdx
cmp rsi, 0xfff8
jbe 0x45b11d
cmp rdx, 0xfff8
ja 0x45b165
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x10], rdx
mov eax, 0x10000
lea rbx, [0x00991860]
call sym.runtime.sysAlloc
test rax, rax
je 0x45b154
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rax], rbx
mov qword [rdx], rax
mov qword [rdx + 8], 0
mov rax, rdx
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rax + 8]
cmp rbx, 0xfff8
jae 0x45b147
mov rcx, qword [rax]
test byte [rcx], al
lea rcx, [rcx + rbx]
lea rcx, [rcx + 8]
add rdx, rbx
mov qword [rax + 8], rdx
mov rax, rcx
add rsp, 0x18
pop rbp
ret
mov rax, rbx
mov ecx, 0xfff8
call sym.runtime.panicIndexU
lea rax, [0x006d9cf9]
mov ebx, 0x1a
call sym.runtime.throw
lea rax, [0x006db129]
mov ebx, 0x1c
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime._traceRegionAlloc_.alloc

Function at 0x45d000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d0b5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call sym.runtime._traceMap_.put
nop
test bl, bl
je 0x45d0af
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._traceStringTable_.put.func1]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime._traceStringTable_.put
Function at 0x45fc40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45fdee
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
call sym.runtime.printlock
lea rax, [0x006db145]
mov ebx, 0x1c
call sym.runtime.printstring
mov rax, qword [rsp + 0x50]
call sym.runtime.printuint
lea rax, [0x006d0c9b]
mov ebx, 3
call sym.runtime.printstring
call sym.runtime.printunlock
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rcx
xor edx, edx
jmp 0x45fcd9
mov rdx, qword [rsp + 0x30]
inc rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
jge 0x45fd5d
mov qword [rsp + 0x30], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call sym.runtime.findfunc
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
nop
test rax, rax
je 0x45fd13
mov edx, dword [rax + 4]
mov r9d, dword [rax + 0x24]
movzx r10d, byte [rax + 0x28]
jmp 0x45fd1d
xor r10d, r10d
xor r9d, r9d
xor edx, edx
xor ebx, ebx
mov r11, qword [rsp + 0x30]
test r11, r11
sete sil
mov rax, rbx
mov ebx, edx
mov ecx, r9d
mov edi, r10d
xor r8d, r8d
call sym.runtime.showfuncinfo
nop dword [rax]
test al, al
je 0x45fcc7
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sym.runtime.printAncestorTracebackFuncInfo
jmp 0x45fcc7
cmp qword [rsp + 0x78], 0x32
jne 0x45fd85
call sym.runtime.printlock
lea rax, [0x006dce34]
mov ebx, 0x1f
call sym.runtime.printstring
nop dword [rax + rax]
call sym.runtime.printunlock
mov rax, qword [rsp + 0x90]
call sym.runtime.findfunc
test rax, rax
jne 0x45fd9b
xor ecx, ecx
jmp 0x45fdca
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rax
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x24]
movzx edi, byte [rax + 0x28]
xor esi, esi
xor r8d, r8d
mov rax, rbx
mov ebx, edx
call sym.runtime.showfuncinfo
mov rbx, qword [rsp + 0x20]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x45fde8
cmp qword [rsp + 0x88], 1
je 0x45fde8
mov rcx, qword [rsp + 0x90]
xor edi, edi
call sym.runtime.printcreatedby1
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp sym.runtime.printAncestorTraceback
Function at 0x460020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4600cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers
Function at 0x468140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4681ba
push rbp
mov rbp, rsp
sub rsp, 0x18
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x4681a5
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor ecx, ecx
call sym.runtime.mallocgc
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jl 0x4681a0
mov rdx, rax
neg rdx
nop dword [rax + rax]
cmp rcx, rdx
ja 0x46818e
mov rbx, rcx
add rsp, 0x18
pop rbp
ret
test rax, rax
je 0x468198
call sym.runtime.panicunsafeslicelen
call sym.runtime.panicunsafeslicenilptr
nop dword [rax]
call sym.runtime.panicunsafeslicelen
nop
lea rax, [0x0068b540]
lea rbx, [0x00756dc0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.internal_bytealg.MakeNoZero
Function at 0x46c040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0098c06a], 0
je 0x46c04e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x46c060
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0098c06a], 0
je 0x46c075
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x46c080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0098c06a], 0
je 0x46c0b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0098c940]
aesenc xmm0, xmmword [0x0098c950]
aesenc xmm0, xmmword [0x0098c960]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x46c0c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0098c06a], 0
je 0x46c0f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0098c940]
aesenc xmm0, xmmword [0x0098c950]
aesenc xmm0, xmmword [0x0098c960]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x46d7a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x0098c2c8]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x46d83b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret
Function at 0x46da60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x0098c2c8]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x46daf7
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret

Function at 0x46dec0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46def4
mov rcx, 0x28
jmp 0x46deff
shl rcx, 3
add rcx, 0x1480
mov qword [0x0098c2c8], rcx
pop rbp
ret

Function at 0x470ca0
Capabilities:
Reference http user-agent string

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp sym.runtime.badmorestackgsignal

Function at 0x470dc0
Capabilities:
Reference http user-agent string

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp sym.runtime.check

Function at 0x470e20
Capabilities:
Reference http user-agent string

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp sym.runtime.newstack