joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44a372
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call sym.a.out.exe_runtime.pcvalue
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x44a292
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call sym.a.out.exe_runtime.funcname
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x48], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x40], rdx
call sym.a.out.exe_runtime.printlock
lea rax, [0x00661aeb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call sym.a.out.exe_runtime.printstring
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call sym.a.out.exe_runtime.printstring
call sym.a.out.exe_runtime.printsp
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call sym.a.out.exe_runtime.printhex
call sym.a.out.exe_runtime.printsp
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call sym.a.out.exe_runtime.printhex
call sym.a.out.exe_runtime.printsp
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call sym.a.out.exe_runtime.printhex
call sym.a.out.exe_runtime.printsp
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call sym.a.out.exe_runtime.printint
call sym.a.out.exe_runtime.printnl
call sym.a.out.exe_runtime.printunlock
mov eax, dword [rsp + 0x3c]
jmp 0x44a281
call sym.a.out.exe_runtime.morestack_noctxt
jmp sym.a.out.exe_runtime.funcspdelta
Function at 0x450fd0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4510b0
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [sym.a.out.exe_runtime.callers.func1]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.a.out.exe_runtime.systemstack
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call sym.a.out.exe_runtime.morestack_noctxt
jmp sym.a.out.exe_runtime.callers
Function at 0x45a8e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x45a900

Function at 0x45ae50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [sym.a.out.exe_runtime.aeskeysched]
aesenc xmm0, xmmword [0x007efc70]
aesenc xmm0, xmmword [0x007efc80]
movq qword [rsp + 0x18], xmm0
ret

Function at 0x45ae90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [sym.a.out.exe_runtime.aeskeysched]
aesenc xmm0, xmmword [0x007efc70]
aesenc xmm0, xmmword [0x007efc80]
movq qword [rsp + 0x18], xmm0
ret

Function at 0x45c9f0
Capabilities:
Access peb ldr_data

Disassembly:
lea rax, [sym.a.out.exe_runtime.lastcontinuehandler]
jmp 0x45c8c0
Function at 0x4bf880
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
neg rsi
imul rsi, rsi, 0x1c
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rsi, 0x3f
sar rdx, 5
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x4bf95b
lea rsi, [rdx + rdx*2]
lea rdi, sym.a.out.exe_strconv.powersOfTen
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x4bf904
inc rdx
jmp 0x4bf8db
cmp r9, 0xffffffffffffffe0
jle 0x4bf90f
dec rdx
jmp 0x4bf8db
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call sym.a.out.exe_runtime.panicIndex
nop
int3
Function at 0x4cf210
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x4cf231
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rbx, rcx
jl 0x4cf222
mov dword [rsp + 0x28], edx
ret
Function at 0x51c140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x51c274
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
xor eax, eax
xor ecx, ecx
jmp 0x51c18f
add rax, 2
lea ecx, [r9 + 1]
cmp rax, rdx
jge 0x51c206
lea r9, [rax + 1]
cmp r9, rdx
jae 0x51c268
mov r9d, dword [rbx + rax*4 + 4]
cmp rax, rdx
jae 0x51c260
mov r10d, dword [rbx + rax*4]
dec r10d
cmp ecx, r10d
jg 0x51c187
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rsi
mov qword [rsp + 8], r8
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r10d
call sym.a.out.exe_regexp_syntax.appendRange
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x3c]
jmp 0x51c187
cmp ecx, 0x10ffff
jle 0x51c230
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], rdi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rsi
mov qword [rsp + 8], r8
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call sym.a.out.exe_regexp_syntax.appendRange
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
jmp 0x51c20e
mov rcx, rdx
call sym.a.out.exe_runtime.panicIndex
mov rax, r9
mov rcx, rdx
call sym.a.out.exe_runtime.panicIndex
nop
call sym.a.out.exe_runtime.morestack_noctxt
jmp sym.a.out.exe_regexp_syntax.appendNegatedClass
Function at 0x53d330
Capabilities:
Hash data using sha256

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x53d477
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x40]
cmp rax, 0x20
jg 0x53d44c
lea rax, [0x00642b60]
mov qword [rsp], rax
call sym.a.out.exe_runtime.newobject
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0xb8], rcx
lea rdx, [rax + 0x78]
mov rbx, qword [rsp + 0x38]
cmp rdx, rbx
je 0x53d3b7
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
call sym.a.out.exe_runtime.memmove
nop
movups xmm0, xmmword [sym.a.out.exe_golang.org_x_crypto_blake2s.iv]
mov rax, qword [rsp + 0x18]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x005bc0f0]
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rax + 0x28]
mov rdx, qword [rax + 0xb8]
shl edx, 8
or edx, ecx
or edx, 0x1010000
xor dword [rax], edx
mov qword [rax + 0x70], 0
mov qword [rax + 0x20], 0
cmp qword [rax + 0xb8], 0
jle 0x53d435
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [rax + 0x88]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rax + 0x98]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [rax + 0xa8]
movups xmmword [rax + 0x60], xmm0
mov qword [rax + 0x70], 0x40
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [0x007d0a68]
mov rcx, qword [sym.a.out.exe_golang.org_x_crypto_blake2s.errKeySize]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call sym.a.out.exe_runtime.morestack_noctxt
jmp sym.a.out.exe_golang.org_x_crypto_blake2s.newDigest
Function at 0x53d490
Capabilities:
Hash data using sha256

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x50]
cmp rax, qword [rcx + 0x10]
jbe 0x53d701
sub rsp, 0xd0
mov qword [rsp + 0xc8], rbp
lea rbp, [rsp + 0xc8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x40], 0
movups xmm1, xmmword [sym.a.out.exe_golang.org_x_crypto_blake2s.iv]
movups xmmword [rsp + 0x48], xmm1
movups xmm1, xmmword [0x005bc0f0]
movups xmmword [rsp + 0x58], xmm1
mov rax, qword [rsp + 0xe0]
or eax, 0x1010000
xor dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0xf0]
cmp rcx, 0x40
jle 0x53d6cf
mov rax, rcx
and rcx, 0xffffffffffffffc0
lea rbx, [rcx - 0x40]
cmp rax, rcx
cmove rcx, rbx
mov rdx, qword [rsp + 0xf8]
cmp rcx, rdx
ja 0x53d6fb
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x48]
mov qword [rsp], rax
lea rbx, [rsp + 0x40]
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], 0
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
call sym.a.out.exe_golang.org_x_crypto_blake2s.hashBlocks
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xf0]
cmp rax, rcx
ja 0x53d6f6
sub rcx, rax
mov rdx, qword [rsp + 0xf8]
sub rdx, rax
neg rdx
sar rdx, 0x3f
and rax, rdx
mov rdx, qword [rsp + 0xe8]
add rax, rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rcx, [rsp + 0x88]
cmp rcx, rax
jne 0x53d6a5
lea rax, [rdx - 0x40]
neg rax
cmp dword [rsp + 0x40], eax
jae 0x53d601
dec dword [rsp + 0x44]
sub dword [rsp + 0x40], eax
lea rax, [rsp + 0x48]
mov qword [rsp], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], 0xffffffff
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0x40
mov qword [rsp + 0x28], 0x40
call sym.a.out.exe_golang.org_x_crypto_blake2s.hashBlocks
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x78], xmm0
mov rax, qword [rsp + 0xd8]
xor ecx, ecx
jmp 0x53d663
mov dword [rax + rcx], edx
lea rcx, [rbx + 1]
cmp rcx, 8
jge 0x53d695
test byte [rax], al
mov edx, dword [rsp + rcx*4 + 0x68]
mov rbx, rcx
shl rcx, 2
cmp rcx, 0x20
ja 0x53d6e9
lea rsi, [rcx - 0x20]
mov rdi, rsi
sar rsi, 0x3f
and rcx, rsi
neg rdi
cmp rdi, 3
ja 0x53d65c
jmp 0x53d6dc
mov rbp, qword [rsp + 0xc8]
add rsp, 0xd0
ret
mov qword [rsp + 0x30], rdx
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
call sym.a.out.exe_runtime.memmove
lea rcx, [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
jmp 0x53d5f0
mov rax, qword [rsp + 0xe8]
jmp 0x53d5af
mov eax, 3
mov rcx, rdi
call sym.a.out.exe_runtime.panicIndex
mov rax, rcx
mov ecx, 0x20
call sym.a.out.exe_runtime.panicSliceB
call sym.a.out.exe_runtime.panicSliceB
call sym.a.out.exe_runtime.panicSliceAcap
nop
call sym.a.out.exe_runtime.morestack_noctxt
jmp sym.a.out.exe_golang.org_x_crypto_blake2s.checkSum
Function at 0x56ef60
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x56f027
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x56ef8c
test r15, r15
je 0x56f06a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x56f03c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x56ef9b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x571130
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5711d7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x57127a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5711d7
cmp r9, 0
je 0x571333
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x571290
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5a2230
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x5a22bc
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
xorps xmm0, xmm0
movups xmmword [rax + 0xc0], xmm0
ret
cmp rcx, 0xe
jne 0x5a2336
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x5a22b1
cmp rcx, 0xf
jne 0x5a23b0
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x5a22b1
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
jmp 0x5a22b1
Function at 0x5b8f80
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov ecx, 2
call qword [fcn.005bacc0]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop

Function at 0x5b9090
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov r8, rdx
xor edx, edx
call qword [sym.imp.msvcrt.dll__beginthread]
cmp rax, 0xffffffffffffffff
je 0x5b90ac
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, 2
mov ebx, dword [rax]
call qword [fcn.005bacc0]
lea rdx, [0x007cbf00]
mov rcx, rax
mov r8d, ebx
call sub.msvcrt.dll_fprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x5b9250
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
lock xadd dword [0x007f2728], eax
test eax, eax
je 0x5b92a8
lea rcx, [0x007f2700]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x007f2700]
mov dword [0x007f26e8], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x007f26f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x5b9329
add rsp, 0x20
pop rbx
ret
mov eax, 1
lock xadd dword [0x007f272c], eax
test eax, eax
je 0x5b92f0
lock sub dword [0x007f272c], 1
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5b92d4
xor ecx, ecx
call rbx
xor eax, eax
lock xadd dword [0x007f2728], eax
test eax, eax
je 0x5b92d0
jmp 0x5b9263
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x007f26f0], rax
test rax, rax
je 0x5b9353
lea rcx, [0x007f2700]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lock add dword [0x007f2728], 1
jmp 0x5b9263
mov ecx, 2
call qword [fcn.005bacc0]
mov r8d, 0x3b
mov edx, 1
lea rcx, str.runtime:_failed_to_signal_runtime_initialization_complete._n
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
call fcn.005b8f80
nop
nop dword [rax]

Function at 0x5b93d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x5b9403
movdqu xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
add rsp, 0x20
pop rbx
jmp sym.a.out.exe__cgo_sys_thread_start
mov ecx, 2
call qword [fcn.005bacc0]
mov r8d, 0x2b
mov edx, 1
lea rcx, str.runtime_cgo:_out_of_memory_in_thread_start_n
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
push r12
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx]
mov rbx, qword [rcx + 8]
mov r12, qword [rcx + 0x10]
call sub.msvcrt.dll_free
mov qword gs:[0x28], rbx
mov rax, qword gs:[0x28]
mov qword [rax], rsi
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.a.out.exe_crosscall_amd64
Function at 0x5b9480
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8, rcx
lea rcx, [0x005b9430]
call qword [sym.imp.msvcrt.dll__beginthread]
cmp rax, 0xffffffffffffffff
je 0x5b94a3
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, 2
mov ebx, dword [rax]
call qword [fcn.005bacc0]
lea rdx, str.runtime:_failed_to_create_new_OS_thread___d__n
mov rcx, rax
mov r8d, ebx
call sub.msvcrt.dll_fprintf
call sub.msvcrt.dll_abort
nop
nop
nop

Function at 0x5b99a0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.005bacc0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.005bacc0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x5b9a10
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x007f2d34]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x5b9bb8
mov rax, qword [0x007f2d38]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x5b9a5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x5b9ae7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x5b9a40
mov rcx, r12
call fcn.005ba770
mov rbp, rax
test rax, rax
je 0x5b9bf2
mov rax, qword [0x007f2d38]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.005ba8a0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x007f2d38]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x5b9c01
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x5b9ae0
sub eax, 4
and eax, 0xfffffffb
jne 0x5b9b70
add dword [0x007f2d34], 1
cmp ebx, 8
jae 0x5b9b18
test bl, 4
jne 0x5b9bc0
test ebx, ebx
je 0x5b9b09
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x5b9be0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x5b9b09
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x5b9b4a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x007f2d38]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x5b9ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.005b99a0
nop dword [rax]
xor edi, edi
jmp 0x5b9a67
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x5b9b09
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x5b9b09
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.005b99a0
mov rax, qword [0x007f2d38]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.005b99a0
nop
nop dword [rax]