joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40931b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x84], ebx
test ebx, 0xffff0000
jne 0x409346
cmp dword [edi + 0x80], 0
jne 0x409346
movzx eax, bx
mov dword [edi + 0x80], eax
call fcn.004087bd
push 5
push ebx
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.004095b4
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x409373
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004087bd
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4093a6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.004093b9
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40c18f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x40c1e2
push esi
push dword [ebp + 8]
call fcn.0040c375
mov edi, eax
test edi, edi
je 0x40c1dd
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40c1dd
mov eax, dword [ebp - 8]
jmp 0x40c1f4
mov eax, dword [ebp + 0x10]
jmp 0x40c1f4
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc
Function at 0x40f854
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00416c69
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x40f890
call fcn.0040fa71
mov dword [esi + 0xc], 1
jmp 0x40f895
call fcn.0040fa71
cmp dword [esi], 0
je 0x40f8e0
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x40f8bb
push edi
call fcn.00407d79
lea ecx, [edi + 1]
push ecx
jmp 0x40f8ca
push 0xff
call fcn.0040751e
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00407d9c
pop edi
jmp 0x40f904
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x40f904
push dword [esi]
push dword [ebp - 4]
call fcn.00419b66
pop esi
leave
ret 0xc

Function at 0x40f9c8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0040fa71
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x40fa10
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00407d79
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407d9c
jmp 0x40fa1b
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00419b66
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x411cc8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x411d07
call fcn.004087bd
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x411d07
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411d0f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0041a30d
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41272c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4127b8
cmp dword [esi + 0x20], 0
je 0x4127b8
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4127b8
cmp dword [ebp + 8], 0
je 0x4127b8
xor edi, edi
mov ebx, edi
call fcn.004087bd
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x41279c
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4127b8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.0042195c
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4127b4
mov ecx, esi
call fcn.004124ca
mov eax, edi
jmp 0x4127ba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x416d23
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x55e4db
call fcn.00540128
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x416d49
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x416da3
lea ecx, [ebp - 0x10]
call fcn.00401e40
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x56d9ac]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00547a6e
push eax
call fcn.0040676b
add esp, 0x14
test esi, esi
je 0x416d96
push esi
call fcn.00547af0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040762e
mov eax, ebx
call fcn.005400f6
ret 8

Function at 0x423502
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x423558
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x423531
call fcn.0040ebb5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x423546
call fcn.0040ebb5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x423558
call fcn.0040ebb5
call fcn.004087bd
cmp dword [eax + 0x3c], 0
je 0x42356d
push edi
mov ecx, ebx
call fcn.00422c25
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00423753
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x423596
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4235a2
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4475a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x4475bd
call fcn.004087bd
mov esi, dword [eax + 0xc]
push 0x578efc
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4475ff
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4475ff
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4475ff
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00447608
jmp 0x447601
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4e0723
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x567cd0
call fcn.0054015b
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00402570
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x57042c
call fcn.0040b274
cmp eax, 0xffffffff
jne 0x4e07fe
push 0
push 0x578b64
lea ecx, [ebp - 0x278]
call fcn.0040b274
cmp eax, 0xffffffff
jne 0x4e07fe
push 0
push 0x5712dc
lea ecx, [ebp - 0x278]
call fcn.0040b274
cmp eax, 0xffffffff
jne 0x4e07fe
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00402570
add eax, 0x10
pop ecx
mov dword [ebp - 0x280], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x27c], edi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x4e07cd
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x56d9ac]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.0040762e
jmp 0x4e0837
lea eax, [ebp - 0x114]
push eax
call fcn.00547af0
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.004034a0
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040762e
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4e0824
mov edi, dword [ebp - 0x274]
jmp 0x4e0837
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x56d9ac]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0040762e
mov eax, edi
call fcn.0054010a
ret

Function at 0x4fa3c3
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0054fd09
pop ecx
test eax, eax
jne 0x4fa405
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040c6b5
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4fa3cb
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret
Function at 0x55831c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00557f99
Function at 0x402a30
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x75421c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402c00
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_chacha8rand.setup
Function at 0x40b0c0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x75421c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b28b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b0e9
mov eax, 0x7000000
jmp 0x40b0f1
test eax, eax
je 0x40b266
mov dword [esp + 0x34], eax
mov ecx, dword [0x75421c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x448]
mov ebx, dword [ecx + 0x44c]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x448], ebx
mov dword [ecx + 0x44c], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x72dd80]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40b27e
cmp edx, 0x21
jae 0x40b272
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x6b5748]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x6b57b8]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b241
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x6b57f8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand
Function at 0x412970
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x75421c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412b6e
sub esp, 0x18
mov eax, dword [0x754158]
test eax, eax
jne 0x412b57
nop
nop
lea eax, [0x754148]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x75414c]
test eax, eax
je 0x4129b8
cmp dword [eax + 8], 0xcc
jne 0x412a2e
mov edx, dword [0x754150]
test edx, edx
jne 0x412a10
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x757030]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x754150], eax
mov ecx, dword [0x754154]
mov dword [eax], ecx
mov eax, dword [0x754150]
mov dword [0x754154], eax
movzx eax, byte [0x7545c0]
test al, al
jne 0x412a10
xor eax, eax
jmp 0x412b28
mov edx, dword [0x754150]
mov ebx, dword [edx + 4]
mov dword [0x754150], ebx
mov ebx, dword [0x75414c]
mov dword [edx + 4], ebx
mov dword [0x75414c], edx
mov edx, dword [0x75414c]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x412b07
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.internal_runtime_atomic.Xadd
mov eax, dword [0x754308]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x412a80
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x412ac0
call sym.runtime.gcWriteBarrier8
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x754148]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x754144]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.internal_runtime_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x72d228]
movzx ebx, byte [edx + eax]
lea ebp, [0x7545c0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x412a10
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x412b11
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x4c5864]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x4178f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x75421c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x417979
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call sym.internal_runtime_atomic.Cas
movzx eax, byte [esp + 0xc]
test al, al
je 0x41795e
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x417962
mov dword [esp], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call sym.runtime._gcCPULimiterState_.updateLocked
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym.runtime._gcCPULimiterState_.unlock
add esp, 0x10
ret
add esp, 0x10
ret
lea eax, [0x4c587c]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._gcCPULimiterState_.update
Function at 0x426e00
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x75421c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426f44
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.spanOfHeap
mov eax, dword [esp + 4]
test eax, eax
je 0x426f2d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x75421c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sym.runtime._mspan_.ensureSwept
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call sym.runtime.lock2
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x426e97
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x426ec2
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x426eac
cmp byte [ebp + 6], bl
je 0x426eb7
cmp esi, edx
ja 0x426ebe
jne 0x426e95
cmp byte [ebp + 6], bl
jbe 0x426e95
jmp 0x426ebe
mov ebx, 1
jmp 0x426ec4
xor ebx, ebx
jmp 0x426ec4
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x426ee2
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call sym.runtime.spanHasSpecials
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x75421c]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x426f1d
movzx eax, byte [ebx + 0x69]
test al, al
je 0x426f1d
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x4c6daa]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.addspecial
Function at 0x4273c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x75421c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42759a
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x4274c5
cmp cl, 1
je 0x427454
cmp cl, 2
jne 0x427583
mov ecx, dword [eax + 8]
test byte [ecx], al
mov dword [esp], ecx
mov dword [esp + 4], 0
call sym.internal_runtime_atomic.Storeuintptr
nop
nop
lea eax, [0x740808]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x7407fc]
sub eax, dword [0x7407e0]
nop
mov dword [0x7407fc], eax
mov eax, dword [0x7407ec]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7407ec], ecx
nop
lea eax, [0x740808]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42757f
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call sym.runtime.queuefinalizer
nop
nop
lea eax, [0x740808]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x74075c]
sub eax, dword [0x740740]
nop
mov dword [0x74075c], eax
mov eax, dword [0x74074c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x74074c], ecx
nop
lea eax, [0x740808]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42757f
cmp cl, 3
je 0x427527
cmp cl, 4
jne 0x4274d8
mov byte [eax + 8], 1
jmp 0x42757f
cmp cl, 5
jne 0x427583
nop
nop
lea eax, [0x740808]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x7407d4]
sub eax, dword [0x7407b8]
nop
mov dword [0x7407d4], eax
mov eax, dword [0x7407c4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7407c4], ecx
nop
lea eax, [0x740808]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42757f
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call sym.runtime.mProf_Free
nop
nop
lea eax, [0x740808]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x740784]
sub eax, dword [0x740768]
nop
mov dword [0x740784], eax
mov eax, dword [0x740774]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x740774], ecx
nop
nop
lea eax, [0x740808]
mov dword [esp], eax
call sym.runtime.unlock2
add esp, 0x14
ret
lea eax, [0x4c34ea]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.freeSpecial