joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab081
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x4ab0a9
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x4ab0ba
push 2
call edi
test ax, ax
jge 0x4ab0ba
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0049faf2
cmp dword [esi + 0x30], ebx
jne 0x4ab194
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, pe_nt_image_headers32
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0049faf2
cmp eax, dword [esp + 0x34]
jne 0x4ab194
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x4ab130
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x4ab175
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x4ab194
cmp eax, 0x205
je 0x4ab194
cmp eax, 0x201
je 0x4ab194
cmp eax, 0x204
je 0x4ab194
cmp eax, ebx
jne 0x4ab15b
cmp dword [esp + 0x1c], 0x1b
je 0x4ab194
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x5169cc]
jbe 0x4ab18a
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x4ab0ed
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x4051cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4087b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004042ba
and dword [ebp - 0x14], 0
cmp dword [0x40c5f0], 0
mov dword [ebp - 0x18], eax
jne 0x40527e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405326
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405326
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40c5f0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40c5f4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40c5f8], eax
call edi
push eax
call esi
mov dword [0x40c600], eax
test eax, eax
je 0x40527e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40c5fc], eax
mov eax, dword [0x40c5fc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4052d7
cmp dword [0x40c600], ecx
je 0x4052d7
push eax
call esi
push dword [0x40c600]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4052d7
test ebx, ebx
je 0x4052d7
call edi
test eax, eax
je 0x4052ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4052ce
test byte [ebp - 8], 1
jne 0x4052d7
or dword [ebp + 0x10], 0x200000
jmp 0x40530a
mov eax, dword [0x40c5f4]
cmp eax, dword [ebp - 0x18]
je 0x40530a
push eax
call esi
test eax, eax
je 0x40530a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40530a
mov eax, dword [0x40c5f8]
cmp eax, dword [ebp - 0x18]
je 0x40530a
push eax
call esi
test eax, eax
je 0x40530a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40c5f0]
call esi
test eax, eax
je 0x405326
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405328
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405536
leave
ret

Function at 0x405536
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4087b0]
jne 0x405540
repz ret
jmp fcn.004066a3
Function at 0x46a1ef
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50000
call fcn.00431940
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20004]
push eax
push 0x7fff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
test eax, eax
je 0x46a34c
push ebx
lea eax, [ebp - 0x20004]
push eax
lea eax, [ebp - 0x10004]
push str.___s
push eax
call fcn.00423698
lea eax, [ebp - 0x10004]
push eax
call fcn.00422bfc
mov ebx, eax
add esp, 0x10
cmp word [ebp + ebx*2 - 0x10006], 0x5c
jne 0x46a267
cmp word [ebp + ebx*2 - 0x10008], 0x3a
je 0x46a267
xor eax, eax
mov word [ebp + ebx*2 - 0x10006], ax
push edi
xor edi, edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x46a281
cmp byte [ebp + 0x10], al
je 0x46a33d
push edi
push 0x2200000
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x46a334
push 0x2fffa
lea eax, [ebp - 0x50000]
push 0
push eax
call fcn.00422de0
lea eax, [ebx + ebx]
mov dword [ebp - 0x50000], 0xa0000003
mov word [ebp - 0x4fff6], ax
mov eax, dword [ebp - 0x4fff6]
add eax, 2
mov word [ebp - 0x4fff4], ax
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
lea eax, [ebp - 0x4fff0]
push eax
call fcn.004240bb
mov eax, dword [ebp - 0x4fff6]
lea ecx, [ebp + 8]
add esp, 0x18
xor edx, edx
add eax, 0xc
mov word [ebp - 0x4fffc], ax
movzx eax, ax
push edx
push ecx
push edx
push edx
add eax, 8
push eax
lea eax, [ebp - 0x50000]
push eax
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push edi
test eax, eax
jne 0x46a341
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
xor eax, eax
jmp 0x46a34a
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40b7b0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b97b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b7d9
mov eax, 0x7000000
jmp 0x40b7e1
test eax, eax
je 0x40b956
mov dword [esp + 0x14], eax
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x59acc0]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40b96e
cmp edx, 0x21
jae 0x40b962
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x511d98]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x511df0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b931
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x511e40]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand
Function at 0x415700
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41590e
sub esp, 0x18
mov eax, dword [0x5c7114]
test eax, eax
jne 0x4158f7
nop
nop
lea eax, [0x5c7104]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x5c7108]
test eax, eax
je 0x415748
cmp dword [eax + 8], 0xcc
jne 0x4157be
mov edx, dword [0x5c710c]
test edx, edx
jne 0x4157a0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5cb910]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x5c710c], eax
mov ecx, dword [0x5c7110]
mov dword [eax], ecx
mov eax, dword [0x5c710c]
mov dword [0x5c7110], eax
movzx eax, byte [0x5c75e0]
test al, al
jne 0x4157a0
xor eax, eax
jmp 0x4158c8
mov edx, dword [0x5c710c]
mov ebx, dword [edx + 4]
mov dword [0x5c710c], ebx
mov ebx, dword [0x5c7108]
mov dword [edx + 4], ebx
mov dword [0x5c7108], edx
mov edx, dword [0x5c7108]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4158a7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime_internal_atomic.Xadd
mov eax, dword [0x5c7340]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x415808
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x41581e
call sym.runtime.gcWriteBarrier2
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x5c7340]
test eax, eax
jne 0x415842
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x415870
call sym.runtime.gcWriteBarrier6
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x5c7104]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x5c7100]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.runtime_internal_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x59a200]
movzx ebx, byte [edx + eax]
lea ebp, [0x5c75e0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x4157a0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x4158b1
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x4ef4c8]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x4233e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4234e3
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x4234dd
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call sym.runtime._atomicScavChunkData_.load
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call sym.runtime._scavChunkData_.alloc
movzx eax, byte [esp + 0x18]
test al, 2
je 0x423491
cmp word [esp + 0x10], 0x1f0
jbe 0x423491
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + 0x30]
test bl, bl
jne 0x423495
mov ebx, dword [esp + 0x28]
cmp ebx, 0x200
jae 0x423495
nop
jmp 0x423495
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x4234d8
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call sym.runtime._atomicScavChunkData_.store
add esp, 0x1c
ret
call sym.runtime.panicIndexU
call sym.runtime.panicIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._scavengeIndex_.alloc
Function at 0x4234f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423624
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x42361e
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call sym.runtime._atomicScavChunkData_.load
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call sym.runtime._scavChunkData_.free
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x423617
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call sym.runtime._atomicScavChunkData_.store
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x4235da
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call sym.runtime._atomicOffAddr_.Load
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x423613
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sym.runtime_internal_atomic.Storeint64
add esp, 0x20
ret
mov eax, edx
call sym.runtime.panicIndexU
call sym.runtime.panicIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._scavengeIndex_.free
Function at 0x429090
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4291d4
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.spanOfHeap
mov eax, dword [esp + 4]
test eax, eax
je 0x4291bd
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x5c71e0]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sym.runtime._mspan_.ensureSwept
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call sym.runtime.lock2
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x429127
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x429152
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x42913c
cmp byte [ebp + 6], bl
je 0x429147
cmp esi, edx
ja 0x42914e
jne 0x429125
cmp byte [ebp + 6], bl
jbe 0x429125
jmp 0x42914e
mov ebx, 1
jmp 0x429154
xor ebx, ebx
jmp 0x429154
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x429172
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call sym.runtime.spanHasSpecials
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x5c71e0]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x4291ad
movzx eax, byte [ebx + 0x65]
test al, al
je 0x4291ad
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x4f0b76]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.addspecial
Function at 0x429660
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4297d0
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x429760
cmp cl, 1
je 0x4296f2
cmp cl, 2
jne 0x4297b9
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call sym.runtime.mProf_Free
nop
nop
lea eax, [0x5ab700]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x5ab6a4]
sub eax, dword [0x5ab688]
nop
mov dword [0x5ab6a4], eax
mov eax, dword [0x5ab694]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5ab694], ecx
nop
lea eax, [0x5ab700]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x4297b5
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call sym.runtime.queuefinalizer
nop
nop
lea eax, [0x5ab700]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x5ab67c]
sub eax, dword [0x5ab660]
nop
mov dword [0x5ab67c], eax
mov eax, dword [0x5ab66c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5ab66c], ecx
nop
lea eax, [0x5ab700]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x4297b5
cmp cl, 3
jne 0x42976b
mov byte [eax + 8], 1
jmp 0x4297b5
cmp cl, 4
jne 0x4297b9
nop
nop
lea eax, [0x5ab700]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x5ab6f4]
sub eax, dword [0x5ab6d8]
nop
mov dword [0x5ab6f4], eax
mov eax, dword [0x5ab6e4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5ab6e4], ecx
nop
nop
lea eax, [0x5ab700]
mov dword [esp], eax
call sym.runtime.unlock2
add esp, 0x14
ret
lea eax, [0x4ecd31]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.freeSpecial
Function at 0x42f580
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42f641
sub esp, 0x2c
movzx ecx, byte [esp + 0x3c]
test cl, cl
je 0x42f5ae
mov byte [esp], 6
call sym.runtime.stopTheWorld
movzx ecx, byte [esp + 0x3c]
mov dword [esp + 4], 0
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x42f5c2
test cl, cl
jmp 0x42f62e
mov ebx, dword [0x5c71e0]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
lea ebp, [esp + 0x30]
lea edi, [esp + 8]
xor eax, eax
call fcn.00465777
lea ecx, [sym.runtime.Stack.func1]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
movzx ecx, byte [esp + 0x3c]
mov byte [esp + 0x24], cl
lea edx, [esp + 4]
mov dword [esp + 0x28], edx
lea edx, [esp + 8]
mov dword [esp], edx
call sym.runtime.systemstack
movzx ecx, byte [esp + 0x3c]
test cl, cl
je 0x42f635
call sym.runtime.startTheWorld
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
add esp, 0x2c
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.Stack
Function at 0x431cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5c71e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x431e9f
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call sym.runtime.lock2
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x24]
movzx edx, byte [esp + 0x28]
test dl, dl
jne 0x431d10
mov ecx, dword [eax + 0x60]
mov ebx, dword [esp + 0x24]
cmp ebx, ecx
jne 0x431e60
test dl, dl
je 0x431d90
mov ecx, dword [eax + 0x58]
mov ebx, dword [eax + 0x5c]
test ebx, ebx
setl bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test ecx, ecx
setbe cl
and ebp, ecx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x431e88
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x431e88
mov dword [eax + 0x58], 0xffffffff
mov dword [eax + 0x5c], 0xffffffff
mov dword [esp], eax
call sym.runtime._pollDesc_.publishInfo
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call sym.runtime.netpollunblock
mov eax, dword [esp + 0xc]
movzx edx, byte [esp + 0x28]
mov ecx, eax
mov eax, dword [esp + 0x20]
jmp 0x431d92
xor ecx, ecx
mov dword [esp + 0x14], ecx
movzx ebx, byte [esp + 0x29]
test bl, bl
je 0x431e18
mov ebx, dword [eax + 0x94]
mov ebp, dword [eax + 0x98]
test ebp, ebp
xchg ebp, ebx
setl bl
xchg ebp, ebx
xchg esi, ebx
sete bl
xchg esi, ebx
test ebx, ebx
setbe bl
and esi, ebx
or esi, ebp
xchg esi, eax
test al, al
xchg esi, eax
jne 0x431e72
mov ebx, dword [eax + 0x78]
test ebx, ebx
jne 0x431ddd
test dl, dl
je 0x431e72
mov dword [eax + 0x94], 0xffffffff
mov dword [eax + 0x98], 0xffffffff
mov dword [esp], eax
call sym.runtime._pollDesc_.publishInfo
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call sym.runtime.netpollunblock
mov eax, dword [esp + 0xc]
jmp 0x431e1a
xor eax, eax
mov dword [esp + 0x10], eax
nop
nop
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call sym.runtime.unlock2
mov eax, dword [esp + 0x14]
test eax, eax
je 0x431e44
mov dword [esp], eax
mov dword [esp + 4], 0
call sym.runtime.netpollgoready
mov eax, dword [esp + 0x10]
test eax, eax
je 0x431e5c
mov dword [esp], eax
mov dword [esp + 4], 0
call sym.runtime.netpollgoready
add esp, 0x1c
ret
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime.unlock2
add esp, 0x1c
ret
lea eax, [0x4f22c8]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call sym.runtime.throw
lea eax, [0x4f2047]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.netpolldeadlineimpl