joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ed1e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045f9d6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045ee7e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45ee68
test ebx, ebx
jl 0x45ee0c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd15182
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45ee2d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45ee1f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004607ee
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004607ee
add esp, 8
mov ebx, 0x80070057
jmp 0x45ee0c
Function at 0x47591e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004765d6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00475a7e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x475a68
test ebx, ebx
jl 0x475a0c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2bd82
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x475a2d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x475a1f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004773ee
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004773ee
add esp, 8
mov ebx, 0x80070057
jmp 0x475a0c
Function at 0x48ca4e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048d706
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048cbae
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48cb98
test ebx, ebx
jl 0x48cb3c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd42eb2
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48cb5d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48cb4f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048e51e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048e51e
add esp, 8
mov ebx, 0x80070057
jmp 0x48cb3c
Function at 0x4a370e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a43c6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a386e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a3858
test ebx, ebx
jl 0x4a37fc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd59b72
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a381d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a380f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a51de
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a51de
add esp, 8
mov ebx, 0x80070057
jmp 0x4a37fc
Function at 0x4b8151
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c03b0
cmp edx, dword [eax]
je 0x4b8173
add eax, 8
inc ecx
cmp eax, 0x4c0440
jl 0x4b8164
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c03b0]
jne 0x4b82a1
mov eax, dword [0x4c4d64]
cmp eax, 1
je 0x4b827b
test eax, eax
jne 0x4b81a4
cmp dword [0x4c02d8], 1
je 0x4b827b
cmp edx, 0xfc
je 0x4b82a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b81db
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b8b30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b8fc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b821e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b8fc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bd80c
push edi
call fcn.004bae90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b8b30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b8b40
lea eax, [ebp - 0xa0]
push 0x4bd7ec
push eax
call fcn.004b8b40
push dword [esi + 0x4c03b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b8b40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bae04
add esp, 0x2c
pop edi
jmp 0x4b82a1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c03b4]
push 0
push eax
push dword [esi]
call fcn.004b8fc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40ae60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b00e
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40aff5
mov ebp, dword [eax]
cmp ebp, 0
je 0x40aff5
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x40aeb9
mov ebx, 0x56c6a0
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call dbg.runtime.throw
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40af53
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp ecx, 8
jae 0x40aef5
mov esi, ecx
shl esi, 3
add esi, 8
mov ebx, edx
add ebx, esi
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp eax, dword [esp + 0x1c]
jne 0x40aeef
cmp esi, dword [esp + 0x18]
je 0x40af27
inc ecx
cmp ecx, 8
jb 0x40aed2
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x38]
mov eax, ebp
sub eax, 4
mov ebx, edx
add ebx, eax
mov edx, dword [ebx]
xor ebp, ebp
cmp edx, ebp
jne 0x40aecb
mov ebx, 0xb29a34
mov dword [esp], ebx
call dbg.runtime/internal/atomic.Loadp
mov ebx, dword [esp + 4]
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
mov ebx, edx
add ebx, ecx
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40aeef
mov eax, edx
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x36]
mov edx, ebp
imul edx, ecx
add edx, 0x48
mov ebx, eax
add ebx, edx
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x24]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40aff1
shl ebx, cl
dec ebx
mov ecx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x38]
imul eax, ebp
mov edx, dword [edi + 0xc]
add edx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40aecb
shr ecx, 1
and ecx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x38]
mov ebx, ebp
mov ebp, ecx
imul ebp, ebx
mov ecx, eax
add ecx, ebp
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40afed
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40afed
mov eax, 1
cmp al, 0
jne 0x40aecb
mov edx, ecx
jmp 0x40aecb
xor eax, eax
jmp 0x40afdd
xor ebx, ebx
jmp 0x40af8a
mov ebx, 0xb29a34
mov dword [esp], ebx
call dbg.runtime/internal/atomic.Loadp
mov ebx, dword [esp + 4]
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.mapaccess1_fast64
Function at 0x4224a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4226b3
sub esp, 0x34
mov ecx, dword [esp + 0x38]
movzx ebp, byte [ecx + 6]
xchg ebp, eax
cmp al, 1
xchg ebp, eax
jne 0x422597
mov ebx, dword [esp + 0x3c]
mov dword [esp], ebx
mov ebp, dword [ecx + 8]
mov dword [esp + 4], ebp
mov ebp, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov ebp, dword [ecx + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x20], ecx
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], ebp
call dbg.runtime.queuefinalizer
mov ebx, 0xb2f6e0
mov dword [esp], ebx
add dword [esp], 0x2218
call dbg.runtime.lock
mov eax, 0xb2f6e0
add eax, 0x21d8
mov edx, dword [esp + 0x20]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x24], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x14], edx
cmp edx, 0
je 0x422593
cmp byte [0xb3d87c], 0
jne 0x42257d
mov dword [edx], ebp
cmp eax, 0
je 0x422579
cmp byte [0xb3d87c], 0
jne 0x422568
mov dword [eax + 0xc], edx
mov ebx, 0xb2f6e0
mov dword [esp], ebx
add dword [esp], 0x2218
call dbg.runtime.unlock
add esp, 0x34
ret
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call dbg.runtime.writebarrierptr
jmp 0x422550
mov dword [eax], eax
jmp 0x422544
mov dword [esp], edx
mov dword [esp + 4], ebp
call dbg.runtime.writebarrierptr
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
jmp 0x42253f
mov dword [edx], eax
jmp 0x422534
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jne 0x422659
mov dword [esp + 0x1c], ecx
mov ebp, dword [ecx + 8]
mov dword [esp], ebp
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], ebx
call dbg.runtime.mProf_Free
mov ebx, 0xb2f6e0
mov dword [esp], ebx
add dword [esp], 0x2218
call dbg.runtime.lock
mov eax, 0xb2f6e0
add eax, 0x21f8
mov edx, dword [esp + 0x1c]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x28], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x18], edx
cmp edx, 0
je 0x422655
cmp byte [0xb3d87c], 0
jne 0x42263f
mov dword [edx], ebp
cmp eax, 0
je 0x42263b
cmp byte [0xb3d87c], 0
jne 0x42262a
mov dword [eax + 0xc], edx
mov ebx, 0xb2f6e0
mov dword [esp], ebx
add dword [esp], 0x2218
call dbg.runtime.unlock
jmp 0x422564
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call dbg.runtime.writebarrierptr
jmp 0x422611
mov dword [eax], eax
jmp 0x422605
mov dword [esp], edx
mov dword [esp + 4], ebp
call dbg.runtime.writebarrierptr
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
jmp 0x422600
mov dword [edx], eax
jmp 0x4225f5
mov ebx, 0x55f420
mov dword [esp], ebx
mov dword [esp + 4], 0x10
call dbg.runtime.throw
mov ebx, 0x557ba0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xb
mov dword [esp], 0x50b9c0
lea ebx, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call dbg.runtime.convT2E
lea ebx, [esp + 0xc]
cld
mov ecx, dword [ebx]
mov dword [esp], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 4], ecx
call dbg.runtime.gopanic
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.freespecial
Function at 0x423590
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4236df
sub esp, 0x28
mov ebx, 0xb3da6c
mov dword [esp], ebx
call dbg.runtime.lock
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov eax, 2
mov dword [esp + 0x14], ecx
mov ebp, dword [ecx + 0x18]
mov byte [ebp + 0x1e9], al
mov ebx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
call dbg.runtime.printlock
mov ebx, 0x558880
mov dword [esp], ebx
mov dword [esp + 4], 0xa
call dbg.runtime.printstring
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
call dbg.runtime.printpointer
mov ebx, 0x548950
mov dword [esp], ebx
mov dword [esp + 4], 2
call dbg.runtime.printstring
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call dbg.runtime.printhex
mov ebx, 0x548944
mov dword [esp], ebx
mov dword [esp + 4], 2
call dbg.runtime.printstring
call dbg.runtime.printunlock
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call dbg.runtime.goroutineheader
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call dbg.runtime.getcallerpc
mov ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call dbg.runtime.getcallersp
mov edx, dword [esp + 4]
lea ebx, [esp + 0x18]
mov ecx, 0x4458f0
mov dword [ebx], ecx
mov ecx, dword [esp + 8]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov ecx, dword [esp + 0x14]
mov dword [ebx + 0xc], ecx
mov dword [esp], ebx
call dbg.runtime.systemstack
call dbg.runtime.printlock
mov ebx, 0x548cfc
mov dword [esp], ebx
mov dword [esp + 4], 1
call dbg.runtime.printstring
call dbg.runtime.printunlock
xor eax, eax
mov ebx, dword [esp + 0x14]
mov ebp, dword [ebx + 0x18]
mov byte [ebp + 0x1e9], al
mov ebx, 0xb3da6c
mov dword [esp], ebx
call dbg.runtime.unlock
add esp, 0x28
ret
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.tracefree
Function at 0x423c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423dec
sub esp, 0x34
mov eax, dword [esp + 0x38]
xor ebx, ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x48], ebx
xor edx, edx
mov byte [esp + 0x24], dl
mov dword [esp + 0x28], edx
mov byte [esp + 0x2c], dl
mov ebx, eax
dec ebx
and ebx, eax
cmp ebx, 0
jne 0x423de1
mov ebx, eax
dec ebx
xor ebx, 0xffffffff
mov dword [esp + 0x30], ebx
mov ebx, eax
and ebx, 1
cmp ebx, 0
jne 0x423cd4
mov ebx, edx
inc ebx
mov edx, ebx
mov byte [esp + 0x24], bl
shr eax, 1
mov ebx, eax
and ebx, 1
cmp ebx, 0
je 0x423cbf
mov ebp, 0x3f
mov dword [esp + 0x38], eax
xor esi, esi
mov edi, eax
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
xchg ebp, eax
mov byte [esp + 0x1b], al
xchg ebp, eax
cmp ecx, 0x40
jae 0x423dd8
cmp ecx, 0x20
jae 0x423dcd
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0xc], esi
call dbg.runtime.uint64div
movzx ebp, byte [esp + 0x1b]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 1
jb 0x423d5a
jbe 0x423d53
mov ebx, ebp
dec ebx
mov ebp, ebx
jmp 0x423ce1
cmp edx, 0
jb 0x423d5a
jmp 0x423d4c
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
cmp ecx, 0x40
jae 0x423dc7
cmp ecx, 0x20
jae 0x423dbf
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call dbg.runtime.uint64div
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1b]
mov eax, ebx
movzx ebx, byte [esp + 0x24]
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ecx
mov byte [esp + 0x44], al
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x48], ebx
add esp, 0x34
ret
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x423d75
xor edx, edx
xor eax, eax
jmp 0x423d6b
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x423d0a
xor edx, edx
xor eax, eax
jmp 0x423cfc
xor ecx, ecx
mov dword [esp + 0x30], ecx
jmp 0x423cb5
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.computeDivMagic
Function at 0x42f850
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x70]
inc edx
mov dword [ecx + 0x70], edx
mov ecx, 1
mov byte [eax + 0x85], cl
mov ecx, 0xfffffade
mov dword [eax + 8], ecx
mov ebp, dword [eax + 0x18]
mov ebx, dword [ebp + 0x54]
mov ecx, dword [ebx + 0x14]
mov ebp, dword [eax + 0x18]
mov dword [ebp + 0x200], ecx
mov ecx, 1
mov byte [eax + 0x87], cl
mov dword [esp + 0x18], eax
mov ebp, dword [eax + 0x18]
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax + 0x14]
inc ecx
mov dword [eax + 0x14], ecx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call dbg.runtime.getcallerpc
mov ebx, dword [esp + 4]
mov dword [esp + 0x10], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call dbg.runtime.getcallersp
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 4]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0xc], esi
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x20], esi
xor edx, edx
mov dword [ecx + 0x34], edx
xor edx, edx
mov dword [ecx + 0x30], edx
xor edx, edx
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x28], ecx
mov ebp, dword [eax + 0x20]
mov dword [eax + 0x3c], ebp
mov ebp, dword [eax + 0x24]
mov dword [eax + 0x40], ebp
mov edx, dword [eax + 0x3c]
mov ebp, dword [eax]
cmp edx, ebp
jb 0x42f9e4
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0x3c]
cmp edx, ebp
jb 0x42f9e4
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call dbg.runtime.casgstatus
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x3c]
mov ebp, dword [ecx]
cmp eax, ebp
jb 0x42f9c2
mov eax, dword [ecx + 4]
mov ebp, dword [ecx + 0x3c]
cmp eax, ebp
jb 0x42f9c2
mov ebx, 0x5861f8
mov dword [esp], ebx
call dbg.runtime.systemstack
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call dbg.runtime.getcallerpc
mov ebx, dword [esp + 4]
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call dbg.runtime.getcallersp
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], ecx
xor ecx, ecx
mov dword [eax + 0x34], ecx
xor ecx, ecx
mov dword [eax + 0x30], ecx
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x28], eax
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x70]
dec ecx
mov dword [eax + 0x70], ecx
add esp, 0x3c
ret
lea ebx, [esp + 0x1c]
mov edx, 0x445f00
mov dword [ebx], edx
mov edx, dword [esp + 0xc]
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
mov dword [esp], ebx
call dbg.runtime.systemstack
jmp 0x42f956
mov edi, esi
mov esi, dword [eax + 0x20]
mov edx, dword [eax + 0x3c]
lea ebx, [esp + 0x28]
mov dword [esp + 0x14], 0x445d90
mov ebp, dword [esp + 0x14]
mov dword [ebx], ebp
mov dword [ebx + 4], edi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], eax
mov dword [esp], ebx
call dbg.runtime.systemstack
mov eax, dword [esp + 0x18]
jmp 0x42f927