joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b4e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b6a6
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
nop
cmp rcx, 0x11
jne 0x47b5a1
movzx esi, byte [rax + 0x17]
and esi, 0x1f
cmp rsi, 0x12
ja 0x47b538
nop word [rax + rax]
cmp rsi, 0x11
jne 0x47b52c
mov rsi, qword [rax + 0x30]
jmp 0x47b55e
cmp rsi, 0x12
jne 0x47b55c
mov rsi, qword [rax + 0x30]
jmp 0x47b55e
cmp rsi, 0x15
jne 0x47b544
mov rsi, qword [rax + 0x38]
jmp 0x47b55e
cmp rsi, 0x16
jne 0x47b550
mov rsi, qword [rax + 0x30]
jmp 0x47b55e
cmp rsi, 0x17
jne 0x47b55c
mov rsi, qword [rax + 0x30]
jmp 0x47b55e
xor esi, esi
movzx esi, byte [rsi + 0x17]
and esi, 0x1f
cmp rsi, 8
jne 0x47b690
bt edx, 8
jae 0x47b67d
mov rcx, qword [rax + 0x40]
nop dword [rax]
test rcx, rcx
jl 0x47b678
mov rax, rbx
neg rbx
cmp rcx, rbx
ja 0x47b669
mov rbx, rcx
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x17
jne 0x47b62e
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x12
ja 0x47b5d0
cmp rdx, 0x11
jne 0x47b5c4
mov rdx, qword [rax + 0x30]
jmp 0x47b5fa
cmp rdx, 0x12
jne 0x47b5f8
mov rdx, qword [rax + 0x30]
jmp 0x47b5fa
cmp rdx, 0x15
jne 0x47b5e0
mov rdx, qword [rax + 0x38]
jmp 0x47b5fa
cmp rdx, 0x16
jne 0x47b5ec
mov rdx, qword [rax + 0x30]
jmp 0x47b5fa
cmp rdx, 0x17
jne 0x47b5f8
mov rdx, qword [rax + 0x30]
jmp 0x47b5fa
xor edx, edx
movzx edx, byte [rdx + 0x17]
and edx, 0x1f
cmp rdx, 8
jne 0x47b61b
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov rbx, rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x00501850]
call sym.runtime.gopanic
mov qword [rsp + 0x10], rcx
lea rax, [0x004c6700]
call sym.runtime.newobject
mov qword [rax + 8], 0x13
lea rcx, [0x004db073]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c0f20]
call sym.runtime.gopanic
test rax, rax
je 0x47b673
call sym.runtime.panicunsafeslicelen
call sym.runtime.panicunsafeslicenilptr
call sym.runtime.panicunsafeslicelen
lea rax, [0x004bcec0]
lea rbx, [0x00501870]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501860]
nop
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.reflect.Value.bytesSlow
Function at 0x47ca00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cb96
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and edx, 0x1f
nop
cmp rdx, 0x14
je 0x47caa9
cmp rdx, 0x16
jne 0x47cb5a
bt ecx, 7
jae 0x47ca7a
movzx edx, byte [rax + 0x17]
test dl, 0x20
jne 0x47ca77
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
call fcn.00463760
nop dword [rax]
test al, al
je 0x47cb47
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
mov rbx, qword [rbx]
test rbx, rbx
je 0x47ca9d
mov rax, qword [rax + 0x30]
and ecx, 0x60
movzx edx, byte [rax + 0x17]
and edx, 0x1f
or rcx, rdx
or rcx, 0x180
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x38
pop rbp
ret
call sym.internal_abi._Type_.NumMethod
test rax, rax
jne 0x47cac2
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
nop
jmp 0x47cad7
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx]
test rsi, rsi
je 0x47cad3
mov rsi, qword [rsi + 8]
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x18]
test rdx, rdx
je 0x47cb0e
movzx esi, byte [rdx + 0x17]
mov edi, esi
and esi, 0x1f
mov r8, rsi
or rsi, 0x80
nop
mov r9, qword [rsp + 0x20]
test dil, 0x20
cmove r8, rsi
jmp 0x47cb16
xor r8d, r8d
xor edx, edx
xor r9d, r9d
test r8, r8
je 0x47cb38
mov rsi, qword [rsp + 0x10]
test rsi, 0x60
mov esi, 0
mov edi, 0x20
cmovne rsi, rdi
or r8, rsi
mov rax, rdx
mov rbx, r9
mov rcx, r8
add rsp, 0x38
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x005018e0]
call sym.runtime.gopanic
mov qword [rsp + 0x10], rdx
lea rax, [0x004c6700]
call sym.runtime.newobject
mov qword [rax + 8], 0x12
lea rcx, [0x004dac23]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c0f20]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.reflect.Value.Elem
Function at 0x47cea0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cf9c
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
nop dword [rax]
test rcx, rcx
je 0x47cf66
test dil, dil
je 0x47ced7
test rcx, 0x60
jne 0x47cf53
bt ecx, 9
jae 0x47cef7
mov rdi, rbx
mov rsi, rcx
mov ebx, 9
mov rcx, rax
lea rax, [0x004d8dcc]
call sym.reflect.makeMethodValue
mov rdx, rcx
and edx, 0x1f
nop dword [rax]
cmp rdx, 0x14
jne 0x47cf48
mov qword [rsp + 0x28], rbx
call sym.reflect.Value.NumMethod
test rax, rax
je 0x47cf36
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
nop dword [rax]
test rdx, rdx
je 0x47cf29
mov rdx, qword [rdx + 8]
mov rbx, qword [rcx + 8]
mov rax, rdx
add rsp, 0x30
pop rbp
ret
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
add rsp, 0x30
pop rbp
ret
call sym.reflect.packEface
add rsp, 0x30
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x00501920]
call sym.runtime.gopanic
lea rax, [0x004c6700]
call sym.runtime.newobject
mov qword [rax + 8], 0x17
lea rcx, [0x004dc51a]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x004c0f20]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.reflect.valueInterface
Function at 0x47d080
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d280
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x47d0f5
cmp rcx, 0x11
je 0x47d0eb
cmp rcx, 0x12
jne 0x47d210
cmp qword [rax], 8
jne 0x47d26c
cmp qword [rax + 8], 0
je 0x47d26c
bt edx, 7
jae 0x47d0db
mov rbx, qword [rbx]
mov rax, rbx
nop
call sym.reflect.chanlen
add rsp, 0x18
pop rbp
ret
mov rax, qword [rax + 0x40]
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x15
jne 0x47d12b
cmp qword [rax], 8
nop
jne 0x47d259
cmp qword [rax + 8], 0
je 0x47d259
bt edx, 7
jae 0x47d11a
mov rbx, qword [rbx]
mov rax, rbx
nop dword [rax]
call sym.reflect.maplen
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x16
jne 0x47d200
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax]
cmp rcx, 0x12
ja 0x47d160
cmp rcx, 0x11
jne 0x47d152
mov rdx, qword [rax + 0x30]
jmp 0x47d186
cmp rcx, 0x12
jne 0x47d184
mov rdx, qword [rax + 0x30]
jmp 0x47d186
cmp rcx, 0x15
jne 0x47d16c
mov rdx, qword [rax + 0x38]
jmp 0x47d186
cmp rcx, 0x16
jne 0x47d178
mov rdx, qword [rax + 0x30]
jmp 0x47d186
cmp rcx, 0x17
jne 0x47d184
mov rdx, qword [rax + 0x30]
jmp 0x47d186
xor edx, edx
movzx edx, byte [rdx + 0x17]
and edx, 0x1f
cmp rdx, 0x11
jne 0x47d246
cmp rcx, 0x12
ja 0x47d1b8
nop dword [rax]
cmp rcx, 0x11
jne 0x47d1ac
mov rcx, qword [rax + 0x30]
jmp 0x47d1de
cmp rcx, 0x12
jne 0x47d1dc
mov rcx, qword [rax + 0x30]
jmp 0x47d1de
cmp rcx, 0x15
jne 0x47d1c4
mov rcx, qword [rax + 0x38]
jmp 0x47d1de
cmp rcx, 0x16
jne 0x47d1d0
mov rcx, qword [rax + 0x30]
jmp 0x47d1de
cmp rcx, 0x17
jne 0x47d1dc
mov rcx, qword [rax + 0x30]
jmp 0x47d1de
xor ecx, ecx
movzx edx, byte [rcx + 0x17]
and edx, 0x1f
cmp rdx, 0x11
jne 0x47d1f1
mov rcx, qword [rcx + 0x40]
jmp 0x47d1f3
xor ecx, ecx
mov rax, rcx
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x18
jne 0x47d210
mov rax, qword [rbx + 8]
add rsp, 0x18
pop rbp
ret
lea rax, [0x004c6700]
call sym.runtime.newobject
mov qword [rax + 8], 0x11
lea rcx, [0x004da8ce]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c0f20]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501930]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501800]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501800]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.reflect.Value.lenNonSlice
Function at 0x47d2c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d359
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp qword [rax + 0x28], 0
je 0x47d345
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x18]
mov rax, rcx
call sym.reflect.mapiterkey
test rax, rax
je 0x47d32f
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 0x30]
mov rdx, qword [rdx + 0x10]
movzx ebx, byte [rsi + 0x17]
and ebx, 0x1f
test rdx, 0x60
mov edx, 0
mov edi, 0x20
cmovne rdx, rdi
or rbx, rdx
mov rcx, rax
mov rax, rsi
call sym.reflect.copyVal
add rsp, 0x18
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x00501950]
nop dword [rax]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501940]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect._MapIter_.Key

Function at 0x47d380
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d419
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp qword [rax + 0x28], 0
je 0x47d405
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x18]
mov rax, rcx
call sym.reflect.mapiterelem
test rax, rax
je 0x47d3ef
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 0x38]
mov rdx, qword [rdx + 0x10]
movzx ebx, byte [rsi + 0x17]
and ebx, 0x1f
test rdx, 0x60
mov edx, 0
mov edi, 0x20
cmovne rdx, rdi
or rbx, rdx
mov rcx, rax
mov rax, rsi
call sym.reflect.copyVal
add rsp, 0x18
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x00501970]
nop dword [rax]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501960]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect._MapIter_.Value

Function at 0x47d440
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d506
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x47d4f0
lea rcx, [rax + 0x18]
mov qword [rsp + 0x18], rcx
cmp qword [rax + 0x28], 0
jne 0x47d499
mov rsi, qword [rax]
cmp qword [rsi], 8
jne 0x47d4dd
cmp qword [rsi + 8], 0
je 0x47d4dd
mov rdi, qword [rax + 8]
bt edx, 7
jae 0x47d48c
mov rdi, qword [rdi]
mov rax, rsi
mov rbx, rdi
call sym.reflect.mapiterinit
jmp 0x47d4b4
mov rax, rcx
nop dword [rax]
call sym.reflect.mapiterkey
test rax, rax
je 0x47d4ca
mov rax, qword [rsp + 0x18]
call sym.reflect.mapiternext
mov rax, qword [rsp + 0x18]
call sym.reflect.mapiterkey
test rax, rax
setne al
add rsp, 0x20
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x00501990]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501800]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501980]
nop
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect._MapIter_.Next
Function at 0x47d7c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d966
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop
cmp byte [0x00597250], 0
je 0x47d81a
lea rdx, [0x004bd300]
mov qword [0x00597258], rdx
cmp dword [0x0061c240], 0
je 0x47d813
nop dword [rax]
call sym.runtime.gcWriteBarrier2
mov qword [r11], rbx
mov rdx, qword [0x00597260]
mov qword [r11 + 8], rdx
mov qword [0x00597260], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x18], rcx
nop
cmp rcx, 0x15
ja 0x47d888
cmp rcx, 0x12
je 0x47d8c6
cmp rcx, 0x13
jne 0x47d880
bt edx, 9
jb 0x47d872
nop
cmp qword [rax], 8
jne 0x47d94e
cmp qword [rax + 8], 0
je 0x47d94e
bt edx, 7
jae 0x47d861
mov rbx, qword [rbx]
test rbx, rbx
je 0x47d869
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [sym.reflect.methodValueCall.abi0]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x47d8c6
jmp 0x47d905
cmp rcx, 0x16
jne 0x47d8b8
cmp qword [rax + 8], 0
jne 0x47d8c6
mov rax, qword [rbx]
mov qword [rsp + 0x10], rax
nop dword [rax]
call fcn.00463760
test al, al
je 0x47d93b
mov rax, qword [rsp + 0x10]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x47d8e5
nop
cmp rcx, 0x1a
jne 0x47d905
cmp qword [rax], 8
jne 0x47d8ee
cmp qword [rax + 8], 0
je 0x47d8ee
bt edx, 7
jae 0x47d8dc
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x00501800]
nop dword [rax]
call sym.runtime.gopanic
lea rax, [0x004c6700]
call sym.runtime.newobject
mov qword [rax + 8], 0x15
lea rcx, [0x004dbb81]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c0f20]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x005019a0]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501800]
nop dword [rax]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.reflect.Value.Pointer
Function at 0x47dae0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47dbf4
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop dword [rax]
test rcx, rcx
je 0x47dbbe
bt ecx, 9
jae 0x47db88
movzx edx, byte [rax + 0x17]
and edx, 0x1f
sar rcx, 0xa
nop word [rax + rax]
cmp rdx, 0x14
jne 0x47db4a
cmp qword [rax + 0x40], rcx
jbe 0x47dbab
mov rdx, qword [rax + 0x38]
mov ebx, dword [rdx + rcx*8 + 4]
nop
call sym.reflect.resolveTypeOff
mov rbx, rax
lea rax, [0x00502e60]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call sym.internal_abi._Type_.ExportedMethods
mov rcx, qword [rsp + 0x10]
nop
cmp rbx, rcx
jbe 0x47db98
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
nop
mov rax, qword [rsp + 0x18]
call sym.reflect.resolveTypeOff
mov rbx, rax
lea rax, [0x00502e60]
add rsp, 0x20
pop rbp
ret
mov rbx, rax
lea rax, [0x00502e60]
add rsp, 0x20
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x00501890]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501890]
call sym.runtime.gopanic
lea rax, [0x004c6700]
call sym.runtime.newobject
mov qword [rax + 8], 0x12
lea rcx, [0x004dac35]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x004c0f20]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.reflect.Value.typeSlow
Function at 0x47dc20
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47dd86
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
nop
cmp rcx, 0x15
ja 0x47dcac
cmp rcx, 0x12
je 0x47dcec
cmp rcx, 0x13
jne 0x47dca4
bt edx, 9
jb 0x47dc96
nop
cmp qword [rax], 8
jne 0x47dd70
cmp qword [rax + 8], 0
je 0x47dd70
bt edx, 7
nop
jae 0x47dc85
mov rbx, qword [rbx]
test rbx, rbx
je 0x47dc8d
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [sym.reflect.methodValueCall.abi0]
nop
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x47dcec
jmp 0x47dd27
cmp rcx, 0x16
jne 0x47dce0
cmp qword [rax + 8], 0
jne 0x47dcec
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.00463760
test al, al
je 0x47dd5d
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x47dd0b
cmp rcx, 0x1a
jne 0x47dd27
cmp qword [rax], 8
jne 0x47dd14
cmp qword [rax + 8], 0
je 0x47dd14
bt edx, 7
jae 0x47dd02
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x004bcec0]
lea rbx, [0x00501800]
call sym.runtime.gopanic
lea rax, [0x004c6700]
call sym.runtime.newobject
mov qword [rax + 8], 0x1b
lea rcx, [0x004dd8b0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c0f20]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x005019b0]
call sym.runtime.gopanic
lea rax, [0x004bcec0]
lea rbx, [0x00501800]
nop
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.reflect.Value.UnsafePointer
Function at 0x484c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484d4a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x484d2f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004bcfc0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x484d1e
mov edi, 1
lea rsi, [0x004bcfc0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00501d28]
lea rsi, [0x00501510]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x485940
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485a46
push rbp
mov rbp, rsp
sub rsp, 0x38
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x18], 0
mov ebx, eax
xor ecx, ecx
lea rdi, [rsp + 0x18]
xor eax, eax
call sym.syscall.initializeProcThreadAttributeList
lea rdx, [0x00501d28]
cmp rax, rdx
jne 0x4859a0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
lea rcx, [0x005009c0]
call sym.runtime.ifaceeq
test al, al
jne 0x4859e3
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
nop
test rax, rax
je 0x4859b3
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x38
pop rbp
ret
lea rax, [0x004c4080]
call sym.runtime.newobject
mov qword [rax + 8], 0x42
lea rcx, [0x004e2b93]
mov qword [rax], rcx
lea rbx, [0x00501ce8]
mov rcx, rax
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov rcx, qword [rsp + 0x18]
lea rax, [0x004bcf40]
mov rbx, rcx
call sym.runtime.makeslice
cmp qword [rsp + 0x18], 0
jbe 0x485a36
mov qword [rsp + 0x30], rax
mov ebx, dword [rsp + 0x48]
xor ecx, ecx
lea rdi, [rsp + 0x18]
call sym.syscall.initializeProcThreadAttributeList
test rax, rax
je 0x485a27
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov rax, qword [rsp + 0x30]
xor ebx, ebx
xor ecx, ecx
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
nop dword [rax + rax]
call sym.runtime.panicIndex
nop
mov dword [rsp + 8], eax
call sym.runtime.morestack_noctxt.abi0
mov eax, dword [rsp + 8]
jmp sym.syscall.newProcThreadAttributeList
Function at 0x48bbe0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x48bd6e
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
lea rdi, [0x004e07f4]
mov esi, 0x27
call sym.time.Time.Format
mov rdx, qword [rsp + 0x70]
bt rdx, 0x3f
jae 0x48bd65
mov rdx, qword [rsp + 0x78]
test rdx, rdx
jge 0x48bc42
neg rdx
mov ecx, 0x2d
nop
jmp 0x48bc47
mov ecx, 0x2b
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x80], rax
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
mov word [rsp + 0x40], 0x6d20
mov byte [rsp + 0x42], 0x3d
mov byte [rsp + 0x43], cl
mov r8, rdx
shr rdx, 1
movabs rax, 0x89705f4136b4a598
mul rdx
mov rdi, rdx
shr rdi, 0x1c
imul r9, rdi, 0x3b9aca00
shr rdx, 0x1d
movabs rax, 0x89705f4136b4a598
mul rdx
shr rdx, 0x1c
imul r10, rdx, 0x3b9aca00
sub r8, r9
mov qword [rsp + 0x60], r8
sub rdi, r10
test rdx, rdx
jne 0x48bcd0
mov eax, 0x18
mov edx, 4
xor esi, esi
lea r9, [rsp + 0x40]
jmp 0x48bd01
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x40]
mov ebx, 4
mov ecx, 0x18
mov rdi, rdx
xor esi, esi
call sym.time.appendInt
mov rdi, qword [rsp + 0x68]
mov rdx, rbx
mov esi, 9
mov r9, rax
mov rax, rcx
mov rbx, rdx
mov rcx, rax
mov rax, r9
call sym.time.appendInt
inc rbx
cmp rcx, rbx
jae 0x48bd28
mov edi, 1
lea rsi, [0x004bcf40]
call sym.runtime.growslice
mov byte [rbx + rax - 1], 0x2e
mov rdi, qword [rsp + 0x60]
mov esi, 9
call sym.time.appendInt
mov rcx, rbx
mov rbx, rax
xor eax, eax
call sym.runtime.slicebytetostring
mov rcx, qword [rsp + 0x58]
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, qword [rsp + 0x80]
nop
call sym.runtime.concatstring2
add rsp, 0x88
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.time.Time.String