joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6927f0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x69280c
xor eax, eax
pop edi
add esp, 8
ret 4
push ebx
push ebp
push esi
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x692858
xor ebp, ebp
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jge 0x692868
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x14]
cmp ebx, ecx
jle 0x692872
mov ebx, ecx
cmp edi, eax
jle 0x692878
mov edi, eax
mov edx, dword [esp + 0x1c]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 4
Function at 0x698b60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x9214e4]
xor edx, edx
cmp eax, edx
jne 0x698b86
xor eax, eax
mov byte [eax + 0x9213e4], al
inc eax
cmp eax, 0x100
jl 0x698b6e
mov dword [0x9214e4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x9213e4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x698c17
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x698bea
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x698bb8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x698c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x698c73
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x698c5a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x69f620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6dc94e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0069ff40
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x8a5d84
call fcn.006c5124
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x69f6b3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.006c5124
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x69f6ac
push 0
mov ecx, eax
call fcn.006967b0
mov dword [esi + 0xc], eax
jmp 0x69f6b5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x69f6b5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6c7855
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6c788d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.006c583e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.006c5816
jmp 0x6c7899
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x6c90cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x6c910d
call fcn.006cf7d5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x6c910d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x6c9104
xor eax, eax
jmp 0x6c9115
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.006c911b
pop edi
pop esi
pop ebx
ret 4

Function at 0x6cfd05
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x6cfd33
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x6cfd51
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.006cfc6b
jmp 0x6cfd51
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6cfd51
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.006cfc6b
test edi, edi
mov eax, edi
jne 0x6cfd3b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6d26ee
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x6d2716
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x6d2727
push 2
call edi
test ax, ax
jge 0x6d2727
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.006c6e8b
cmp dword [esi + 0x30], ebx
jne 0x6d2801
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.006c6e8b
cmp eax, dword [esp + 0x34]
jne 0x6d2801
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x6d279d
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x6d27e2
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x6d2801
cmp eax, 0x205
je 0x6d2801
cmp eax, 0x201
je 0x6d2801
cmp eax, 0x204
je 0x6d2801
cmp eax, ebx
jne 0x6d27c8
cmp dword [esp + 0x1c], 0x1b
je 0x6d2801
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x933024]
jbe 0x6d27f7
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x6d275a
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x415349
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x415358
pop dword [ebp - 8]
mov eax, 0x4d09bfba
sub eax, 0x4cc86c62
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x4167a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x7ad1cff9
sub ecx, 0x7ad17ac9
xor edx, edx
add edx, eax
mov ebx, 0xf924b15c
add ebx, 0x71ea2a4
add ebx, dword [ebp - 8]
mov edi, 0x45be2756
sub edi, 0xd53f0b8b
xor dword [ebp - 4], ebx
mov esi, dword [ebx]
add dword [ebp - 4], 0x20d995de
add esi, edi
add dword [ebp - 4], 0xd635a3bb
mov dword [edx], esi
add edx, 4
add ebx, 0xdbead0ea
sub ebx, 0xdbead0e6
loop 0x4153b4
add eax, 0x3a87c0c6
sub eax, 0x3a867933
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x2e020040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x2e02004f
pop dword [ebp - 4]
mov eax, 0x6a83ef52
sub eax, 0x3c81ef03
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x248dee04
add dword [ebp - 0x14], 0x29c45747
mov dword [ebp - 0x10], 0x714ce685
sub dword [ebp - 0x10], 0x3f199a40
mov dword [ebp - 0xc], 0x40a7ca30
add dword [ebp - 0xc], 0xba479fe
mov dword [ebp - 8], 0xece8c0c
sub dword [ebp - 8], 0xece8c0c
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x1bb992d
add dword [ebp - 0x14], 0x72b6d029
mov dword [ebp - 0x10], 0x6d4a39d1
sub dword [ebp - 0x10], 0x2bddd85c
mov dword [ebp - 0xc], 0xeb6cbeae
sub dword [ebp - 0xc], 0x87fd5242
mov dword [ebp - 8], 0xe6548955
sub dword [ebp - 8], 0xe6548955
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x44422
push 0
call eax
mov ecx, 0x551e
mov edi, eax
mov esi, 0x2e056e00
add esi, dword [ebp - 4]
mov ebx, 0x5afe3fd5
sub ebx, 0xa7d7b135
mov edx, dword [esi]
xor edx, ebx
mov dword [edi], edx
add edi, 4
add esi, 0x35945599
sub esi, 0x35945595
loop 0x2e02015b
add eax, 0xcbe318f
sub eax, 0xcbcea44
xor ebx, ebx
add ebx, eax
add eax, 0x9c285db0
sub eax, 0x9c285dab
mov ecx, 0x8caa1cd5
sub ecx, 0x5eaa1cd5
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x4034a0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5c4da0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403670
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_chacha8rand.setup
Function at 0x40ce60
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x5c4da0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d02b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40ce89
mov eax, 0x7000000
jmp 0x40ce91
test eax, eax
je 0x40d006
mov dword [esp + 0x34], eax
mov ecx, dword [0x5c4da0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x57ae60]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40d01e
cmp edx, 0x21
jae 0x40d012
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4fb5b0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x4fb5f0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40cfe1
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4fb628]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand
Function at 0x416900
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x5c4da0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x416afe
sub esp, 0x18
mov eax, dword [0x5c4cdc]
test eax, eax
jne 0x416ae7
nop
nop
lea eax, [0x5c4ccc]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x5c4cd0]
test eax, eax
je 0x416948
cmp dword [eax + 8], 0xcc
jne 0x4169be
mov edx, dword [0x5c4cd4]
test edx, edx
jne 0x4169a0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5c75b0]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x5c4cd4], eax
mov ecx, dword [0x5c4cd8]
mov dword [eax], ecx
mov eax, dword [0x5c4cd4]
mov dword [0x5c4cd8], eax
movzx eax, byte [0x5c5120]
test al, al
jne 0x4169a0
xor eax, eax
jmp 0x416ab8
mov edx, dword [0x5c4cd4]
mov ebx, dword [edx + 4]
mov dword [0x5c4cd4], ebx
mov ebx, dword [0x5c4cd0]
mov dword [edx + 4], ebx
mov dword [0x5c4cd0], edx
mov edx, dword [0x5c4cd0]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x416a97
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime_internal_atomic.Xadd
mov eax, dword [0x5c4e58]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x416a10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x416a50
call sym.runtime.gcWriteBarrier8
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x5c4ccc]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x5c4cc8]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.runtime_internal_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x57a200]
movzx ebx, byte [edx + eax]
lea ebp, [0x5c5120]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x4169a0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x416aa1
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x4d9ca5]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x42a960
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5c4da0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42aaa4
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.spanOfHeap
mov eax, dword [esp + 4]
test eax, eax
je 0x42aa8d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x5c4da0]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sym.runtime._mspan_.ensureSwept
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call sym.runtime.lock2
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x42a9f7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42aa22
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x42aa0c
cmp byte [ebp + 6], bl
je 0x42aa17
cmp esi, edx
ja 0x42aa1e
jne 0x42a9f5
cmp byte [ebp + 6], bl
jbe 0x42a9f5
jmp 0x42aa1e
mov ebx, 1
jmp 0x42aa24
xor ebx, ebx
jmp 0x42aa24
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x42aa42
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call sym.runtime.spanHasSpecials
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x5c4da0]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x42aa7d
movzx eax, byte [ebx + 0x65]
test al, al
je 0x42aa7d
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x4db29b]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.addspecial
Function at 0x42af20
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5c4da0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42b090
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42b020
cmp cl, 1
je 0x42afb2
cmp cl, 2
jne 0x42b079
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call sym.runtime.mProf_Free
nop
nop
lea eax, [0x591120]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x5910c4]
sub eax, dword [0x5910a8]
nop
mov dword [0x5910c4], eax
mov eax, dword [0x5910b4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5910b4], ecx
nop
lea eax, [0x591120]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42b075
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call sym.runtime.queuefinalizer
nop
nop
lea eax, [0x591120]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x59109c]
sub eax, dword [0x591080]
nop
mov dword [0x59109c], eax
mov eax, dword [0x59108c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59108c], ecx
nop
lea eax, [0x591120]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42b075
cmp cl, 3
jne 0x42b02b
mov byte [eax + 8], 1
jmp 0x42b075
cmp cl, 4
jne 0x42b079
nop
nop
lea eax, [0x591120]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x591114]
sub eax, dword [0x5910f8]
nop
mov dword [0x591114], eax
mov eax, dword [0x591104]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x591104], ecx
nop
nop
lea eax, [0x591120]
mov dword [esp], eax
call sym.runtime.unlock2
add esp, 0x14
ret
lea eax, [0x4d7539]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.freeSpecial
Function at 0x430cb0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x5c4da0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x430d96
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [eax + 0x88], 0
lea ecx, [0x5c50d0]
mov dword [esp], ecx
call sym.runtime_internal_atomic.Loadint32
mov eax, dword [esp + 4]
test eax, eax
je 0x430d72
mov dword [esp + 8], 0
mov ecx, dword [0x5c4da0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x30]
lea edi, [esp + 0x10]
xor eax, eax
call fcn.00468ee9
lea ecx, [sym.runtime._mLockProfile_.captureStack.func1]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
call sym.runtime.systemstack
mov eax, dword [esp + 8]
cmp eax, 0x20
jge 0x430d6e
jae 0x430d8b
mov ecx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 8], 0
add esp, 0x2c
ret
lea eax, [sym.runtime._LostContendedRuntimeLock]
inc eax
mov ecx, dword [esp + 0x30]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
add esp, 0x2c
ret
mov ecx, 0x20
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._mLockProfile_.captureStack