joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ac20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, 0x1e53
mov dword [0x1016eaa4], 0
mov byte [0x1016eaa8], 0
mov dword [0x1016ea98], 0x1e53
mov dword [0x1016eaa0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jmp 0x1000ad30
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [0x1016eaac], 0
mov dword [0x1016ea98], 0x1a68
mov edx, dword [0x1016eaa4]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x1016eaac], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x1016eaa4], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov cl, byte [ecx + edi]
mov byte [0x1016eaa8], cl
mov dword [0x1016ea98], 0x20a4
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov dword [0x1016ea98], 0x8fe
mov cl, byte [0x1016eaa8]
mov edx, dword [0x1016eaa4]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x1016eaa0]
add edx, 1
mov dword [0x1016eaa0], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
jl 0x1000ac7a
jmp 0x1000ac72
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0xfffffb58
mov edx, ecx
mov bl, dl
mov dword [0x1016ea9c], eax
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], bl
mov ecx, dword [0x1016ea98]
add ecx, 0xfffff707
mov dword [0x1016ea98], ecx
mov edx, dword [0x1016eaa0]
add edx, 1
mov dword [0x1016eaa0], edx
cmp edx, 0x100
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
jl 0x1000ad30
xor eax, eax
mov dword [0x1016ea98], 0xd54
mov dword [0x1016eaa0], 0
mov dword [ebp - 0x24], eax
jmp 0x1000ac7a
Function at 0x1000b340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1016eaa0], 0
mov dword [0x1016eaa4], 0
mov dword [0x1016eab0], 0
mov dword [0x1016ea98], 0x8c5
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1000b492
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1000b3a5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x1016ea98], 0x4dd
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1016eaa0], edx
mov dword [0x1016ea9c], 0x2b64
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1016eaa4], edx
mov dword [0x1016ea9c], 0xffffe3e2
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1016eaa8], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1016eaa8]
mov edx, dword [0x1016eaa4]
mov byte [edi + edx], cl
mov edx, dword [0x1016eaa0]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1016eaa4]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1016eab0], ebx
mov dword [0x1016ea98], 0x601
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
xor cl, byte [edx + ebx]
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], cl
add ebx, 1
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x38], ebx
je 0x1000b490
mov eax, dword [0x1016eaa0]
mov ecx, dword [0x1016eaa4]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jmp 0x1000b3a5
jmp 0x1000b492
mov dword [0x1016ea98], 0x1da6
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000c6e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [0x1016ea9c]
add edx, 0xfffffeb8
mov dword [0x1016ea98], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1000c240
lea ecx, [0x1000b8a0]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x50], edx
mov dword [esp + 0x5c], 0x133800
mov edx, dword [0x1016ea84]
mov dword [esp + 0x80], edx
mov edx, dword [0x1016ea88]
mov dword [esp + 0x6c], edx
mov edx, dword [0x1016ea8c]
mov dword [esp + 0x70], edx
mov edx, dword [0x1016ea90]
mov dword [esp + 0x48], edx
mov dword [0x1016ea98], 0x15a8
mov edx, dword [0x1016ea94]
mov dword [esp + 0x54], edx
mov dword [0x1016ea9c], 0xffffff84
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x1000c7cc
jmp 0x1000c7e4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x78], eax
mov dword [0x1016ea98], 0x22f3
mov dword [0x1016ea9c], 0x4640
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x88], eax
call fcn.1000b100
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
je 0x1000c805
jmp 0x1000c853
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x1000c78a
mov dword [0x1016ea98], 0x1e91
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1000c779
lea eax, [esp + 0x38]
mov ecx, dword [0x1016ea9c]
add ecx, 0x7f8
mov dword [0x1016ea98], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000be10
mov ecx, dword [0x1016ea98]
add ecx, 0xffffeaf7
mov dword [0x1016ea98], ecx
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x414ac0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
in al, 0x48
sub bl, byte [edx - 0x77]
jl 0x414abb
mov al, byte [0x539c419e]
sahf
inc ecx
pushfd
push ebx
popal
fst st(7)
mov edx, 0xe8e8da7
and byte [eax + 0x4ab1375f], cl
sbb al, 0x5f
or edi, dword [esi - 0x4a]
and eax, 0xfa176a4
mov dword [eax + ebx*4], ebp
mov eax, dword [0xbf5e319e]
and ecx, dword [eax - 0x357ea41c]
pop esi
out 0x51, eax
call 0xd8caaa0c
mov eax, dword [0x5609ea0]
mov al, byte [0x4fe6779e]
add ecx, ecx
pop esi
mov bh, 0xb0
push cs
mov eax, dword [0x5e4ba8a0]
pop edi
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
ja 0x414ab3
mov al, byte [0x5f5e889e]
popal
ja 0x414abb
mov al, byte [0x5f5e889e]
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi - 0x24], bl
lea ecx, [ecx + ebx*4 - 0x99bbaa5]
sbb eax, 0x10a58161
or dword [eax - 0x399ee1d2], ecx
sbb edi, esp
mov ecx, 0xdad9640a
inc edi
invalid
Function at 0x402db8
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
lea esi, [esp + 0x20]
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], esi
mov eax, dword [0x407040]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x20], 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
sub esp, 0x14
cmp eax, 0x6f
jne 0x402ea5
mov eax, dword [esp + 0x20]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
push ecx
push ecx
test eax, eax
je 0x402ea5
mov dword [esp + 0x10], esi
mov esi, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
sub esp, 0x14
lea ebp, [esp + 0x26]
cmp dword [esi + 0x34], 6
jne 0x402e94
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x26], eax
mov ax, word [esi + 0x30]
mov dword [esp + 8], 3
mov dword [esp + 4], ebp
mov dword [esp], edi
mov word [esp + 0x2a], ax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x402e94
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
push edx
jmp 0x402ea7
mov esi, dword [esi + 8]
test esi, esi
jne 0x402e58
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x407040]
je 0x402eb8
call fcn.00401770
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402f54
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebx
sub esp, 0x38
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x407040]
mov dword [esp + 0x2c], eax
xor eax, eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
call ebx
push eax
mov dword [esp], 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push edx
lea eax, [esp + 0x24]
mov dword [esp], eax
call ebx
xor eax, eax
push ecx
mov edx, dword [esp + 0x24]
cmp dword [esp + 0x1c], edx
jne 0x402fa2
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x20], eax
sete al
mov ecx, dword [esp + 0x2c]
sub ecx, dword [0x407040]
je 0x402fb3
call fcn.00401770
add esp, 0x38
pop ebx
ret

Function at 0x402fb8
Capabilities:
Enumerate processes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x140
mov dword [esp + 4], 0
mov edi, dword [esp + 0x150]
mov eax, dword [0x407040]
mov dword [esp + 0x13c], eax
xor eax, eax
mov dword [esp], 2
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push ecx
mov ebx, eax
push ecx
lea esi, [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.KERNEL32.dll_Process32First
push edx
push edx
test eax, eax
jne 0x403010
xor eax, eax
jmp 0x40303a
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
push edx
push edx
test eax, eax
je 0x40300c
lea eax, [esp + 0x38]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x403010
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x13c]
sub edx, dword [0x407040]
je 0x40304e
call fcn.00401770
add esp, 0x140
pop ebx
pop esi
pop edi
ret
Function at 0x403058
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x407040]
mov dword [esp + 0x3c], eax
xor eax, eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push eax
cmp dword [esp + 0x2c], 1
setbe al
mov edx, dword [esp + 0x3c]
sub edx, dword [0x407040]
je 0x40308d
call fcn.00401770
add esp, 0x4c
ret

Function at 0x40310c
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x6c
mov eax, dword [0x407040]
mov dword [esp + 0x5c], eax
xor eax, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push eax
mov eax, 0x7fffffff
cmp eax, dword [esp + 0x20]
mov eax, 0
sbb eax, dword [esp + 0x24]
setae al
mov edx, dword [esp + 0x5c]
sub edx, dword [0x407040]
je 0x403156
call fcn.00401770
add esp, 0x6c
ret
Function at 0x91b460
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x91b466
pop ebp
sub ebp, 6
sub ebp, 0x51b460
jmp 0x91b4c4
jmp 0x91b4cd
mov eax, 0x51b460
add eax, ebp
add eax, 0x93
mov ecx, 0x624
mov edx, 0x324bdcd8
xor byte [eax], dl
inc eax
dec ecx
jne 0x91b4e4
jmp 0x91b4f7
mov dl, 0x98
mov al, 0xd8
enter 0xffffffffffffd8d8, 0xffffffffffffffb0
fcom dword [esp + esi*8]
fsubr st(3)
sbb byte [eax + 0x39e44d27], cl
lahf
fmul dword [eax + 0x51531553]
in al, 0xd8
fcomp st(0)
pop ecx
sbb dword [eax], esp
fcomp st(0)
fcomp st(3)
adc eax, 0xd8d8de60
fsub dword [edx - 0x10]
fcomp st(0)
fsubr dword [edi]
cmp bl, bl
adc byte [ebx + 0x59], dl
aam 0xd8
fcomp st(0)
fistp dword [0xed71b088]
rcr eax, 1
mov al, 0x6e
cmpsb byte [esi], byte es:[edi]
nop
fcomp st(1)
hlt
Function at 0x40b800
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x55ee20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b9cb
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b829
mov eax, 0x7000000
jmp 0x40b831
test eax, eax
je 0x40b9a6
mov dword [esp + 0x14], eax
mov ecx, dword [0x55ee20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x530b80]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40b9be
cmp edx, 0x21
jae 0x40b9b2
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4c8d90]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x4c8dc8]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b981
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4c8e10]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand
Function at 0x415240
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x55ee20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41544e
sub esp, 0x18
mov eax, dword [0x55ed50]
test eax, eax
jne 0x415437
nop
nop
lea eax, [0x55ed40]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x55ed44]
test eax, eax
je 0x415288
cmp dword [eax + 8], 0xcc
jne 0x4152fe
mov edx, dword [0x55ed48]
test edx, edx
jne 0x4152e0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5634b0]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x55ed48], eax
mov ecx, dword [0x55ed4c]
mov dword [eax], ecx
mov eax, dword [0x55ed48]
mov dword [0x55ed4c], eax
movzx eax, byte [0x55f180]
test al, al
jne 0x4152e0
xor eax, eax
jmp 0x415408
mov edx, dword [0x55ed48]
mov ebx, dword [edx + 4]
mov dword [0x55ed48], ebx
mov ebx, dword [0x55ed44]
mov dword [edx + 4], ebx
mov dword [0x55ed44], edx
mov edx, dword [0x55ed44]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4153e7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime_internal_atomic.Xadd
mov eax, dword [0x55ef00]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x415348
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x41535e
call sym.runtime.gcWriteBarrier2
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x55ef00]
test eax, eax
jne 0x415382
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x4153b0
call sym.runtime.gcWriteBarrier6
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x55ed40]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x55ed3c]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.runtime_internal_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x5301f4]
movzx ebx, byte [edx + eax]
lea ebp, [0x55f180]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x4152e0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x4153f1
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x4ac35a]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x422f20
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x55ee20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423008
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x423002
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call sym.runtime._atomicScavChunkData_.load
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call sym.runtime._scavChunkData_.alloc
movzx eax, byte [esp + 0x18]
test al, 2
je 0x422fb6
cmp word [esp + 0x10], 0x1f0
jbe 0x422fb6
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x422ffd
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call sym.runtime._atomicScavChunkData_.store
add esp, 0x1c
ret
call sym.runtime.panicIndexU
call sym.runtime.panicIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._scavengeIndex_.alloc
Function at 0x423020
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x55ee20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423154
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x42314e
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call sym.runtime._atomicScavChunkData_.load
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call sym.runtime._scavChunkData_.free
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x423147
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call sym.runtime._atomicScavChunkData_.store
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x42310a
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call sym.runtime._atomicOffAddr_.Load
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x423143
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sym.runtime_internal_atomic.Storeint64
add esp, 0x20
ret
mov eax, edx
call sym.runtime.panicIndexU
call sym.runtime.panicIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._scavengeIndex_.free