joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ca20
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44cb56
push rbp
mov rbp, rsp
sub rsp, 0x48
cmp rcx, rbx
jae 0x44ca7d
mov rdx, qword [rax]
mov qword [rsp + 0x30], rdx
mov rsi, rax
mov rax, rbx
mul rdx
jo 0x44cb41
movabs rdx, 0x1000000000000
nop dword [rax + rax]
cmp rax, rdx
ja 0x44cb41
test rbx, rbx
jl 0x44cb41
mov rdx, qword [rsp + 0x30]
imul rcx, rdx
jmp 0x44ca8a
mov rcx, qword [rax]
imul rcx, rbx
mov rsi, rax
mov rax, rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x28], rcx
cmp qword [rsi + 8], 0
jne 0x44cad8
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor ecx, ecx
call sym.runtime.mallocgc
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp rcx, rbx
jae 0x44cb27
mov qword [rsp + 0x38], rax
sub rbx, rcx
lea rdx, [rax + rcx]
mov rax, rdx
call sym.runtime.memclrNoHeapPointers
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
jmp 0x44cb27
mov qword [rsp + 0x40], rsi
mov rbx, rsi
mov ecx, 1
call sym.runtime.mallocgc
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x44cb27
cmp byte [0x00682e70], 0
je 0x44cb27
mov qword [rsp + 0x38], rax
mov rdx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, rbx
mov rdi, qword [rsp + 0x40]
mov rax, rdx
mov rbx, rsi
call sym.runtime.bulkBarrierPreWriteSrcOnly
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x70]
call sym.runtime.memmove
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbp
ret
nop
lea rax, [0x004f68e0]
lea rbx, [0x00541a50]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime.makeslicecopy

Function at 0x44cba0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44cc3f
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rsi, rax
mov rax, rdx
mov rdi, rax
mul rcx
jo 0x44cc33
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x44cbef
test rbx, rbx
jl 0x44cbef
cmp rcx, rbx
jl 0x44cbef
mov rbx, rsi
mov ecx, 1
call sym.runtime.mallocgc
add rsp, 0x18
pop rbp
ret
mov rax, rdi
mul rbx
jno 0x44cc0b
nop
lea rax, [0x004f68e0]
lea rbx, [0x00541a50]
call sym.runtime.gopanic
movabs rcx, 0x1000000000000
cmp rax, rcx
ja 0x44cbf7
test rbx, rbx
jl 0x44cbf7
nop
lea rax, [0x004f68e0]
lea rbx, [0x00541a60]
call sym.runtime.gopanic
movabs rdx, 0x1000000000000
jmp 0x44cbef
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.makeslice
Function at 0x44d5c0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44d726
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x800000000000
add rdx, rax
mov rsi, rdx
shr rdx, 0x2a
nop
nop
cmp rdx, 0x40
jae 0x44d716
lea rdi, [0x00614cf8]
mov rdx, qword [rdi + rdx*8]
test byte [rdx], al
mov rdi, rax
shr rax, 0xd
and eax, 0x1ff
shr rsi, 0x16
and esi, 0xfffff
mov rdx, qword [rdx + rsi*8]
test byte [rdx], al
mov rdx, qword [rdx + rax*8]
nop
mov sil, byte [rdx + 0x63]
cmp sil, 2
jne 0x44d705
mov qword [rsp + 0x18], rdx
mov rsi, qword [rdx + 0x28]
test rsi, rsi
jne 0x44d67d
movzx eax, bl
nop
cmp rax, 2
jae 0x44d6f8
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x40], bl
shl rax, 6
lea rcx, [0x006832c0]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, rdx
call sym.runtime._mSpanList_.insert
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rdx + 0x28]
mov r8, rdi
mov qword [rdi], rsi
mov qword [rdx + 0x28], r8
movzx esi, word [rdx + 0x60]
lea edi, [rsi - 1]
mov word [rdx + 0x60], di
cmp dword [0x00682c08], 0
jne 0x44d6e8
nop
cmp si, 1
jne 0x44d6e8
movzx eax, bl
cmp rax, 2
jae 0x44d6ee
shl rax, 6
lea rcx, [0x006832c0]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, rdx
call sym.runtime._mSpanList_.remove
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 0x28], 0
lea rax, [0x00604b20]
mov ecx, 1
call sym.runtime._mheap_.freeManual
add rsp, 0x28
pop rbp
ret
mov ecx, 2
call sym.runtime.panicIndex
mov ecx, 2
nop dword [rax]
call sym.runtime.panicIndex
lea rax, [0x00519693]
mov ebx, 0x21
call sym.runtime.throw
mov rax, rdx
mov ecx, 0x40
nop
call sym.runtime.panicIndexU
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
nop
jmp sym.runtime.stackpoolfree
Function at 0x44e080
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44e22e
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rsi
mov rdx, rax
mov qword [rsp + 0x30], rax
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
mov r10, qword [rcx + 0x10]
movsxd r11, dword [rbx]
mov qword [rsp + 0x28], r11
mov rcx, qword [rcx + 0x18]
xor r12d, r12d
nop
jmp 0x44e0c6
lea r12, [r13 + 8]
cmp r12, r11
jae 0x44e0e2
mov qword [rsp + 0x20], r12
mov r13, r12
shr r12, 3
add r12, qword [rbx + 8]
movzx r12d, byte [r12]
jmp 0x44e0f2
add rsp, 0x50
pop rbp
ret
mov rbx, qword [rsp + 0x68]
mov r11, qword [rsp + 0x28]
test r12b, r12b
je 0x44e0c2
bsf r15d, r12d
lea ebx, [r12 - 1]
add r15, r13
and r12d, ebx
lea rbx, [rdx + r15*8]
jmp 0x44e131
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
jmp 0x44e0e8
add r11, r10
mov qword [rdx + r15*8], r11
nop
jmp 0x44e0e8
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r11, qword [rsp + 0x28]
mov r11, qword [rdx + r15*8]
mov qword [rsp + 0x18], r11
test rdi, rdi
je 0x44e161
lea r13, [r11 - 1]
cmp r13, 0xfff
jae 0x44e15c
cmp dword [0x006831e8], 0
jne 0x44e192
mov r13, qword [rsp + 0x20]
jmp 0x44e161
mov r13, qword [rsp + 0x20]
cmp r11, r8
jb 0x44e0e8
cmp r11, r9
jae 0x44e0e8
cmp rcx, rax
jbe 0x44e118
mov rsi, qword [rsp + 0x18]
add rsi, r10
mov rax, r11
lock cmpxchg qword [rbx], rsi
sete sil
test sil, sil
je 0x44e122
jmp 0x44e10c
mov qword [rsp + 0x48], rbx
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf1], 2
mov ebx, dword [rdi + 4]
mov rax, rsi
call sym.runtime._moduledata_.funcName
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.printlock
lea rax, [0x00518641]
mov ebx, 0x1e
call sym.runtime.printstring
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x10]
call sym.runtime.printstring
lea rax, [0x0051056c]
mov ebx, 4
call sym.runtime.printstring
mov rax, qword [rsp + 0x48]
call sym.runtime.printpointer
lea rax, [0x005102e6]
mov ebx, 2
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0051865f]
mov ebx, 0x1e
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp sym.runtime.adjustpointers
Function at 0x44f880
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44f9ea
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax], 0
je 0x44f9d8
nop
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x44f8d2
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
cmp rax, rdx
jne 0x44f9c7
mov rsi, r14
cmp rsi, rdx
je 0x44f9c7
cmp ecx, 2
jne 0x44f9c7
cmp qword [rax + 0x70], 0
jne 0x44f8f4
cmp byte [rax + 0xb4], 0
je 0x44f8e6
xor ecx, ecx
jmp 0x44f8f6
nop
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x44f8f6
xor ecx, ecx
test cl, cl
je 0x44f9b6
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x44f91d
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x3f0], 0
jne 0x44f9a5
cmp dword [0x006831dc], 0
jg 0x44f99f
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov rax, rcx
call sym.runtime.findfunc
test rax, rax
je 0x44f94b
cmp byte [rax + 0x28], 7
jne 0x44f94b
add rsp, 0x10
pop rbp
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rdx, rcx
mov rcx, rdx
shr rdx, 1
cmp rdx, 0x2000
jb 0x44f999
mov rsi, qword [rax + 0x38]
sub rbx, rsi
lea rsi, [rbx + 0x320]
shr rcx, 2
nop
cmp rcx, rsi
ja 0x44f98b
add rsp, 0x10
pop rbp
ret
mov rbx, rdx
call sym.runtime.copystack
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
lea rax, [0x00516f33]
mov ebx, 0x1a
call sym.runtime.throw
lea rax, [0x00515b4b]
mov ebx, 0x17
call sym.runtime.throw
lea rax, [0x0051684b]
mov ebx, 0x19
call sym.runtime.throw
lea rax, [0x00517af8]
mov ebx, 0x1c
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.shrinkstack
Function at 0x450720
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x450907
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x78], rbx
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x45075a
add r10, 0x10
lea r11, [rbx + 1]
mov rbx, r10
mov r9, r8
mov r8, rsi
mov rsi, r11
cmp rcx, rsi
jle 0x450791
mov r10, rbx
mov r11, qword [rbx + 8]
test r11, r11
jne 0x450776
mov rbx, rsi
mov rsi, r8
mov r8, r9
jmp 0x450746
lea r8, [r9 + r11]
nop word [rax + rax]
cmp r9, r8
jg 0x4508f5
inc rdi
mov rbx, rsi
jmp 0x450746
test rdi, rdi
je 0x45081e
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rdx
cmp rdi, 1
jne 0x4507fc
test rax, rax
jne 0x4507d6
cmp rcx, r8
jbe 0x4508ed
mov rsi, r8
shl r8, 4
mov rdi, qword [rdx + r8]
cmp qword [r14], rdi
ja 0x4507e0
mov r8, qword [r14 + 8]
cmp rdi, r8
jb 0x4507fc
jmp 0x4507e0
mov rsi, r8
nop dword [rax]
cmp rcx, rsi
jbe 0x4508e5
shl rsi, 4
mov rax, qword [rdx + rsi]
mov rbx, qword [rdx + rsi + 8]
add rsp, 0x60
pop rbp
ret
mov rbx, r9
nop
call sym.runtime.rawstringtmp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x80]
jmp 0x450848
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
sub rsi, r9
mov r10, rsi
neg r10
sar r10, 0x3f
and r10, r9
add rdx, 0x10
dec r8
sub r11, r9
add rcx, r10
mov rdi, r11
test r8, r8
jle 0x4508d1
mov r9, qword [rdx + 8]
mov r10, qword [rdx]
cmp rdi, r9
mov r11, rdi
cmovg rdi, r9
cmp rcx, r10
jne 0x45086c
cmp r11, r9
jmp 0x4508c9
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x18], r9
mov rax, rcx
mov rbx, r10
mov rcx, rdi
call sym.runtime.memmove
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jae 0x450828
jmp 0x4508d7
add rsp, 0x60
pop rbp
ret
mov rax, r9
mov rcx, r11
nop dword [rax]
call sym.runtime.panicSliceB
mov rax, rsi
call sym.runtime.panicIndex
mov rax, r8
call sym.runtime.panicIndex
lea rax, [0x00518093]
mov ebx, 0x1d
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime.concatstrings
Function at 0x453040
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov ecx, ebx
mov rdx, qword [rax + 0xb0]
mov rbx, qword [rax + 0x150]
lea rsi, [rdx + rcx]
nop dword [rax]
cmp rbx, 1
jle 0x453072
mov rdi, qword [rax + 0x148]
xor r8d, r8d
jmp 0x453082
mov rax, rsi
add rsp, 0x28
pop rbp
ret
lea rdi, [r9 + 0x18]
inc r8
cmp r8, rbx
jge 0x4530b5
mov r9, rdi
mov r10, qword [rdi]
mov r11, qword [rdi + 8]
cmp r10, rcx
ja 0x45309b
cmp r11, rcx
ja 0x4530aa
lea r12, [rbx - 1]
nop
cmp r8, r12
jne 0x45307b
cmp r11, rcx
jne 0x45307b
mov rbx, qword [rdi + 0x10]
lea rsi, [rbx + rcx]
sub rsi, r10
mov rcx, qword [rax + 0xb8]
nop dword [rax]
cmp rsi, rcx
jbe 0x453072
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rcx
call sym.runtime.printlock
lea rax, [0x0051394b]
mov ebx, 0x12
call sym.runtime.printstring
mov rax, qword [rsp + 0x10]
call sym.runtime.printhex
lea rax, [0x0051250a]
mov ebx, 0xe
call sym.runtime.printstring
mov rax, qword [rsp + 0x20]
call sym.runtime.printhex
lea rax, [0x00510393]
mov ebx, 3
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x005196f6]
mov ebx, 0x21
call sym.runtime.throw
nop
int3
Function at 0x454140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4542b7
movzx edx, byte [rax]
test edx, edx
jne 0x454174
nop dword [rax]
test r8b, r8b
jne 0x454174
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x454187
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x454277
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x454265
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x454257
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4541dd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x454220
mov eax, 1
cmp rax, rbx
ja 0x45420b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45424f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x454213
mov rcx, r11
mov eax, r12d
jmp 0x4541e2
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4542ad
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x454270
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45418d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3
Function at 0x454dc0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x454f19
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov edx, dword [0x00682c18]
test edx, edx
jne 0x454df5
call sym.runtime.netpollGenericInit
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
jne 0x454f07
mov rdx, rax
nop
mov qword [rbx], rax
test byte [rdx], al
mov rdi, qword [rdx + 0x22b0]
mov rcx, qword [rdx + 0x22b8]
lea r8, [rdi + 1]
mov rax, qword [rdx + 0x22a8]
cmp rcx, r8
jae 0x454e7b
mov qword [rsp + 0x40], rdi
mov rbx, r8
mov edi, 1
lea rsi, [0x004ee160]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x22b8], rcx
cmp dword [0x00682e70], 0
je 0x454e67
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rsi, qword [rdx + 0x22a8]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x22a8], rax
mov rdi, qword [rsp + 0x40]
mov r8, rbx
mov rbx, qword [rsp + 0x60]
mov qword [rdx + 0x22b0], r8
cmp dword [0x00682e70], 0
je 0x454e9c
call sym.runtime.gcWriteBarrier2
mov qword [r11], rbx
mov rsi, qword [rax + r8*8 - 8]
mov qword [r11 + 8], rsi
mov qword [rax + r8*8 - 8], rbx
mov rax, qword [rdx + 0x22a8]
mov rsi, qword [rdx + 0x22b0]
mov rcx, qword [rdx + 0x22b8]
mov rbx, rsi
call sym.runtime.siftupTimer
mov rdx, qword [rsp + 0x58]
cmp qword [rdx + 0x22b0], 0
jbe 0x454efd
mov rax, qword [rdx + 0x22a8]
mov rcx, qword [rsp + 0x60]
cmp qword [rax], rcx
jne 0x454ee9
mov rax, qword [rcx + 8]
xchg qword [rdx + 0x1228], rax
nop
mov eax, 1
lock xadd dword [rdx + 0x22c0], eax
add rsp, 0x48
pop rbp
ret
xor eax, eax
mov rcx, rax
call sym.runtime.panicIndex
lea rax, [0x00519a85]
mov ebx, 0x22
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.doaddtimer
Function at 0x455580
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455a28
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
nop dword [rax]
test rbx, rbx
jle 0x455a16
test rcx, rcx
jl 0x455a05
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rsi
jmp 0x4555da
mov rax, r11
mov edx, dword [rax + 0x40]
mov r10d, edx
cmp r10, 9
ja 0x4557d5
lea r11, [0x00542660]
jmp qword [r11 + r10*8]
call sym.runtime.badTimer
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov r11, qword [rsp + 0x40]
mov r12d, 6
jmp 0x4555d7
lea rax, [0x00519717]
mov ebx, 0x21
call sym.runtime.throw
lea rax, [0x00517614]
mov ebx, 0x1b
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.runtime.modtimer

Function at 0x457f20
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x457ff7
push rbp
mov rbp, rsp
sub rsp, 0x18
lea rdx, [rbx + 7]
nop
and rdx, 0xfffffffffffffff8
cmp qword [rax], 0
nop
je 0x457f52
mov rsi, qword [rax + 8]
add rsi, rdx
cmp rsi, 0xfff8
jbe 0x457f9d
cmp rdx, 0xfff8
ja 0x457fe5
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x10], rdx
mov eax, 0x10000
lea rbx, [0x00685840]
call sym.runtime.sysAlloc
test rax, rax
je 0x457fd4
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rax], rbx
mov qword [rdx], rax
mov qword [rdx + 8], 0
mov rax, rdx
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rax + 8]
cmp rbx, 0xfff8
jae 0x457fc7
mov rcx, qword [rax]
test byte [rcx], al
lea rcx, [rcx + rbx]
lea rcx, [rcx + 8]
add rdx, rbx
mov qword [rax + 8], rdx
mov rax, rcx
add rsp, 0x18
pop rbp
ret
mov rax, rbx
mov ecx, 0xfff8
call sym.runtime.panicIndexU
lea rax, [0x00516f67]
mov ebx, 0x1a
call sym.runtime.throw
lea rax, [0x00517b68]
mov ebx, 0x1c
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime._traceRegionAlloc_.alloc
Function at 0x459e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459f35
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call sym.runtime._traceMap_.put
nop
test bl, bl
je 0x459f2f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._traceStringTable_.put.func1]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime._traceStringTable_.put
Function at 0x45cac0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45cc6e
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
call sym.runtime.printlock
lea rax, [0x00517b84]
mov ebx, 0x1c
call sym.runtime.printstring
mov rax, qword [rsp + 0x50]
call sym.runtime.printuint
lea rax, [0x005103ab]
mov ebx, 3
call sym.runtime.printstring
call sym.runtime.printunlock
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rcx
xor edx, edx
jmp 0x45cb59
mov rdx, qword [rsp + 0x30]
inc rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
jge 0x45cbdd
mov qword [rsp + 0x30], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call sym.runtime.findfunc
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
nop
test rax, rax
je 0x45cb93
mov edx, dword [rax + 4]
mov r9d, dword [rax + 0x24]
movzx r10d, byte [rax + 0x28]
jmp 0x45cb9d
xor r10d, r10d
xor r9d, r9d
xor edx, edx
xor ebx, ebx
mov r11, qword [rsp + 0x30]
test r11, r11
sete sil
mov rax, rbx
mov ebx, edx
mov ecx, r9d
mov edi, r10d
xor r8d, r8d
call sym.runtime.showfuncinfo
nop dword [rax]
test al, al
je 0x45cb47
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sym.runtime.printAncestorTracebackFuncInfo
jmp 0x45cb47
cmp qword [rsp + 0x78], 0x32
jne 0x45cc05
call sym.runtime.printlock
lea rax, [0x00518c5c]
mov ebx, 0x1f
call sym.runtime.printstring
nop dword [rax + rax]
call sym.runtime.printunlock
mov rax, qword [rsp + 0x90]
call sym.runtime.findfunc
test rax, rax
jne 0x45cc1b
xor ecx, ecx
jmp 0x45cc4a
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rax
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x24]
movzx edi, byte [rax + 0x28]
xor esi, esi
xor r8d, r8d
mov rax, rbx
mov ebx, edx
call sym.runtime.showfuncinfo
mov rbx, qword [rsp + 0x20]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x45cc68
cmp qword [rsp + 0x88], 1
je 0x45cc68
mov rcx, qword [rsp + 0x90]
xor edi, edi
call sym.runtime.printcreatedby1
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp sym.runtime.printAncestorTraceback
Function at 0x45cea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45cf4f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00682e20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers