joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e968
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0045eb5b
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004696b0
xor ebx, ebx
cmp eax, ebx
jne 0x45eb16
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0045eb5b
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0046638f
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004b7c84
add esp, 0x10
test eax, eax
jne 0x45ea31
push esi
call fcn.0045c01a
mov esi, eax
cmp esi, ebx
pop ecx
je 0x45ea31
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x45ea1c
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x45ea31
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45ea2a
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0046abc3
cmp byte [esp + 0x13], bl
je 0x45ea61
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0045eb98
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x45ead1
push 0x14
call fcn.004b6ef1
cmp eax, ebx
pop ecx
je 0x45ea8b
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x45ea8d
xor edi, edi
cmp edi, ebx
je 0x45ead1
push esi
push edi
call fcn.0045e0be
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0045e186
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045e2af
add esp, 0x18
call fcn.0045eb5b
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00468d7d
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45eae8
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x45eafa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x45eb3d
push dword [esp + 0x20]
call dword [int.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x45eb3d
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0045e186
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045e2af
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465fbe
Capabilities:
Encode data using xor

Disassembly:
cld
sbb bl, byte [edx]
pop ss
fcmovne st(0), st(1)
xlatb
adc byte [edx + 0x378d17c5], ch
stosb byte es:[edi], al
lds edx, [edi]
lea esi, [edi]
jge 0x465f8d
enter 0x74b9, 0xffffffffffffffa1
adc al, 0x32
mov dword [eax - 0xe], eax
and al, 0x85
xor cl, byte [ebx]
pop es
test eax, 0x31c33fcb
mov ecx, 0x4d0b3707
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
xlatb
push ecx
sub byte [edx + edx*8 + 0x12f31545], dh
lcall 0xdfbc, 0xe6f0b120
fstp dword [ebx]
xchg esp, eax
call 0xd5880b16
cwde
push ecx
movsb byte es:[edi], byte [esi]
mov byte [0xfdb274d8], al
xor eax, 0x943614a8
inc ebp
adc ch, byte [esi]
test byte [ebx], dh
push esp
pop edi
inc esp
jmp 0x465fa1
Function at 0x47faac
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x91
rcr byte [edi], 0x2c
inc esp
dec edi
pop ss
pop eax
add cl, byte [ecx]
mov dh, 0xe2
xchg byte [ecx + 0x3d42bb9e], ch
mov dword [0x1c4ed5db], eax
outsd dx, dword [esi]
or byte [ecx], bh
cmc
or al, 0xa1
invalid

Function at 0x488ee5
Capabilities:
Encode data using xor

Disassembly:
xchg dword [ecx], ecx
mov eax, dword [ecx - 0xdefae]
bnd call dword [eax + 0x1b0a01c8]
fcmovu st(0), st(0)
xchg edi, eax
cmp edi, dword [ebx - 0x65]
push 0x87d0f5ae
or eax, 0x4bbe5f85
mov dl, 0x9a
lcall 0xdfa1, 0xbddbb388
lodsb al, byte [esi]
aaa
push eax
push esi
dec ebx
adc ecx, dword [ebx - 0x28]
in al, 0x1f
imul esi, ecx, 0x37e9369c
out 0x13, al
adc edi, dword [eax]
adc esp, dword [0x3e11ca7f]
jno 0x488ec6
sbb bl, byte [edi + 0x39]
lcall 0xacb1, 0x8e38a392
mov cl, 0xac
pushal
push cs
lahf
jge 0x488f45
pop ecx
arpl word [ecx], bx
sbb bh, al
pop ecx
aas
sub ecx, esi
push edx
mov esp, 0xfd434fd9
stc
lahf
imul esp, dword [ebx], 0xffffffcc
int3
Function at 0x4a9142
Capabilities:
Encode data using xor

Disassembly:
push ecx
aaa
cdq
mov word [ebx + 4], cs
sub byte [eax + 0x7232f4ec], al
pop eax
sub ah, 0xf4
xor dh, byte [edx + 0x58]
sar ah, 1
loope 0x4a9149
invalid
invalid

Function at 0x4aea86
Capabilities:
Encode data using xor

Disassembly:
cmp edx, edx
mov dword [0x5d23c2ba], eax
mov ah, byte [edi + ebp + 0x53df1aef]
arpl sp, sp
inc edx
popal
dec ecx
out 0xc8, eax
cdq
iretd
out 0xa, eax
and dword [ebp - 0x115885bc], edx
salc
add byte [eax - 0x7e], cl
inc esp
cdq
mov eax, dword [0x5279b18b]
xchg sp, si
or bl, byte [edx - 0x18428c64]
aad 0x66
mov bl, 0xe8
cld
push edx
sub al, 0x68
fucomp st(6)
push ds
loope 0x4aea58
invalid

Function at 0x4af923
Capabilities:
Encode data using xor

Disassembly:
sub cl, byte [ecx - 0x324dbbad]
pop esp
sbb dword [ecx + ecx*8 + 0x3f0dd435], esi
adc edi, dword [edi]
xor eax, 0x133f0dd4
aas
or al, 0x2e
mov ah, 0x42
cmpsb byte [esi], byte es:[edi]
loop 0x4af8f0
sub edi, esi
lodsb al, byte [esi]
sub edx, edi
int1
sbb eax, 0x43db5cbe
stc
mov cl, 0xa1
jge 0x4af96b
invalid
cmpsd dword [esi], dword es:[edi]
and byte [edi + 0x77e0096c], cl
loopne 0x4af9a1
loop 0x4af963
fdiv st(6)
mov bl, 0x2a
shr dword [edi + esi], cl
sahf
xchg ebx, eax
adc bh, byte [ecx + 0x21]
je 0x4af8e6
mov cl, 0x84
retf
test bl, cl
daa
xchg ebp, eax
ficom word [edx + 0x67]
lodsb al, byte [esi]
push ds
and dword [ecx], ecx
mov ah, 0xef
enter 0x476c, 0xffffffffffffffa1
sub al, 0x66
not byte [0x272064e5]
dec edx
push ss
lodsd eax, dword [esi]
fst dword [esi - 0x478941af]
mov bh, 0xac
cwde
lds edx, [ecx]
jb 0x4af992
add dword cs:[0x463fe853], 0x2b
add dword [0x463fe853], 0x2b
adc dword [eax - 0x47cef6c0], 0xb26007d2
jae 0x4af9c4
and dword [ebp - 0x6cc532c0], esp
inc ebp
aam 0x88
fnsave dword [edx]
xor eax, 0x12697233
adc eax, 0xceb3083f
in eax, dx
or al, byte [eax + 0x49]
cmpsd dword [esi], dword es:[edi]
sbb al, 0x6d
insd dword es:[edi], dx
jp 0x4af928
rol byte [ecx - 0x5a9ed111], 0x5f
dec edx
cmp ebp, dword [ebx + 0x34acb5eb]
jmp 0x4af93b
mov ch, 0xac
xor al, 0xeb
xchg ebp, eax
out 0xb8, eax
sar byte [ecx + 0x272d21dd], cl
xchg esp, eax
daa
salc
cli
sbb al, 0x2b
pop esp
aam 0x47
lcall 0xd53c, 0xe1802b95
cmp dword [esp + ebp*4], esi
sar byte [esp + 0x63], cl
pop ebx
or al, 0x22
inc ebp
inc edi
arpl word [ebx + 0xc], bx
and al, byte [ebp + 0x47]
jmp 0x1d44512e
Function at 0x4024e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00415c3a

Function at 0x4096c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.0041a063
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4096f5
xor eax, eax
jmp 0x40979b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x4096ee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4096ee
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00403c1a
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x40974c
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x40973b
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00408370
push edi
mov ebx, eax
call fcn.00403c49
pop ecx
test ebx, ebx
je 0x40978e
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00408a7b
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00408b2f
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x40f79a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40f7e1
call fcn.0041a063
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40f7e1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40f7fd
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040f314
mov esi, eax
test edi, edi
je 0x40f7fb
test ebx, ebx
je 0x40f7fb
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4101ca
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x43b899
call fcn.00422f08
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4101ef
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x410235
lea ecx, [ebp - 0x10]
call fcn.00401710
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ff20
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401530
mov eax, esi
call fcn.00422fe0
ret 8

Function at 0x421e0c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d0c8]
jne 0x421e16
repz ret
jmp fcn.0042772c

Function at 0x4301ee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042706d
and dword [ebp - 4], 0
cmp dword [0x4510ac], 0
mov ebx, eax
jne 0x43029f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x430350
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x442f50
push edi
call esi
test eax, eax
je 0x430350
push eax
call fcn.00426ffb
mov dword [esp], 0x442f40
push edi
mov dword [0x4510ac], eax
call esi
push eax
call fcn.00426ffb
mov dword [esp], 0x442f2c
push edi
mov dword [0x4510b0], eax
call esi
push eax
call fcn.00426ffb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4510b4], eax
call esi
push eax
call fcn.00426ffb
pop ecx
mov dword [0x4510bc], eax
test eax, eax
je 0x43029f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00426ffb
pop ecx
mov dword [0x4510b8], eax
mov eax, dword [0x4510b8]
cmp eax, ebx
je 0x4302f7
cmp dword [0x4510bc], ebx
je 0x4302f7
push eax
call fcn.00427076
push dword [0x4510bc]
mov esi, eax
call fcn.00427076
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4302f7
test edi, edi
je 0x4302f7
call esi
test eax, eax
je 0x4302ee
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4302ee
test byte [ebp - 0xc], 1
jne 0x4302f7
or dword [ebp + 0x10], 0x200000
jmp 0x430330
mov eax, dword [0x4510b0]
cmp eax, ebx
je 0x430330
push eax
call fcn.00427076
pop ecx
test eax, eax
je 0x430330
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x430330
mov eax, dword [0x4510b4]
cmp eax, ebx
je 0x430330
push eax
call fcn.00427076
pop ecx
test eax, eax
je 0x430330
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4510ac]
call fcn.00427076
pop ecx
test eax, eax
je 0x430350
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x430352
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x92a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x92a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x92a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92a06a
add dl, dl
jne 0x92a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92a0dc
xor eax, eax
add dl, dl
jne 0x92a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x92a17d
add dl, dl
jne 0x92a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x92a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x92a075
mov eax, 1
add dl, dl
jne 0x92a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92a0e1
sub eax, ebx
mov ebx, 1
jne 0x92a128
mov ecx, 1
add dl, dl
jne 0x92a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x92a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x92a136
cmp eax, 0x7d00
jae 0x92a16d
cmp eax, 0x500
jb 0x92a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92a075
cmp eax, 0x7f
ja 0x92a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x92a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x92a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x92a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x36c140
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x36c30b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x36c169
mov eax, 0x7000000
jmp 0x36c171
test eax, eax
je 0x36c2e6
mov dword [esp + 0x14], eax
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x5a1e00]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x36c2fe
cmp edx, 0x21
jae 0x36c2f2
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4e52e0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x4e5330]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x36c2c1
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4e5378]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand
Function at 0x376620
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x37682e
sub esp, 0x18
mov eax, dword [0x5dbe60]
test eax, eax
jne 0x376817
nop
nop
lea eax, [0x5dbe50]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x5dbe54]
test eax, eax
je 0x376668
cmp dword [eax + 8], 0xcc
jne 0x3766de
mov edx, dword [0x5dbe58]
test edx, edx
jne 0x3766c0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5e06f0]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x5dbe58], eax
mov ecx, dword [0x5dbe5c]
mov dword [eax], ecx
mov eax, dword [0x5dbe58]
mov dword [0x5dbe5c], eax
movzx eax, byte [0x5dc3c0]
test al, al
jne 0x3766c0
xor eax, eax
jmp 0x3767e8
mov edx, dword [0x5dbe58]
mov ebx, dword [edx + 4]
mov dword [0x5dbe58], ebx
mov ebx, dword [0x5dbe54]
mov dword [edx + 4], ebx
mov dword [0x5dbe54], edx
mov edx, dword [0x5dbe54]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x3767c7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime_internal_atomic.Xadd
mov eax, dword [0x5dc100]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x376728
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x37673e
call sym.runtime.gcWriteBarrier2
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x5dc100]
test eax, eax
jne 0x376762
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x376790
call sym.runtime.gcWriteBarrier6
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x5dbe50]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x5dbe4c]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.runtime_internal_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x59e324]
movzx ebx, byte [edx + eax]
lea ebp, [0x5dc3c0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x3766c0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x3767d1
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x4b800f]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x384300
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x384403
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x3843fd
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call sym.runtime._atomicScavChunkData_.load
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call sym.runtime._scavChunkData_.alloc
movzx eax, byte [esp + 0x18]
test al, 2
je 0x3843b1
cmp word [esp + 0x10], 0x1f0
jbe 0x3843b1
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + 0x30]
test bl, bl
jne 0x3843b5
mov ebx, dword [esp + 0x28]
cmp ebx, 0x200
jae 0x3843b5
nop
jmp 0x3843b5
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x3843f8
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call sym.runtime._atomicScavChunkData_.store
add esp, 0x1c
ret
call sym.runtime.panicIndexU
call sym.runtime.panicIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._scavengeIndex_.alloc
Function at 0x384410
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x384544
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x38453e
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call sym.runtime._atomicScavChunkData_.load
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call sym.runtime._scavChunkData_.free
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x384537
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call sym.runtime._atomicScavChunkData_.store
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x3844fa
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call sym.runtime._atomicOffAddr_.Load
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x384533
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sym.runtime_internal_atomic.Storeint64
add esp, 0x20
ret
mov eax, edx
call sym.runtime.panicIndexU
call sym.runtime.panicIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._scavengeIndex_.free