joyce8/EMBER2024-capa huggingface dataset:
Function at 0x534220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5343dc
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.0046c057
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x534258
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x534281
lea eax, [0x619aa0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call sym.runtime.makeslice
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.0046c057
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
or edx, ecx
test bl, bl
je 0x5342c4
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x5342d3
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x5342e2
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x5342f1
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x534300
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x53430c
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x534318
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x42], ax
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x34]
cmp eax, edx
jae 0x534388
mov dword [esp + 0x30], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x619aa0]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x58], ebx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call sym.runtime.memmove
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.0046c516
add esp, 0x5c
ret
call sym.runtime.morestack_noctxt
jmp sym.vendor_golang.org_x_net_dns_dnsmessage.NewBuilder
Function at 0x54aa20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54ab91
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x54aab7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x54aa56
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x54aac3
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x54aa81
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x54aac3
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x54aac3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call sym.net.favoriteAddrFamily
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call sym.net.socket
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call sym.runtime.morestack_noctxt
jmp sym.net.internetSocket
Function at 0x558710
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x558881
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x558741
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x558741
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x558747
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x558755
cmp ecx, 4
jne 0x558786
cmp al, 0x2c
ja 0x55876e
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x558780
cmp al, 0x24
je 0x558780
cmp al, 0x26
jae 0x558780
jmp 0x558786
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x558780
cmp al, 0x5b
je 0x558780
cmp al, 0x5d
jne 0x558786
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5587bd
cmp al, 0x26
ja 0x55879f
cmp al, 0x24
je 0x5587dc
cmp al, 0x26
je 0x5587dc
jmp 0x558863
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5587dc
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x55885d
cmp al, 0x2f
je 0x5587dc
jmp 0x558863
cmp al, 0x3d
ja 0x5587d4
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5587dc
cmp al, 0x3d
je 0x5587dc
jmp 0x558863
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x558853
cmp ecx, 2
jg 0x558817
cmp ecx, 1
je 0x55880c
cmp ecx, 2
jne 0x558863
cmp al, 0x2f
je 0x5587fa
cmp al, 0x3b
je 0x5587fa
cmp al, 0x2c
jne 0x558801
mov eax, 1
jmp 0x558807
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x55883d
cmp al, 0x40
je 0x55882b
cmp al, 0x2f
je 0x55882b
cmp al, 0x3f
jne 0x558832
mov eax, 1
jmp 0x558838
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x55884d
cmp ecx, 7
jne 0x558863
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x55885d
cmp al, 0x7e
jne 0x558863
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x55887b
cmp al, 0x21
je 0x558875
add eax, 0xffffffd8
cmp al, 2
ja 0x55887b
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call sym.runtime.morestack_noctxt
jmp sym.net_url.shouldEscape
Function at 0x55c030
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55c098
sub esp, 8
lea eax, [0x634fa0]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
lea ecx, [0x6ab388]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
add esp, 8
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_md5.New

Function at 0x55cc00
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55cc6f
sub esp, 8
lea eax, [0x6350a0]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
lea ecx, [0x6ab418]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
add esp, 8
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_sha1.New
Function at 0x5725a0
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57261d
sub esp, 8
lea eax, [0x61d8c0]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
xor ecx, ecx
jmp 0x5725cf
mov dword [eax + edx*4], ecx
lea ecx, [edx + 1]
cmp ecx, 0x100
jge 0x5725dd
mov edx, ecx
xor ebx, ebx
jmp 0x572602
mov ecx, dword [0x84d1a0]
test ecx, ecx
je 0x5725f7
call sym.runtime.gcWriteBarrier2
mov dword [edi], eax
mov ecx, dword [0x80d210]
mov dword [edi + 4], ecx
mov dword [0x80d210], eax
add esp, 8
ret
inc ebx
cmp ebx, 8
jge 0x5725c9
test ecx, 1
je 0x572619
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x572601
shr ecx, 1
jmp 0x572601
call sym.runtime.morestack_noctxt
jmp sym.hash_crc32.init
Function at 0x5bb990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5bbbbc
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sym.encoding_xml._Decoder_.mustgetc
movzx eax, byte [esp + 5]
test al, al
je 0x5bbac4
movzx eax, byte [esp + 4]
cmp al, 0x22
je 0x5bba90
cmp al, 0x27
je 0x5bba90
mov ecx, dword [esp + 0x1c]
movzx edx, byte [ecx]
test dl, dl
jne 0x5bba26
nop
cmp al, 0xa
jne 0x5bb9eb
dec dword [ecx + 0x7c]
movzx eax, al
mov dword [ecx + 0x6c], eax
mov eax, dword [ecx + 0x88]
mov edx, dword [ecx + 0x8c]
add eax, 0xffffffff
mov dword [ecx + 0x88], eax
adc edx, 0xffffffff
mov dword [ecx + 0x8c], edx
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x3c], 0
mov byte [ecx + 0x40], 0
jmp 0x5bbaf3
lea eax, [0x62b960]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2e
lea ecx, [0x6621d6]
mov dword [eax], ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x7c]
mov dword [eax + 8], edx
lea edx, [0x6aab64]
mov dword [ecx + 0x74], edx
mov edx, dword [0x84d1a0]
test edx, edx
je 0x5bba71
call sym.runtime.gcWriteBarrier2
mov dword [edi], eax
mov edx, dword [ecx + 0x78]
mov dword [edi + 4], edx
mov dword [ecx + 0x78], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
movzx eax, al
mov dword [esp + 4], eax
mov byte [esp + 8], 0
call sym.encoding_xml._Decoder_.text
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call sym.bytes._Buffer_.WriteByte
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
call sym.encoding_xml._Decoder_.mustgetc
movzx eax, byte [esp + 5]
test al, al
je 0x5bbb9a
movzx edx, byte [esp + 4]
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x5bbae0
lea ebx, [edx - 0x41]
cmp bl, 0x19
jbe 0x5bbae0
lea ebx, [edx - 0x30]
cmp bl, 9
jbe 0x5bbae0
cmp dl, 0x5f
je 0x5bbae0
cmp dl, 0x3a
je 0x5bbae0
cmp dl, 0x2d
je 0x5bbae0
nop
cmp dl, 0xa
jne 0x5bbb43
mov ebx, dword [esp + 0x1c]
dec dword [ebx + 0x7c]
jmp 0x5bbb47
mov ebx, dword [esp + 0x1c]
movzx edx, dl
mov dword [ebx + 0x6c], edx
mov edx, dword [ebx + 0x88]
mov ebp, dword [ebx + 0x8c]
add edx, 0xffffffff
mov dword [ebx + 0x88], edx
adc ebp, 0xffffffff
mov dword [ebx + 0x8c], ebp
mov ecx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x3c]
cmp ecx, eax
jb 0x5bbbb6
mov edx, dword [ebx + 0x30]
mov ebx, dword [ebx + 0x38]
sub ebx, eax
sub ecx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
add eax, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
add esp, 0x18
ret
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
add esp, 0x18
ret
call sym.runtime.panicSliceB
nop
call sym.runtime.morestack_noctxt
jmp sym.encoding_xml._Decoder_.attrval
Function at 0x5bceb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5bd051
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [eax + 0x34], 0
mov dword [eax + 0x3c], 0
mov byte [eax + 0x40], 0
mov dword [esp], eax
call sym.encoding_xml._Decoder_.readName
movzx eax, byte [esp + 4]
test al, al
je 0x5bd032
mov edx, dword [esp + 0x30]
mov ecx, dword [edx + 0x34]
mov eax, dword [edx + 0x3c]
nop
cmp ecx, eax
jb 0x5bd04b
mov ebx, dword [edx + 0x30]
mov ebp, dword [edx + 0x38]
sub ecx, eax
mov dword [esp + 0x1c], ecx
sub ebp, eax
mov esi, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x24], eax
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
call sym.encoding_xml.isName
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5bcffd
mov dword [esp], 0
lea eax, [0x6565e0]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x12
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
call sym.runtime.concatstring2
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
lea edx, [0x62b960]
mov dword [esp], edx
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [0x84d1a0]
test ecx, ecx
jne 0x5bcfaa
mov ecx, dword [esp + 0x28]
jmp 0x5bcfb5
call sym.runtime.gcWriteBarrier1
mov ecx, dword [esp + 0x28]
mov dword [edi], ecx
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0x7c]
mov dword [eax + 8], edx
lea edx, [0x6aab64]
mov dword [ecx + 0x74], edx
mov edx, dword [0x84d1a0]
test edx, edx
je 0x5bcfe1
call sym.runtime.gcWriteBarrier2
mov dword [edi], eax
mov edx, dword [ecx + 0x78]
mov dword [edi + 4], edx
mov dword [ecx + 0x78], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov byte [esp + 0x3c], 0
add esp, 0x2c
ret
mov dword [esp], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call sym.runtime.slicebytetostring
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov byte [esp + 0x3c], 1
add esp, 0x2c
ret
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov byte [esp + 0x3c], 0
add esp, 0x2c
ret
call sym.runtime.panicSliceB
nop
call sym.runtime.morestack_noctxt
jmp sym.encoding_xml._Decoder_.name
Function at 0x5ea140
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x7c]
cmp eax, dword [ecx + 8]
jbe 0x5ea30a
sub esp, 0xfc
nop
lea edi, [esp + 0x94]
xor eax, eax
call fcn.0046c049
nop
mov dword [esp + 0x94], 0x67452301
mov dword [esp + 0x98], 0xefcdab89
mov dword [esp + 0x9c], 0x98badcfe
mov dword [esp + 0xa0], 0x10325476
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0
mov ecx, dword [esp + 0x100]
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx + 8]
lea ebp, [esp + 0x94]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call sym.crypto_md5._digest_.Write
lea edi, [esp + 0x38]
lea esi, [esp + 0x94]
call fcn.0046c48a
lea ecx, [esp + 0x38]
mov dword [esp], ecx
call sym.crypto_md5._digest_.checkSum
lea edi, [esp + 0x20]
lea esi, [esp + 4]
call fcn.0046c548
mov dword [esp], 0
mov dword [esp + 4], 0x10
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x10
lea ecx, [0x619aa0]
mov dword [esp + 0x10], ecx
call sym.runtime.growslice
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xf0], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x34], ebx
mov dword [esp], ecx
lea ebp, [esp + 0x20]
mov dword [esp + 4], ebp
mov dword [esp + 8], 0x10
call sym.runtime.memmove
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf8], 0
mov ecx, dword [esp + 0xf0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 8], ecx
call sym.runtime.convTslice
mov ecx, dword [esp + 0xc]
lea edx, [0x6107c0]
mov dword [esp + 0xf4], edx
mov dword [esp + 0xf8], ecx
lea ecx, [0x650ef4]
mov dword [esp], ecx
mov dword [esp + 4], 2
lea ecx, [esp + 0xf4]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call sym.fmt.Sprintf
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x104], ecx
mov dword [esp + 0x108], edx
add esp, 0xfc
ret
call sym.runtime.morestack_noctxt
jmp sym.fb2converter_go_micro_config_source._ChangeSet_.Sum
Function at 0x5f7090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f7215
sub esp, 0x7c
mov eax, dword [esp + 0x80]
test byte [eax], al
lea ecx, [eax + 0x20]
mov dword [esp + 0x78], ecx
mov dword [esp], ecx
call sym.sync._RWMutex_.RLock
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x74], ecx
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0046c054
lea eax, [0x61cea0]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
call sym.runtime.mapiterinit
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x5f7122
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], edx
mov dword [ecx + edx*4 - 4], ebx
lea eax, [esp + 0x3c]
mov dword [esp], eax
call sym.runtime.mapiternext
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x3c]
test ebx, ebx
je 0x5f718c
mov ebx, dword [esp + 0x40]
inc edx
mov ebx, dword [ebx]
cmp eax, edx
jae 0x5f716b
mov dword [esp + 0x30], ebx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
lea eax, [0x627460]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov ebp, dword [0x84d1a0]
test ebp, ebp
je 0x5f70fe
call sym.runtime.gcWriteBarrier2
mov dword [edi], ebx
mov ebp, dword [ecx + edx*4 - 4]
mov dword [edi + 4], ebp
jmp 0x5f70fe
mov dword [esp + 0x70], ecx
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call sym.sync._RWMutex_.RUnlock
xor eax, eax
jmp 0x5f7209
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx + eax*4]
mov ebx, dword [edx + 0x20]
mov dword [esp + 0x6c], ebx
mov ebp, dword [esp + 0x80]
mov esi, dword [ebp + 0x3c]
mov edi, dword [ebp + 0x40]
mov esi, dword [esi + 0x14]
mov ebp, dword [edx + 4]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [esp], edi
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
lea eax, [esp + 0x34]
mov dword [esp + 4], eax
call sym.runtime.selectnbsend
mov eax, dword [esp + 0x28]
inc eax
mov ecx, dword [esp + 0x20]
cmp ecx, eax
jg 0x5f71a4
add esp, 0x7c
ret
call sym.runtime.morestack_noctxt
jmp sym.fb2converter_go_micro_config_loader_memory._memory_.update
Function at 0x5fad60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5faf31
sub esp, 0x6c
call sym.os.Executable
mov eax, dword [esp + 8]
test eax, eax
jne 0x5faec0
call sym.path_filepath.Dir
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x68], 8
lea edx, [0x65266b]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x5c]
mov dword [esp], ebx
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call sym.path_filepath.join
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], edx
call sym.path_filepath.Dir
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x44]
mov edx, eax
xor eax, eax
call fcn.0046c05a
mov eax, dword [esp + 0x24]
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x50], 0xc
lea eax, [0x653bd9]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x58], 8
lea eax, [0x65266b]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
mov dword [esp + 4], 3
mov dword [esp + 8], 3
call sym.path_filepath.join
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x34], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], eax
xor eax, eax
jmp 0x5faedb
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x6c
ret
mov ecx, dword [esp + 0x24]
lea eax, [ecx + 1]
cmp eax, 2
jge 0x5faf1d
mov dword [esp + 0x24], eax
lea ecx, [esp + eax*8 + 0x34]
mov edx, dword [ecx]
mov dword [esp + 0x30], edx
mov ecx, dword [ecx + 4]
mov dword [esp + 0x20], ecx
mov dword [esp], edx
mov dword [esp + 4], ecx
call sym.os.Stat
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x5faed4
mov eax, dword [esp + 0x30]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x7c], eax
add esp, 0x6c
ret
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x6c
ret
call sym.runtime.morestack_noctxt
jmp sym.fb2converter_config.FindConverter
Function at 0x7b3370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x7b338e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x7dc074
push ecx
mov edi, eax
call fcn.007c7198
mov esi, eax
add esp, 8
test esi, esi
jne 0x7b33cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.007c702e
push esi
call fcn.007c6fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret