joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417820
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4179f6
sub esp, 0x18
mov eax, dword [0x61c788]
test eax, eax
jne 0x4179df
lea eax, [0x61c778]
mov dword [esp], eax
call sym.runtime.lock
mov eax, dword [0x61c77c]
test eax, eax
je 0x417866
cmp dword [eax + 8], 0xcc
jne 0x4178dc
mov eax, dword [0x61c780]
test eax, eax
jne 0x4178be
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x61ef10]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x61c780], eax
mov ecx, dword [0x61c784]
mov dword [eax], ecx
mov eax, dword [0x61c780]
mov dword [0x61c784], eax
movzx eax, byte [0x61cca0]
test al, al
jne 0x4178be
xor eax, eax
jmp 0x4179d3
mov eax, dword [0x61c780]
mov ecx, dword [eax + 4]
mov dword [0x61c780], ecx
mov ecx, dword [0x61c77c]
mov dword [eax + 4], ecx
mov dword [0x61c77c], eax
mov eax, dword [0x61c77c]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call sym.internal_runtime_atomic.Xadd
mov eax, dword [0x61c998]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x417923
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x417963
call sym.runtime.gcWriteBarrier8
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
lea eax, [0x61c778]
mov dword [esp], eax
call sym.runtime.unlock
lea eax, [0x61c774]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.internal_runtime_atomic._Uint32_.Or
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov ebx, ecx
sub ecx, edx
lea edx, [0x5d8388]
movzx ecx, byte [edx + ecx]
lea ebp, [0x61cca0]
mov byte [ebp + ebx], cl
lea eax, [ebx + 1]
cmp eax, 0x80
jl 0x4179a7
jmp 0x4178be
lea eax, [0x52af3e]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x41c270
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41c2e7
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sym.runtime._gcCPULimiterState_.tryLock
movzx eax, byte [esp + 4]
test al, al
je 0x41c2cc
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x41c2d0
mov dword [esp], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], ecx
call sym.runtime._gcCPULimiterState_.updateLocked
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sym.runtime._gcCPULimiterState_.unlock
add esp, 0xc
ret
add esp, 0xc
ret
lea eax, [0x52af56]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._gcCPULimiterState_.update
Function at 0x42c8c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ca48
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42c99f
cmp cl, 1
je 0x42c940
cmp cl, 2
jne 0x42ca31
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], 0
call sym.internal_runtime_atomic._Uintptr_.Store
lea eax, [0x608e28]
mov dword [esp], eax
call sym.runtime.lock
lea eax, [0x608e00]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call sym.runtime._fixalloc_.free
lea eax, [0x608e28]
mov dword [esp], eax
call sym.runtime.unlock
jmp 0x42ca2d
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call sym.runtime.queuefinalizer
lea eax, [0x608e28]
mov dword [esp], eax
call sym.runtime.lock
lea eax, [0x608d60]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call sym.runtime._fixalloc_.free
lea eax, [0x608e28]
mov dword [esp], eax
call sym.runtime.unlock
jmp 0x42ca2d
cmp cl, 3
je 0x42c9e8
cmp cl, 4
jne 0x42c9af
mov byte [eax + 8], 1
jmp 0x42ca2d
cmp cl, 5
jne 0x42ca31
lea eax, [0x608e28]
mov dword [esp], eax
call sym.runtime.lock
lea eax, [0x608dd8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call sym.runtime._fixalloc_.free
lea eax, [0x608e28]
mov dword [esp], eax
call sym.runtime.unlock
jmp 0x42ca2d
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call sym.runtime.mProf_Free
lea eax, [0x608e28]
mov dword [esp], eax
call sym.runtime.lock
lea eax, [0x608d88]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call sym.runtime._fixalloc_.free
lea eax, [0x608e28]
mov dword [esp], eax
call sym.runtime.unlock
add esp, 0x14
ret
lea eax, [0x527c2f]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.freeSpecial
Function at 0x458db0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x458f21
sub esp, 0x14
lea eax, [0x61cc94]
mov dword [esp], eax
call sym.internal_runtime_atomic._Int32_.Load
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x458de7
mov ecx, dword [esp + 0x18]
jmp 0x458e02
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 6]
test dl, dl
je 0x458e02
lea eax, [ecx + 0x30]
mov dword [esp], eax
call sym.runtime.lock
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call sym.runtime._timer_.lock
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [0x524fc9]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
call sym.runtime._timer_.trace
mov eax, dword [esp + 0x10]
test eax, eax
je 0x458e40
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime._timer_.maybeRunAsync
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 5]
test dl, 1
je 0x458e80
mov ebx, edx
or edx, 2
mov byte [ecx + 5], dl
test dl, 4
jne 0x458e80
or ebx, 6
mov byte [ecx + 5], bl
mov eax, dword [ecx + 0x2c]
test byte [eax], al
add eax, 0x14
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.internal_runtime_atomic._Int32_.Add
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0xf], al
xchg ebp, eax
test eax, eax
jne 0x458ebe
movzx edx, byte [ecx + 6]
test dl, dl
je 0x458ebe
inc dword [ecx + 0x28]
mov dword [esp], ecx
call sym.runtime._timer_.unlock
mov eax, dword [esp + 0x10]
test eax, eax
je 0x458ed5
movzx ebp, byte [esp + 0xf]
jmp 0x458f17
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x458ee8
movzx ebp, byte [esp + 0xf]
jmp 0x458f17
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call sym.runtime.unlock
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime._timer_.hchan
mov eax, dword [esp + 4]
mov dword [esp], eax
call sym.runtime.timerchandrain
movzx ebp, byte [esp + 4]
movzx eax, byte [esp + 0xf]
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x1c], al
xchg ebp, eax
add esp, 0x14
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime._timer_.stop
Function at 0x45ac80
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45ad67
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp], eax
call sym.runtime._timer_.lock
mov eax, dword [esp + 0x10]
mov dword [esp], eax
lea ecx, [0x527253]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xe
call sym.runtime._timer_.trace
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x45acdd
call sym.runtime.badTimer
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x45ad31
test cl, 4
je 0x45ad31
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
test edx, edx
seta dl
and ebx, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x45ad31
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call sym.internal_runtime_atomic._Int32_.Add
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sym.runtime._timer_.needsAdd
movzx eax, byte [esp + 4]
mov byte [esp + 0xf], al
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call sym.runtime._timer_.unlock
movzx eax, byte [esp + 0xf]
test al, al
je 0x45ad63
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sym.runtime._timer_.maybeAdd
add esp, 0x14
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.blockTimerChan

Function at 0x4610d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x461179
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4610f6
mov ecx, 1
jmp 0x461114
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call sym.runtime._traceBuf_.available
movzx eax, byte [esp + 8]
xor eax, 1
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1f], cl
test cl, cl
jne 0x46112a
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
jmp 0x461157
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
movzx eax, byte [esp + 0x30]
mov byte [esp + 0xc], al
call sym.runtime.traceWriter.refill
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x1f]
mov byte [esp + 0x48], al
add esp, 0x20
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.traceExpWriter.ensure
Function at 0x4626f0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4628d2
sub esp, 0x54
mov eax, dword [0x61c868]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x50]
mov dword [esp + 0x4c], eax
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x58]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov word [esp + 8], 0x101
call sym.runtime.traceLocker.eventWriter
mov eax, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x4c]
lea ebp, [ebx + 0xec]
mov dword [esp], ebp
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], ebp
call sym.runtime._traceSchedResourceState_.nextSeq
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x4c]
mov ebx, dword [edx + 0x54]
mov edx, dword [edx + 0x58]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 2
call sym.runtime.traceEventWriter.write
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
call sym.runtime.puintptr.ptr
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x960]
test eax, eax
jne 0x462831
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x3c]
jmp 0x4628be
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sym.runtime.puintptr.ptr
mov eax, dword [esp + 0x5c]
and eax, 1
shl eax, 5
lea ecx, [0x5fdd30]
add eax, ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov ecx, dword [ecx + 0x960]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x27
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call sym.runtime.traceEventWriter.write
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call sym.runtime.traceEventWriter.end
add esp, 0x54
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.traceLocker.GoStart
Function at 0x464590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x464798
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x464748
mov ecx, dword [esp + 0x90]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x8c]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and edx, ebp
test dl, dl
je 0x464658
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call sym.runtime.traceWriter.event
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x4646da
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call sym.runtime.traceWriter.event
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x46472f
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call sym.runtime.traceWriter.event
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call sym.runtime.printlock
lea eax, [0x52727d]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call sym.runtime.printstring
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea eax, [0x530d94]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.traceWriter.writeGoStatus
Function at 0x473220
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4732bb
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x61c868]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00475487
lea ecx, [sym.runtime.callers.func1]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call sym.runtime.systemstack
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.callers

Function at 0x475240
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x61c727], 0
je 0x47525a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x475260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x61c727], 0
je 0x47527b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x475fe0
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x475ffa
mov ecx, 0x14
jmp 0x476003
shl ecx, 2
add ecx, 0xe10
mov dword [0x61c868], ecx
ret
Function at 0x481360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4813de
sub esp, 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
xor eax, eax
jmp 0x4813cd
mov dword [esp + 4], edx
mov esi, ebx
and esi, 0xff
xor ecx, esi
shr ebx, 8
mov esi, ebp
shl esi, 0x18
mov dword [esp], esi
mov edi, eax
mov eax, ecx
mov esi, 0x1b3
mul esi
shl ecx, 8
mov esi, dword [esp + 4]
imul esi, esi, 0x1b3
add esi, edx
inc edi
mov edx, edi
mov edi, dword [esp]
or ebx, edi
shr ebp, 8
add esi, ecx
mov ecx, eax
mov eax, edx
mov edx, esi
cmp eax, 8
jl 0x481387
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
add esp, 8
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect.fnvUint64

Function at 0x4813f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48144b
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xor eax, eax
jmp 0x48143d
mov ebp, ebx
and ebp, 0xff
xor ecx, ebp
mov ebp, eax
mov eax, ecx
mov esi, 0x1b3
mov edi, edx
mul esi
shl ecx, 8
imul edi, edi, 0x1b3
add edi, edx
inc ebp
shr ebx, 8
lea edx, [ecx + edi]
mov ecx, eax
mov eax, ebp
cmp eax, 4
jl 0x481410
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect.fnvUint32
Function at 0x4910b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x491278
sub esp, 0x60
mov eax, dword [esp + 0x68]
and eax, dword [esp + 0x7c]
test eax, 0x80000000
jne 0x491234
lea eax, [esp + 0x64]
mov dword [esp], eax
call sym.time._Time_.sec
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x78]
mov dword [esp], edx
call sym.time._Time_.sec
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x3c], ecx
lea edx, [esp + 0x64]
mov dword [esp], edx
call sym.time._Time_.nsec
mov eax, dword [esp + 4]
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x78]
mov dword [esp], ecx
call sym.time._Time_.nsec
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 4]
lea edi, [esp]
lea esi, [esp + 0x78]
call fcn.0047596e
mov ecx, eax
sar eax, 0x1f
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
sub edx, ebx
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x3c]
sbb ebx, ebp
mov ebp, eax
mov eax, edx
mov esi, 0x3b9aca00
mul esi
imul ebx, ebx, 0x3b9aca00
add edx, ebx
add eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
adc edx, ebp
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], edx
call sym.time.Time.Add
lea edi, [esp + 0x4c]
lea esi, [esp + 0x1c]
call fcn.0047596e
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0047596e
lea edi, [esp + 0x14]
lea esi, [esp + 0x64]
call fcn.0047596e
call sym.time.Time.Equal
movzx eax, byte [esp + 0x28]
test al, al
jne 0x49121a
lea edi, [esp]
lea esi, [esp + 0x64]
call fcn.0047596e
lea edi, [esp + 0x14]
lea esi, [esp + 0x78]
call fcn.0047596e
call sym.time.Time.Before
movzx eax, byte [esp + 0x28]
test al, al
je 0x491200
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0x80000000
add esp, 0x60
ret
mov dword [esp + 0x8c], 0xffffffff
mov dword [esp + 0x90], 0x7fffffff
add esp, 0x60
ret
mov eax, dword [esp + 0x30]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x90], eax
add esp, 0x60
ret
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x80]
mov ebx, dword [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call sym.time.subMono
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x60
ret
call sym.runtime.morestack_noctxt
jmp sym.time.Time.Sub
Function at 0x49fee0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [0x61c868]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49ff16
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x49ff0d
movzx ebp, byte [eax + ebx]
imul edx, edx, 0x1000193
inc ebx
xor edx, ebp
cmp ecx, ebx
jg 0x49ff00
mov dword [esp + 0x14], edx
ret
call sym.runtime.morestack_noctxt
jmp sym.reflect.fnv1