joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4231a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4232a6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4231e3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42329b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x42329b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x423289
xor eax, eax
jmp 0x423293
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4231d1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge
Function at 0x424a40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424b73
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x38]
test rdx, rdx
jne 0x424a96
call sym.runtime.getempty
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x424b08
mov rdi, qword [rax]
lea r8, [rsi - 1]
mov r9, rbx
sub rbx, rdi
cmp r8, 0x3f
jae 0x424b65
shl r8, 5
mov edi, dword [rdx + r8 + 0x20]
add edi, dword [rdx + r8 + 0x24]
cmp edi, ebx
ja 0x424b52
cmp rsi, 0x3f
jne 0x424b0b
mov qword [rsp + 0x10], rdx
call sym.runtime.getempty
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x38], rax
mov r9, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x424b0b
mov r9, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x424b45
mov rsi, rbx
shl rbx, 5
inc rsi
mov qword [rdx + 0x10], rsi
mov rsi, qword [rax]
sub r9, rsi
mov dword [rdx + rbx + 0x20], r9d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x40]
add rsp, 0x18
pop rbp
ret
mov rax, rbx
mov ecx, 0x3f
call sym.runtime.panicIndex
lea rax, [0x004e0cac]
mov ebx, 0x29
nop
call sym.runtime.throw
mov rax, r8
mov ecx, 0x3f
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime._stackScanState_.addObject
Function at 0x424e60
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424fca
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [0x005ae060], ebx
je 0x424e82
jmp 0x424fb8
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
and ecx, 0x7fffffff
dec ecx
cmp ecx, 0x80000000
jae 0x424fa7
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x424e7f
cmp edx, 0x80000000
jne 0x424fa1
cmp dword [0x0061c598], 0
jle 0x424f9b
nop
mov rax, qword [0x0061ca88]
mov rcx, rax
shr rax, 0x14
mov qword [rsp + 0x28], rax
mov rdx, qword [0x005ae088]
mov qword [rsp + 0x10], rdx
mov rbx, qword [0x005ae098]
sub rcx, rbx
shr rcx, 0x14
mov qword [rsp + 0x20], rcx
movsd xmm0, qword [0x005ae0a0]
movsd qword [rsp + 0x18], xmm0
call sym.runtime.printlock
lea rax, [0x004dec32]
mov ebx, 0x1f
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
call sym.runtime.printuint
lea rax, [0x004d9ea8]
mov ebx, 0xe
call sym.runtime.printstring
mov rax, qword [rsp + 0x20]
nop dword [rax]
call sym.runtime.printuint
lea rax, [0x004dc6e6]
mov ebx, 0x17
call sym.runtime.printstring
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004d910a]
mov ebx, 0xa
call sym.runtime.printstring
movsd xmm0, qword [rsp + 0x18]
nop dword [rax]
call sym.runtime.printfloat
lea rax, [0x004d986f]
mov ebx, 0xc
call sym.runtime.printstring
call sym.runtime.printunlock
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
lea rax, [0x004dfaaa]
mov ebx, 0x23
call sym.runtime.throw
lea rax, [0x004e1e80]
mov ebx, 0x31
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp sym.runtime._activeSweep_.end
Function at 0x425000
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x425109
push rbp
mov rbp, rsp
sub rsp, 0x30
call sym.runtime.sweepone
cmp rax, 0xffffffffffffffff
jne 0x425012
nop
mov edx, dword [0x005974d4]
test edx, 0x7fffffff
jne 0x4250f7
mov eax, dword [0x005ae060]
mov dword [rsp + 0x14], eax
xor ecx, ecx
jmp 0x4250a0
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x28], rdx
lea rcx, [rbx + rbx*4]
mov qword [rsp + 0x20], rcx
lea rax, [rdi + rcx*8]
lea rax, [rax + 8]
call sym.runtime._spanSet_.reset
mov rcx, qword [rsp + 0x28]
lea rdx, [0x005ae3a0]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 0x58]
mov rdx, qword [rsp + 0x20]
lea rax, [rcx + rdx*8]
mov rcx, qword [rsp + 0x18]
inc rcx
mov qword [rsp + 0x28], rcx
call sym.runtime._spanSet_.reset
mov ecx, dword [rsp + 0x14]
mov rdx, qword [rsp + 0x28]
mov eax, ecx
mov rcx, rdx
nop dword [rax + rax]
cmp rcx, 0x88
jge 0x4250d3
lea rdx, [rcx + rcx*2]
shl rdx, 6
mov ebx, eax
shr ebx, 1
and ebx, 1
dec ebx
neg ebx
lea rsi, [0x005ae3a0]
lea rdi, [rsi + rdx]
cmp rbx, 2
jb 0x42503e
jmp 0x4250eb
lea rax, [0x00597760]
call sym.runtime._scavengerState_.wake
nop
call sym.runtime.nextMarkBitArenaEpoch
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 2
call sym.runtime.panicIndex
lea rax, [0x004e1427]
mov ebx, 0x2c
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.finishsweep_m
Function at 0x427900
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4279e6
push rbp
mov rbp, rsp
sub rsp, 0x10
nop
nop
lea rax, [0x00597c10]
nop dword [rax + rax]
call sym.runtime.lock2
cmp qword [0x00597b80], 0
jne 0x4279d2
mov qword [0x00597bc8], 0
mov rcx, qword [0x00597c28]
test rcx, rcx
jne 0x42796c
nop
nop
lea rax, [0x00597c10]
call sym.runtime.unlock2
add rsp, 0x10
pop rbp
ret
lea rdx, [0x00597c18]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x42795e
mov rcx, qword [0x00597c18]
test rcx, rcx
je 0x4279a9
mov rdx, qword [0x00597c30]
mov qword [rdx], rcx
mov rcx, qword [0x00597c18]
mov rdx, qword [0x00597c30]
mov qword [rcx + 8], rdx
mov rcx, qword [0x00597c28]
mov qword [0x00597c18], rcx
jmp 0x4279c5
mov rcx, qword [0x00597c28]
mov rdx, qword [0x00597c30]
mov qword [0x00597c18], rcx
mov qword [0x00597c20], rdx
movups xmmword [0x00597c28], xmm15
jmp 0x42794a
lea rax, [0x004e0a23]
mov ebx, 0x28
nop
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.prepareFreeWorkbufs

Function at 0x428880
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4288b1
push rbp
mov rbp, rsp
sub rsp, 0x18
test cl, cl
je 0x42889f
xor edi, edi
call sym.runtime._mheap_.allocSpan
add rsp, 0x18
pop rbp
ret
lea rax, [0x004e27af]
mov ebx, 0x3c
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop
call sym.runtime.morestackc.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp sym.runtime._mheap_.allocManual

Function at 0x4289c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428ad8
push rbp
mov rbp, rsp
sub rsp, 0x10
xor edx, edx
jmp 0x4289f0
sub r11, rbx
mov rdi, r11
shr r11, 0xd
lea rbx, [rdi + r9]
sub r10, r11
mov rax, rcx
mov rcx, r10
mov edx, r12d
test rcx, rcx
jbe 0x428a79
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
nop
cmp rdi, 0x40
jae 0x428aca
test byte [rax], al
mov rdi, qword [rax + rdi*8 + 0x101d8]
test byte [rdi], al
mov r9, rbx
and ebx, 0x3fffff
mov r10, rcx
shl rcx, 0xd
lea r11, [rcx + rbx]
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x10c8]
cmp r8, rbx
seta r12b
or r12d, edx
nop dword [rax + rax]
cmp r11, 0x400000
jbe 0x428a87
mov r11d, 0x400000
jmp 0x428a87
mov rcx, rax
jmp 0x4289d6
mov eax, edx
add rsp, 0x10
pop rbp
ret
mov rax, rcx
mov r8, rdx
cmp r11, r8
jbe 0x428a71
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x10c8], r11
sete dl
nop
test dl, dl
jne 0x4289d6
mov rdx, qword [rdi + 0x10c8]
cmp rdx, r11
ja 0x428a81
cmp rdx, rbx
jbe 0x428a81
lea rax, [0x004e2071]
mov ebx, 0x33
call sym.runtime.throw
mov rax, rdi
mov ecx, 0x40
call sym.runtime.panicIndexU
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
jmp sym.runtime._mheap_.allocNeedsZero
Function at 0x429c00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429d46
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
jne 0x429c64
nop dword [rax + rax]
cmp qword [rax], rbx
jne 0x429c2d
mov rcx, qword [rbx]
mov qword [rax], rcx
jmp 0x429c37
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov qword [rcx], rdx
cmp qword [rax + 8], rbx
jne 0x429c47
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
jmp 0x429c52
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
movups xmmword [rbx], xmm15
mov qword [rbx + 0x10], 0
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x10], rcx
call sym.runtime.printlock
lea rax, [0x004e15b7]
mov ebx, 0x2d
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
call sym.runtime.printuint
lea rax, [0x004d88ad]
mov ebx, 6
call sym.runtime.printstring
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call sym.runtime.printuintptr
lea rax, [0x004d88b3]
mov ebx, 6
call sym.runtime.printstring
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call sym.runtime.printuintptr
lea rax, [0x004d9446]
mov ebx, 0xb
call sym.runtime.printstring
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call sym.runtime.printuintptr
lea rax, [0x004d88b9]
mov ebx, 6
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call sym.runtime.printuintptr
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004da5c5]
mov ebx, 0x10
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime._mSpanList_.remove
Function at 0x42ac00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42ad86
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdx, qword [0x00588680]
nop dword [rax]
cmp rdx, 0x15
ja 0x42ad03
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x48], dil
test byte [rax], al
cmp dword [0x0061c240], 0
je 0x42ac53
nop
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rdx, qword [rax + 0x10120]
mov qword [r11 + 8], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rcx
mov qword [rax + 0x10120], rcx
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call sym.runtime._addrRanges_.init
mov rax, qword [rsp + 0x30]
movzx ebx, byte [rsp + 0x48]
call sym.runtime._pageAlloc_.sysInit
mov rcx, qword [0x005882d8]
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x10078], rcx
cmp dword [0x0061c240], 0
nop
jne 0x42aca9
mov rdx, qword [rsp + 0x38]
jmp 0x42acc1
call sym.runtime.gcWriteBarrier2
mov rdx, qword [rsp + 0x38]
mov qword [r11], rdx
mov rsi, qword [rax + 0x10118]
mov qword [r11 + 8], rsi
mov qword [rax + 0x10118], rdx
lea rdx, [rax + 0x100b8]
movzx ebx, byte [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, rdx
nop dword [rax]
call sym.runtime._scavengeIndex_.init
mov rdx, qword [rsp + 0x30]
add qword [rdx + 0x10128], rax
movzx esi, byte [rsp + 0x48]
mov byte [rdx + 0x10131], sil
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x18], rdx
call sym.runtime.printlock
lea rax, [0x004defa5]
mov ebx, 0x20
call sym.runtime.printstring
mov rcx, qword [rsp + 0x18]
mov eax, 1
shl rax, cl
cmp rcx, 0x40
sbb rcx, rcx
and rax, rcx
call sym.runtime.printint
call sym.runtime.printnl
nop
call sym.runtime.printunlock
call sym.runtime.printlock
lea rax, [0x004de2dd]
mov ebx, 0x1d
call sym.runtime.printstring
mov eax, 0x200000
call sym.runtime.printint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004e119a]
mov ebx, 0x2b
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.init
Function at 0x42fd40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42fe39
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x0061c5b0]
test ecx, ecx
je 0x42fe12
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [sym.runtime._mLockProfile_.captureStack.func1]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x42fe0c
jae 0x42fe2e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [sym.runtime._LostContendedRuntimeLock]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime._mLockProfile_.captureStack

Function at 0x4301c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430206
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
je 0x4301f0
lea rbx, sym.runtime.osyield
call sym.runtime.tryRecordGoroutineProfile
add rsp, 0x10
pop rbp
ret
lea rax, [0x004e1453]
mov ebx, 0x2c
nop dword [rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.tryRecordGoroutineProfileWB
Function at 0x430600
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430748
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x98], dil
test dil, dil
jne 0x43062d
xor edx, edx
xor esi, esi
jmp 0x430674
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rax
mov eax, 6
call sym.runtime.stopTheWorld
mov rcx, qword [rsp + 0x90]
movzx edi, byte [rsp + 0x98]
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], 0
nop dword [rax]
test rbx, rbx
jne 0x43068d
test dil, dil
jmp 0x430731
mov qword [rsp + 0x18], rsi
mov byte [rsp + 0x17], dl
lea rdx, [rsp + 0x80]
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rsi, [sym.runtime.Stack.func1]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
mov rax, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov byte [rsp + 0x60], dil
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x98]
test al, al
movzx edx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x18]
je 0x43073d
mov eax, edx
mov rbx, rsi
call sym.runtime.startTheWorld
mov rax, qword [rsp + 0x20]
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime.Stack

Function at 0x430d80
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430dc7
push rbp
mov rbp, rsp
sub rsp, 0x10
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
add rcx, rbx
cmp rax, rdx
setbe dl
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x430db5
add rsp, 0x10
pop rbp
ret
lea rax, [0x004e27eb]
mov ebx, 0x3c
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.makeAddrRange
Function at 0x431a60
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x431b86
push rbp
mov rbp, rsp
sub rsp, 0x20
nop
mov rcx, qword [rax + 0x20]
mov rdx, rcx
shr rcx, 0x20
nop
nop
cmp edx, ecx
ja 0x431b16
shr ecx, 9
mov rdx, qword [rax + 0x10]
cmp rdx, rcx
jbe 0x431ade
nop
nop
mov rdx, qword [rax + 8]
lea rcx, [rdx + rcx*8]
nop
nop
mov rbx, qword [rcx]
test rbx, rbx
je 0x431ade
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x431b05
mov edx, dword [rbx + 0x10]
cmp edx, 0x200
je 0x431af3
mov qword [rsp + 0x30], rax
nop
nop
xor edx, edx
xchg qword [rcx], rdx
nop
nop
xor ecx, ecx
xchg dword [rbx + 0x10], ecx
lea rax, [0x0061c0f8]
call sym.runtime._lfstack_.push
mov rax, qword [rsp + 0x30]
nop
nop
xor ecx, ecx
xchg qword [rax + 0x20], rcx
nop
xor ecx, ecx
xchg qword [rax + 0x10], rcx
add rsp, 0x20
pop rbp
ret
lea rax, [0x004e1eb1]
mov ebx, 0x31
nop
call sym.runtime.throw
lea rax, [0x004e21d9]
mov ebx, 0x34
call sym.runtime.throw
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rcx
call sym.runtime.printlock
lea rax, [0x004d8a51]
mov ebx, 7
call sym.runtime.printstring
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004d8ed1]
mov ebx, 9
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004dfaf0]
mov ebx, 0x23
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime._spanSet_.reset
Function at 0x432980
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x432a4d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rax, qword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x005882e0], rax
test rax, rax
je 0x4329e4
add rsp, 0x38
pop rbp
ret
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004e1aee]
mov ebx, 0x2f
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
nop
call sym.runtime.printuint
lea rax, [0x004d84b0]
mov ebx, 3
call sym.runtime.printstring
call sym.runtime.printunlock
lea rax, [0x004dda7b]
mov ebx, 0x1b
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.netpollinit

Function at 0x432b00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x432bed
push rbp
mov rbp, rsp
sub rsp, 0x38
xor eax, eax
lea rcx, [0x0061c020]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
jne 0x432b31
add rsp, 0x38
pop rbp
ret
mov rax, qword [0x005882e0]
mov rcx, qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x432b80
add rsp, 0x38
pop rbp
ret
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
nop
call sym.runtime.printlock
lea rax, [0x004e2827]
mov ebx, 0x3c
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004d84b0]
mov ebx, 3
call sym.runtime.printstring
call sym.runtime.printunlock
lea rax, [0x004e20a4]
mov ebx, 0x33
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.netpollBreak
Function at 0x432fa0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x433017
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, dword [rbx + 0x28]
cmp edx, 0x72
je 0x432fbb
cmp edx, 0x77
jne 0x432fd2
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call sym.runtime.netpollready
add rsp, 0x20
pop rbp
ret
mov dword [rsp + 0x1c], edx
call sym.runtime.printlock
lea rax, [0x004e2863]
mov ebx, 0x3c
call sym.runtime.printstring
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call sym.runtime.printint
call sym.runtime.printnl
nop dword [rax]
call sym.runtime.printunlock
lea rax, [0x004dc714]
mov ebx, 0x17
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp sym.runtime.handlecompletion