joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4747a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474857
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop dword [rax]
test rcx, rcx
je 0x474821
mov rdx, rcx
and edx, 0x1f
cmp rdx, 0x14
jne 0x474815
mov qword [rsp + 0x18], rbx
call sym.internal_reflectlite.Value.numMethod
nop dword [rax + rax]
test rax, rax
je 0x474803
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx]
test rdx, rdx
je 0x4747f6
mov rdx, qword [rdx + 8]
mov rbx, qword [rcx + 8]
mov rax, rdx
add rsp, 0x20
pop rbp
ret
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
add rsp, 0x20
pop rbp
ret
call sym.internal_reflectlite.packEface
add rsp, 0x20
pop rbp
nop
ret
lea rax, [0x0069fc00]
call sym.runtime.newobject
mov qword [rax + 8], 0x1b
lea rcx, [0x006dabd5]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00688920]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_reflectlite.valueInterface

Function at 0x4749e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474a46
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
test rax, rax
je 0x474a0b
nop dword [rax]
call sym.internal_abi._Type_.NumMethod
add rsp, 0x10
pop rbp
ret
lea rax, [0x0069fc00]
call sym.runtime.newobject
mov qword [rax + 8], 0x1b
lea rcx, [0x006dabf0]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00688920]
nop dword [rax + rax]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_reflectlite.Value.numMethod
Function at 0x4759e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x475c79
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdi
nop word [rax + rax]
test rax, rax
je 0x475bcb
test rcx, rcx
je 0x475c65
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x475a6a
movzx esi, byte [rdx + 0x17]
mov r8d, esi
and esi, 0x1f
mov r9, rsi
or rsi, 0x80
nop
mov r10, qword [rsp + 0x78]
test r8b, 0x20
cmove r9, rsi
jmp 0x475a72
xor r9d, r9d
xor r10d, r10d
xor edx, edx
nop
test r9, r9
je 0x475c2f
movzx esi, byte [rdx + 0x17]
and esi, 0x1f
cmp rsi, 0x16
jne 0x475be6
mov rsi, r9
and r9d, 0x1f
mov qword [rsp + 0x50], r9
nop
nop word [rax + rax]
cmp r9, 0x14
ja 0x475ac0
lea r8, [r9 - 0x12]
cmp r8, 1
jbe 0x475aea
cmp r9, 0x14
je 0x475acc
jmp 0x475bf9
cmp r9, 0x16
jbe 0x475aea
cmp r9, 0x17
jne 0x475ae0
cmp qword [r10], 0
setne r8b
jmp 0x475b00
cmp r9, 0x1a
jne 0x475bf9
bt esi, 7
jae 0x475af5
mov r8, qword [r10]
jmp 0x475af8
mov r8, r10
test r8, r8
setne r8b
nop
test r8b, r8b
je 0x475be6
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x58], rdx
mov rax, rdx
nop dword [rax + rax]
call sym.internal_reflectlite.rtype.Elem
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [rax + 0x38]
mov rax, rbx
call rcx
cmp rax, 0x14
je 0x475b84
mov rbx, qword [0x009055c0]
mov rcx, qword [0x009055c8]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x68]
call rsi
nop dword [rax]
test al, al
je 0x475bd3
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x50]
mov r10, qword [rsp + 0x48]
mov r11, qword [rsp + 0x68]
nop dword [rax]
call sym.errors.as
sub rsp, 0xffffffffffffff80
pop rbp
ret
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbp
ret
lea rax, [0x0067b380]
lea rbx, [0x007572f0]
call sym.runtime.gopanic
lea rax, [0x0067b380]
lea rbx, [0x007572e0]
call sym.runtime.gopanic
lea rax, [0x0069fc00]
call sym.runtime.newobject
mov qword [rax + 8], 0x17
lea rcx, [0x006d826e]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00688920]
call sym.runtime.gopanic
lea rax, [0x0069fc00]
call sym.runtime.newobject
mov qword [rax + 8], 0x16
lea rcx, [0x006d76b3]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00688920]
nop
call sym.runtime.gopanic
lea rax, [0x0067b380]
lea rbx, [0x007572d0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.errors.As
Function at 0x482f20
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48365f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x482f4d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4831d1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4831fd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x0075dbc0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x0067b380]
lea rbx, [0x00757a90]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x483222
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x483257
lea rdi, [0x0067b400]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x482f43
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x48323b
jmp 0x483210
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x483800
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x483817
inc rax
cmp rax, 4
jge 0x48382f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x483814
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x483840
inc rax
cmp rax, 4
jge 0x48384e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x483877
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x48385b
jmp 0x48383d
Function at 0x492b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492bea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x492bcf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0067b480]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x492bbe
mov edi, 1
lea rsi, [0x0067b480]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00758140]
lea rsi, [0x007568d8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x499a40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499c62
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rbx, qword [0x009053c0]
lea rax, [0x006897c0]
lea rcx, [0x006d3018]
mov edi, 0xc
call sym.runtime.mapassign_faststr
mov byte [rax], 1
lea rax, [0x006a6400]
nop dword [rax + rax]
call sym.runtime.newobject
mov qword [rax + 0x18], 0xc
cmp dword [0x0098c4d0], 0
je 0x499ab1
mov rdx, qword [rax + 0x10]
call sym.runtime.gcWriteBarrier3
mov qword [r11], rdx
mov qword [r11 + 8], rax
mov rdx, qword [0x009052f8]
mov qword [r11 + 0x10], rdx
lea rdx, [0x006d3018]
mov qword [rax + 0x10], rdx
mov qword [0x009052f8], rax
mov rbx, qword [0x009053c0]
lea rax, [0x006897c0]
lea rcx, [0x006d2eb0]
mov edi, 0xc
nop dword [rax]
call sym.runtime.mapassign_faststr
mov byte [rax], 1
lea rax, [0x006a6400]
call sym.runtime.newobject
mov qword [rax + 0x18], 0xc
cmp dword [0x0098c4d0], 0
je 0x499b20
mov rcx, qword [rax + 0x10]
call sym.runtime.gcWriteBarrier3
mov qword [r11], rcx
mov qword [r11 + 8], rax
mov rcx, qword [0x00905300]
mov qword [r11 + 0x10], rcx
lea rcx, [0x006d2eb0]
mov qword [rax + 0x10], rcx
mov qword [0x00905300], rax
mov rax, qword [0x009052f8]
cmp dword [0x0098c4d0], 0
je 0x499b55
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [0x008fc418]
mov qword [r11 + 8], rcx
mov qword [0x008fc418], rax
mov rax, qword [0x009052f8]
cmp dword [0x0098c4d0], 0
je 0x499b7f
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [0x008fc458]
mov qword [r11 + 8], rcx
mov qword [0x008fc458], rax
mov rax, qword [0x009052f8]
cmp dword [0x0098c4d0], 0
je 0x499ba9
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [0x008fc498]
mov qword [r11 + 8], rcx
mov qword [0x008fc498], rax
mov rax, qword [0x009052f8]
cmp dword [0x0098c4d0], 0
nop
je 0x499bd5
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [0x008fc4d8]
mov qword [r11 + 8], rcx
mov qword [0x008fc4d8], rax
mov rax, qword [0x009052f8]
cmp dword [0x0098c4d0], 0
je 0x499bff
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [0x008fc518]
mov qword [r11 + 8], rcx
mov qword [0x008fc518], rax
mov rax, qword [0x009052f8]
cmp dword [0x0098c4d0], 0
je 0x499c29
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [0x008fc558]
mov qword [r11 + 8], rcx
mov qword [0x008fc558], rax
mov rax, qword [0x00905300]
cmp dword [0x0098c4d0], 0
nop
je 0x499c55
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [0x008fc598]
mov qword [r11 + 8], rcx
mov qword [0x008fc598], rax
add rsp, 0x20
pop rbp
ret
call sym.runtime.morestack_noctxt.abi0
jmp sym.internal_syscall_windows_registry.init
Function at 0x4a9ec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa02d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
cmp rdi, r8
jl 0x4a9f11
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], rsi
xor edx, edx
xor r9d, r9d
xor r10d, r10d
jmp 0x4a9f94
mov rbx, qword [0x008f5d10]
mov rcx, qword [0x008f5d18]
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov r8, qword [rax + 0x18]
sub rsi, rdx
sub rdi, rdx
mov r11, rsi
neg rsi
sar rsi, 0x3f
and rsi, rdx
add rsi, rcx
mov rax, rbx
mov rbx, rsi
mov rcx, rdi
mov rdi, r11
call r8
mov rdx, qword [rsp + 0x28]
add rdx, rax
mov rsi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov rax, r8
mov rsi, rdi
mov rdi, qword [rsp + 0x60]
mov r8, r10
mov r9, rbx
mov r10, rcx
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
cmp r8, rdx
jle 0x4aa00c
mov qword [rsp + 0x28], rdx
nop
test r9, r9
jne 0x4a9fb0
cmp rdi, rdx
jae 0x4a9f27
jmp 0x4aa021
cmp r8, rdx
jle 0x4aa00c
test rdx, rdx
jle 0x4aa012
nop word [rax + rax]
cmp qword [0x008f5d20], r9
je 0x4a9fcd
xor eax, eax
jmp 0x4a9ff8
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x20], r9
mov rcx, qword [0x008f5d28]
mov rax, r9
mov rbx, r10
call sym.runtime.ifaceeq
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x20]
mov r10, qword [rsp + 0x30]
test al, al
je 0x4aa012
mov r9, qword [0x008f5d30]
mov r10, qword [0x008f5d38]
jmp 0x4aa012
xor r9d, r9d
xor r10d, r10d
mov rax, rdx
mov rbx, r9
mov rcx, r10
add rsp, 0x38
pop rbp
ret
mov rax, rdx
mov rcx, rdi
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp sym.io.ReadAtLeast
Function at 0x4addc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4adead
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rax, qword [rax]
test rax, rax
je 0x4ade65
mov byte [rsp + 0x38], cl
call 0x4662a0
mov qword [rsp + 0x10], rax
cmp rax, 1
jg 0x4ade2f
test rax, rax
jne 0x4ade00
xor ecx, ecx
xor edx, edx
jmp 0x4ade59
cmp rax, 1
jne 0x4ade6f
movzx ecx, byte [rsp + 0x38]
test cl, cl
je 0x4ade1f
mov rcx, qword [0x008f5df0]
mov rdx, qword [0x008f5df8]
jmp 0x4ade59
lea rcx, [0x007582a0]
lea rdx, [0x0098c060]
jmp 0x4ade59
cmp rax, 2
jne 0x4ade45
mov rcx, qword [0x008f5e10]
mov rdx, qword [0x008f5e18]
jmp 0x4ade59
cmp rax, 3
jne 0x4ade6f
mov rcx, qword [0x008f5e20]
mov rdx, qword [0x008f5e28]
mov rax, rcx
mov rbx, rdx
add rsp, 0x18
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x18
pop rbp
ret
call sym.runtime.printlock
lea rax, [0x006d3c23]
mov ebx, 0xe
call sym.runtime.printstring
mov rax, qword [rsp + 0x10]
call sym.runtime.printint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0067b380]
lea rbx, [0x007573e0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp sym.internal_poll._pollDesc_.prepare

Function at 0x4adee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4adff9
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rax, qword [rax]
test rax, rax
je 0x4adf89
mov byte [rsp + 0x38], cl
call sym.internal_poll.runtime_pollWait
mov qword [rsp + 0x10], rax
cmp rax, 1
jg 0x4adf53
test rax, rax
jne 0x4adf20
xor ecx, ecx
xor edx, edx
jmp 0x4adf7d
cmp rax, 1
jne 0x4adfb7
movzx ecx, byte [rsp + 0x38]
test cl, cl
je 0x4adf43
mov rcx, qword [0x008f5df0]
mov rdx, qword [0x008f5df8]
jmp 0x4adf7d
lea rcx, [0x007582a0]
lea rdx, [0x0098c060]
jmp 0x4adf7d
cmp rax, 2
jne 0x4adf69
mov rcx, qword [0x008f5e10]
mov rdx, qword [0x008f5e18]
jmp 0x4adf7d
cmp rax, 3
jne 0x4adfb7
mov rcx, qword [0x008f5e20]
mov rdx, qword [0x008f5e28]
mov rax, rcx
mov rbx, rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x21
lea rcx, [0x006de3f8]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00758260]
add rsp, 0x18
pop rbp
ret
call sym.runtime.printlock
lea rax, [0x006d3c23]
mov ebx, 0xe
call sym.runtime.printstring
mov rax, qword [rsp + 0x10]
call sym.runtime.printint
call sym.runtime.printnl
nop dword [rax]
call sym.runtime.printunlock
lea rax, [0x0067b380]
lea rbx, [0x007573e0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax + rax]
jmp sym.internal_poll._pollDesc_.wait
Function at 0x4c2de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2f2e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x008f4ad0]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4c2ef2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x4c2f28
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4c2f1d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x4c85a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x218]
cmp r12, qword [r14 + 0x10]
jbe 0x4c87c7
push rbp
mov rbp, rsp
sub rsp, 0x290
mov qword [rsp + 0x2b0], rax
test byte [rax], al
lea rdi, [rsp + 0x240]
mov rsi, rax
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046cb9a
mov rbp, qword [rbp]
mov rdi, rsp
lea rsi, [rsp + 0x240]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046cb9a
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0x2a6]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x56], rdx
call sym.net.extractExtendedRCode
cmp ax, 3
je 0x4c87b0
mov word [rsp + 0x122], ax
nop
mov rax, qword [rsp + 0x2b0]
mov ebx, 3
call sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.resourceHeader
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x124], xmm0
lea rdi, [rsp + 0x130]
lea rsi, [rsp + 0xc]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046cb00
mov rbp, qword [rbp]
test rax, rax
je 0x4c86fc
nop dword [rax + rax]
cmp qword [0x008f5aa0], rax
je 0x4c86b0
mov ecx, 1
jmp 0x4c86e1
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rbx
mov rcx, qword [0x008f5aa8]
call sym.runtime.ifaceeq
xor eax, 1
mov rbx, qword [rsp + 0x238]
mov ecx, eax
mov rax, qword [rsp + 0x230]
test cl, cl
je 0x4c86fc
mov rax, qword [0x008f4f90]
mov rbx, qword [0x008f4f98]
add rsp, 0x290
pop rbp
ret
movzx edx, word [rsp + 0x122]
test dx, dx
jne 0x4c876d
cmp byte [rsp + 0x2a6], 0
je 0x4c8718
test dx, dx
jmp 0x4c876d
cmp byte [rsp + 0x2a9], 0
je 0x4c8727
test dx, dx
jmp 0x4c876d
cmp qword [0x008f5aa0], rax
je 0x4c8734
xor eax, eax
jmp 0x4c874d
mov rcx, qword [0x008f5aa8]
nop dword [rax + rax]
call sym.runtime.ifaceeq
movzx edx, word [rsp + 0x122]
test al, al
jne 0x4c8756
test dx, dx
jmp 0x4c876d
mov rax, qword [0x008f4f80]
mov rbx, qword [0x008f4f88]
add rsp, 0x290
pop rbp
ret
je 0x4c87a3
cmp dx, 2
jne 0x4c878c
mov rax, qword [0x008f4fe0]
mov rbx, qword [0x008f4fe8]
add rsp, 0x290
pop rbp
ret
mov rax, qword [0x008f4fb0]
mov rbx, qword [0x008f4fb8]
add rsp, 0x290
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x290
pop rbp
ret
mov rax, qword [0x008f5020]
mov rbx, qword [0x008f5028]
add rsp, 0x290
pop rbp
ret
mov qword [rsp + 0x18], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 0x18]
jmp sym.net.checkHeader
Function at 0x4c87e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x2c8]
cmp r12, qword [r14 + 0x10]
jbe 0x4c8944
push rbp
mov rbp, rsp
sub rsp, 0x340
mov qword [rsp + 0x350], rax
mov word [rsp + 0x358], bx
jmp 0x4c8817
mov rax, qword [rsp + 0x350]
mov ebx, 3
nop dword [rax]
call sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.resourceHeader
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x22c], xmm0
lea rdi, [rsp + 0x238]
lea rsi, [rsp + 0xc]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046cb00
mov rbp, qword [rbp]
movups xmm0, xmmword [rsp + 0x22c]
movups xmmword [rsp + 0x120], xmm0
lea rdi, [rsp + 0x12c]
lea rsi, [rsp + 0x238]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046cb00
mov rbp, qword [rbp]
cmp qword [0x008f5aa0], rax
jne 0x4c88c0
mov qword [rsp + 0x338], rax
mov rcx, qword [0x008f5aa8]
call sym.runtime.ifaceeq
test al, al
jne 0x4c892d
mov rax, qword [rsp + 0x338]
nop dword [rax]
test rax, rax
jne 0x4c8916
movzx ecx, word [rsp + 0x358]
cmp word [rsp + 0x220], cx
je 0x4c8909
mov rax, qword [rsp + 0x350]
mov ebx, 3
call sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.skipResource
test rax, rax
je 0x4c880f
mov rax, qword [0x008f4f90]
mov rbx, qword [0x008f4f98]
add rsp, 0x340
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x340
pop rbp
ret
mov rax, qword [0x008f4f90]
mov rbx, qword [0x008f4f98]
add rsp, 0x340
pop rbp
ret
mov rax, qword [0x008f5020]
mov rbx, qword [0x008f5028]
add rsp, 0x340
pop rbp
ret
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
nop dword [rax]
jmp sym.net.skipToAnswer