joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002610
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400026e5
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400026c0
mov qword [rsp + 0x280], rsi
lea rsi, str.Overwolf.exe
lea rdx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x1400026a0
add rax, 2
cmp rax, 0xd
je 0x1400026b4
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
je 0x140002680
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002672
jmp 0x1400026b8
mov edi, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x280]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400026e5
mov edx, edi
call fcn.140002350
test al, al
jne 0x1400026e1
lea rdx, str.DLL
jmp 0x1400026ec
xor eax, eax
jmp 0x14000270d
lea rdx, str.Failed_to_find_target_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a10
lea rdx, [0x140001e90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003bd0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140002ae0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002b01
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140002b2e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002b30
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002b89
test ecx, ecx
jle 0x140002b69
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002b89
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002b89
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002bb0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002bd2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002be1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002c04
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002c06
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002c42
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002cde
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002c7d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002cbe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002cde
cmp rbx, rax
ja 0x140002c90
test rbx, rbx
je 0x140002cde
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140003170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov ebx, edx
mov rdi, rcx
call fcn.1400019d0
mov ecx, eax
mov edx, ebx
call fcn.1400019e0
test al, al
je 0x1400031bf
call fcn.1400019d0
cmp ebx, eax
jne 0x1400031b8
call fcn.1400019d0
xor ebx, ebx
test eax, eax
sete bl
mov eax, ebx
jmp 0x140003315
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400031f8
mov rdx, qword [rdi + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1400031f8
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, ebx
mov byte [rdx], bl
jmp 0x140003315
cmp qword [rdi + 0x80], 0
jne 0x14000320c
call fcn.1400019d0
jmp 0x140003315
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140003239
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140003265
movsx ecx, bl
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
jne 0x14000325e
call fcn.1400019d0
mov ebx, eax
mov eax, ebx
jmp 0x140003315
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], bl
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400032be
sub eax, 1
je 0x1400032be
cmp eax, 2
jne 0x140003202
movsx ecx, byte [rsp + 0x50]
jmp 0x140003245
mov qword [rsp + 0xa0], rsi
lea rax, [rsp + 0x58]
mov rsi, qword [rsp + 0x40]
sub rsi, rax
je 0x1400032f4
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140003308
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
je 0x140003308
mov eax, ebx
jmp 0x14000330d
call fcn.1400019d0
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003bd0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003720
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rdi, rcx
je 0x140003807
cmp byte [rcx + 0x71], 0
je 0x140003807
mov qword [rsp + 0x78], rbx
mov rbx, qword [rcx]
call fcn.1400019d0
mov edx, eax
mov rcx, rdi
call qword [rbx + 0x18]
mov ebx, eax
call fcn.1400019d0
mov ecx, eax
mov edx, ebx
call fcn.1400019e0
test al, al
jne 0x140003803
mov rcx, qword [rdi + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rdi + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400037c8
sub eax, 1
je 0x1400037cc
cmp eax, 2
jne 0x140003803
mov byte [rdi + 0x71], 0
mov al, 1
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003bd0
add rsp, 0x60
pop rdi
ret
mov byte [rdi + 0x71], 0
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rbx, rax
je 0x1400037fa
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140003803
cmp byte [rdi + 0x71], 0
sete al
jmp 0x1400037b0
xor al, al
jmp 0x1400037b0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003bd0
add rsp, 0x60
pop rdi
ret

Function at 0x140004550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000459a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000459a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000459a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000459a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000459a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000459c
xor al, al
add rsp, 0x28
ret
Function at 0x140170a80
Capabilities:
Terminate process

Disassembly:
sub al, byte [r14 + 0x47]
pop rsi
invalid
cld
pop r11
jmp 0x140170a8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140170a9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140170a85
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140170ab5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140170aa2
sub eax, 3
jb 0x140170acf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140170b06
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140170af6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140170af4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140170ae3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140170a42
jmp 0x140170a8d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x16e000]
mov eax, dword [rdi]
or eax, eax
je 0x140170b62
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x17e2ac]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140170b12
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140170b5c
mov qword [rbx], rax
add rbx, 8
jmp 0x140170b32
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140170bba
sub rsp, 0xffffffffffffff80
jmp 0x14015a3ee
Function at 0x404740
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4047ca
push rbp
mov rbp, rsp
sub rsp, 0x28
test rax, rax
je 0x40478c
mov rdx, qword [rax + 0x18]
nop dword [rax + rax]
test rdx, rdx
je 0x404797
movzx esi, byte [rax + 0x17]
test sil, 0x20
je 0x40477b
cmp rbx, rcx
sete al
add rsp, 0x28
pop rbp
ret
mov rsi, qword [rdx]
mov rax, rbx
mov rbx, rcx
call rsi
add rsp, 0x28
pop rbp
ret
mov eax, 1
add rsp, 0x28
pop rbp
ret
call sym.runtime.rtype.string
mov ecx, 0x1c
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x005e619f]
call sym.runtime.concatstring2
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x005a2540]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.efaceeq

Function at 0x404800
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40488a
push rbp
mov rbp, rsp
sub rsp, 0x28
test rax, rax
je 0x40484c
mov rax, qword [rax + 8]
mov rdx, qword [rax + 0x18]
nop
test rdx, rdx
je 0x404857
movzx esi, byte [rax + 0x17]
test sil, 0x20
je 0x40483b
cmp rbx, rcx
sete al
add rsp, 0x28
pop rbp
ret
mov rsi, qword [rdx]
mov rax, rbx
mov rbx, rcx
call rsi
add rsp, 0x28
pop rbp
ret
mov eax, 1
add rsp, 0x28
pop rbp
ret
call sym.runtime.rtype.string
mov ecx, 0x1c
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x005e619f]
call sym.runtime.concatstring2
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x005a2540]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.ifaceeq

Function at 0x404960
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4049ab
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [0x007c4838]
test rcx, rcx
je 0x4049a5
mov eax, 0x400000
xor edx, edx
div rcx
test rdx, rdx
jne 0x40498f
add rsp, 0x10
pop rbp
ret
lea rax, [0x005ece2b]
mov ebx, 0x41
nop dword [rax + rax]
call sym.runtime.throw
call sym.runtime.panicdivide
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.init.0
Function at 0x4049c0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404b40
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp byte [rax + 0x6d], 0
je 0x404b2e
mov rcx, qword [rax + 0x20]
shl rcx, 0xd
cmp rcx, 0x400000
jne 0x404b1d
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x1f], 1
movzx ecx, byte [rsp + 0x1f]
mov byte [rax + 0x6a], cl
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
mov rcx, qword [rax + 0x18]
mov rdx, rbx
neg rdx
lea rsi, [0x007c5718]
lock xadd qword [rsi], rdx
nop
mov rax, rcx
call sym.runtime.sysUnusedOS
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
neg rbx
lea rax, [0x007c56f0]
call sym.runtime._sysMemStat_.add
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
lea rsi, [0x007c5710]
lock xadd qword [rsi], rdx
lea rax, [0x007c69c0]
call sym.runtime._consistentHeapStats_.acquire
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
neg rdx
lock xadd qword [rax], rdx
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
neg rdx
lock xadd qword [rax + 0x10], rdx
mov edx, 1
lock xadd qword [rax + 0x270], rdx
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
lock xadd qword [rax + 0x268], rdx
lea rax, [0x007c69c0]
call sym.runtime._consistentHeapStats_.release
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
neg rbx
lea rax, [0x007c55e0]
xor ecx, ecx
call sym.runtime._gcControllerState_.update
movups xmmword [rsp + 0x20], xmm15
lea rcx, [sym.runtime._mspan_.setUserArenaChunkToFault.func1]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
nop
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x007c4a20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x30
pop rbp
ret
lea rax, [0x005eaa78]
mov ebx, 0x2c
call sym.runtime.throw
lea rax, [0x005e9cdb]
mov ebx, 0x28
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime._mspan_.setUserArenaChunkToFault
Function at 0x404de0
Capabilities:
Reference sql statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rax]
mov rsi, qword [rdx]
cmp rbx, rsi
jbe 0x404dff
cmp qword [rdx + 8], rbx
jb 0x404dff
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x68], rbx
cmp dword [rax + 0x108], 0
jle 0x404f48
mov byte [rsp + 0x70], cl
mov qword [rsp + 0x30], rsi
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x18], rcx
lea rsi, [rbx + 0x400]
mov qword [rdx + 8], rsi
lea rsi, [rbx - 0x8000]
mov qword [rdx], rsi
lea rsi, [rbx - 0x6c60]
mov qword [rdx + 0x10], rsi
mov rsi, qword [rax + 0xb8]
mov qword [rsp + 0x28], rsi
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x20], rax
nop dword [rax]
call sym.runtime.printlock
lea rax, [0x005dd095]
mov ebx, 2
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call sym.runtime.printint
lea rax, [0x005dddb8]
mov ebx, 8
call sym.runtime.printstring
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x005e6e34]
mov ebx, 0x1e
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printhex
lea rax, [0x005e088d]
mov ebx, 0x10
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call sym.runtime.printhex
lea rax, [0x005dd087]
mov ebx, 2
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call sym.runtime.printhex
lea rax, [0x00635130]
mov ebx, 1
call sym.runtime.printstring
call sym.runtime.printunlock
nop dword [rax + rax]
call sym.runtime.printlock
call sym.runtime.printnl
call sym.runtime.printunlock
mov eax, 2
call sym.runtime.exit
movzx ecx, byte [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x68]
lea rax, [rbx + 0x400]
mov qword [rdx + 8], rax
lea rax, [rbx - 0x8000]
mov qword [rdx], rax
nop dword [rax]
test cl, cl
jne 0x404fd6
cmp qword [0x007701e8], 0
je 0x404fd6
movups xmmword [rsp + 0x38], xmm15
mov rax, qword [0x007701e8]
mov qword [rsp], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 8], rax
call sym.runtime.asmcgocall.abi0
xorps xmm15, xmm15
mov r14, qword [0x007c4a20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x404fce
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
jbe 0x404fce
cmp qword [rsp + 0x40], rcx
jb 0x404fce
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
mov qword [rcx + 8], rax
jmp 0x404fd3
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
mov rax, qword [rdx]
add rax, 0x13a0
mov qword [rdx + 0x10], rax
add rsp, 0x50
pop rbp
ret
Function at 0x405000
Capabilities:
Reference sql statements

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], r14
mov rdx, qword [r14 + 0x30]
mov rsi, r14
cmp qword [rdx + 0x90], rsi
je 0x405059
call sym.runtime.printlock
lea rax, [0x005e6e52]
mov ebx, 0x1e
nop dword [rax]
call sym.runtime.printstring
call sym.runtime.printunlock
mov eax, 2
call sym.runtime.exit
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsi + 0x30]
mov rdx, qword [rax]
mov rbx, qword [rdx + 0x38]
xor ecx, ecx
call sym.runtime.callbackUpdateSystemStack
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0x23c]
mov rdx, qword [r14 + 0x30]
mov rsi, r14
nop
mov qword [rdx + 0x130], rsi
mov rdx, qword [r14 + 0x30]
mov qword [r14 + 0xd0], rdx
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x30]
mov qword [rsp + 0x68], rsi
movups xmm0, xmmword [rsi + 0x2c8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x2d8]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [rsi + 0x2e8]
movups xmmword [rsp + 0x48], xmm0
mov rdi, qword [rdx + 0x70]
mov qword [rsp + 0x58], rdi
mov r8, qword [rdx + 0x78]
mov qword [rsp + 0x18], r8
call sym.runtime.exitsyscall
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x30]
mov byte [rsi + 0xe8], 0
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe9], 0
je 0x4050fd
mov byte [rsi + 0xea], 0
mov rsi, qword [rdx + 0x30]
xor edi, edi
xchg dword [rsi + 0x338], edi
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x20]
call sym.runtime.cgocallbackg1
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x30]
mov byte [rsi + 0xe8], 1
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe9], 0
je 0x405141
mov byte [rsi + 0xea], 1
mov rcx, qword [rdx + 0x30]
mov rsi, qword [rsp + 0x68]
cmp rcx, rsi
jne 0x4051e7
mov qword [rsp + 0x68], rcx
nop
jmp 0x405188
nop
lea rax, sym.runtime.switchtothread
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x007c4a20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rcx + 0x338], esi
sete dil
nop dword [rax + rax]
test dil, dil
je 0x40515b
mov rbx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x18]
call sym.runtime.reentersyscall
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x30]
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx + 0x2c8], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx + 0x2d8], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rcx + 0x2e8], xmm0
sub rsp, 0xffffffffffffff80
pop rbp
ret
lea rax, [0x005e95c6]
mov ebx, 0x26
call sym.runtime.throw
nop
int3