joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x455057
movzx edx, byte [rax]
test edx, edx
jne 0x454f14
nop dword [rax]
test r8b, r8b
jne 0x454f14
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x454f27
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x455017
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x455005
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x454ff7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x454f7d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x454fc0
mov eax, 1
cmp rax, rbx
ja 0x454fab
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x454fef
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x454fb3
mov rcx, r11
mov eax, r12d
jmp 0x454f82
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45504d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x455010
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x454f2d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3
Function at 0x455520
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x455875
push rbp
mov rbp, rsp
sub rsp, 0xa8
movzx edx, byte [rbx + 0x17]
and edx, 0x1f
dec rdx
cmp rdx, 0x19
ja 0x45582d
mov qword [rsp + 0xb8], rax
lea rsi, [0x00502aa0]
nop dword [rax]
jmp qword [rsi + rdx*8]
mov rax, rbx
call sym.runtime.rtype.string
mov ecx, 0x16
mov rdi, rax
mov rsi, rbx
lea r8, [0x004e2492]
mov r9d, 0x37
xor eax, eax
lea rbx, [0x004dc284]
call sym.runtime.concatstring3
nop dword [rax + rax]
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004bcec0]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime._abiDesc_.tryRegAssignArg

Function at 0x45ac80
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ad6e
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x80], rdi
nop
test r8b, r8b
je 0x45ad2b
mov byte [rsp + 0x91], r9b
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
movzx edx, r8b
mov qword [rsp + 0x48], rdx
lea rsi, [rsp + 0x38]
mov r8d, 3
mov r9, r8
mov edi, 0x19
call sym.runtime.traceWriter.event
movzx edx, byte [rsp + 0x91]
test dl, dl
je 0x45ad25
mov qword [rsp + 0x50], 0
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x50], rdx
mov edi, 0x22
lea rsi, [rsp + 0x50]
mov r8d, 1
mov r9, r8
nop dword [rax]
call sym.runtime.traceWriter.event
add rsp, 0x58
pop rbp
ret
call sym.runtime.printlock
lea rax, [0x004d9f96]
mov ebx, 0xe
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x80]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004e1b7b]
mov ebx, 0x2f
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x30], r8b
mov byte [rsp + 0x31], r9b
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movzx r8d, byte [rsp + 0x30]
movzx r9d, byte [rsp + 0x31]
nop dword [rax + rax]
jmp sym.runtime.traceWriter.writeGoStatus
Function at 0x45ade0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45aeb7
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
test sil, sil
je 0x45ae76
mov byte [rsp + 0x81], r8b
movups xmmword [rsp + 0x38], xmm15
mov qword [rsp + 0x38], rdi
movzx edx, sil
mov qword [rsp + 0x40], rdx
lea rsi, [rsp + 0x38]
mov r8d, 2
mov r9, r8
mov edi, 0xd
call sym.runtime.traceWriter.event
movzx edx, byte [rsp + 0x81]
test dl, dl
je 0x45ae70
mov qword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdx
mov edi, 0x1f
lea rsi, [rsp + 0x48]
mov r8d, 1
mov r9, r8
call sym.runtime.traceWriter.event
add rsp, 0x50
pop rbp
ret
call sym.runtime.printlock
lea rax, [0x004d9c65]
mov ebx, 0xd
call sym.runtime.printstring
mov rax, qword [rsp + 0x78]
call sym.runtime.printuint
call sym.runtime.printnl
nop dword [rax + rax]
call sym.runtime.printunlock
lea rax, [0x004e1018]
mov ebx, 0x2a
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov byte [rsp + 0x29], r8b
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
movzx r8d, byte [rsp + 0x29]
jmp sym.runtime.traceWriter.writeProcStatus

Function at 0x45af00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45afb5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call sym.runtime._traceMap_.put
nop
test bl, bl
je 0x45afaf
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._traceStringTable_.put.func1]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime._traceStringTable_.put
Function at 0x45df20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45dfcf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45e8e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e9cb
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ecx, dword [rdx + 0x18]
cmp qword [rdx + 8], rax
jne 0x45e902
mov edx, 1
jmp 0x45e920
mov rdx, qword [rdx + 0x10]
cmp rax, rdx
jne 0x45e912
mov edx, 1
jmp 0x45e920
mov edx, dword [rax + 0x90]
cmp edx, 6
sete dl
nop
test dl, dl
jne 0x45e945
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x2c], ecx
xor ebx, ebx
call sym.runtime.isSystemGoroutine
test al, al
je 0x45e94b
mov eax, dword [rsp + 0x2c]
nop dword [rax]
cmp eax, 2
jge 0x45e94b
add rsp, 0x30
pop rbp
ret
call sym.runtime.printlock
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x40]
nop
call sym.runtime.goroutineheader
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 0x30]
cmp qword [r14 + 0x30], rax
je 0x45e9b1
nop
mov edx, dword [rdi + 0x90]
and edx, 0xffffefff
cmp edx, 2
jne 0x45e9b1
call sym.runtime.printlock
lea rax, [0x004e2381]
mov ebx, 0x36
call sym.runtime.printstring
nop dword [rax]
call sym.runtime.printunlock
mov rax, qword [rsp + 0x40]
call sym.runtime.printcreatedby
jmp 0x45e9c5
nop
mov rax, 0xffffffffffffffff
mov rbx, rax
xor ecx, ecx
xor esi, esi
call sym.runtime.traceback1
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.tracebackothers.func1
Function at 0x45f2c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f506
push rbp
mov rbp, rsp
sub rsp, 0x48
test ebx, ebx
je 0x45f2e3
mov dword [rsp + 0x60], ebx
lea rcx, [0x00589480]
jmp 0x45f2f2
xor eax, eax
add rsp, 0x48
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x45f32f
mov rdx, qword [rcx + 0x128]
nop
cmp rax, rdx
jb 0x45f2eb
mov rsi, qword [rcx + 0x130]
cmp rax, rsi
jae 0x45f2eb
movsxd rcx, ebx
lea rax, [rdx + rcx]
nop dword [rax + rax]
cmp rsi, rax
jb 0x45f47b
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x28], rax
nop
nop
nop
lea rax, [0x00597500]
nop
call sym.runtime.lock2
mov rbx, qword [0x00597510]
lea rax, [0x004c1ac0]
mov ecx, dword [rsp + 0x60]
call sym.runtime.mapaccess2_fast32
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
nop
nop
nop
lea rax, [0x00597500]
call sym.runtime.unlock2
movzx ecx, byte [rsp + 0x1f]
nop dword [rax]
test cl, cl
jne 0x45f3e7
call sym.runtime.printlock
lea rax, [0x004daacc]
mov ebx, 0x11
call sym.runtime.printstring
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call sym.runtime.printhex
lea rax, [0x004d8907]
mov ebx, 6
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
nop dword [rax]
call sym.runtime.printhex
lea rax, [0x004da6f5]
mov ebx, 0x10
call sym.runtime.printstring
call sym.runtime.printunlock
lea rax, [0x00589480]
jmp 0x45f465
mov rax, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x30], rdx
call sym.runtime.printlock
lea rax, [0x004d8ab3]
mov ebx, 7
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printhex
lea rax, [0x004d8cd2]
mov ebx, 8
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x248]
test rax, rax
jne 0x45f3f2
lea rax, [0x004e191b]
mov ebx, 0x2e
call sym.runtime.throw
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rsi
call sym.runtime.printlock
lea rax, [0x004daacc]
mov ebx, 0x11
call sym.runtime.printstring
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call sym.runtime.printhex
lea rax, [0x004d9f6c]
mov ebx, 0xe
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
nop dword [rax]
call sym.runtime.printhex
lea rax, [0x004d84b3]
mov ebx, 3
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004df625]
mov ebx, 0x21
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp sym.runtime.resolveNameOff
Function at 0x45f800
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f9b7
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp ebx, 0xffffffff
je 0x45f822
lea rcx, [0x00589480]
nop
jmp 0x45f836
lea rax, [sym.runtime.unreachableMethod]
add rsp, 0x40
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x45f854
nop dword [rax + rax]
cmp qword [rcx + 0x128], rax
ja 0x45f82f
cmp qword [rcx + 0x130], rax
jbe 0x45f82f
jmp 0x45f856
xor ecx, ecx
test rcx, rcx
jne 0x45f91c
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x20], rax
nop
nop
nop
lea rax, [0x00597500]
call sym.runtime.lock2
mov rbx, qword [0x00597510]
lea rax, [0x004c1ac0]
mov ecx, dword [rsp + 0x58]
call sym.runtime.mapaccess1_fast32
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
nop
nop
nop
lea rax, [0x00597500]
call sym.runtime.unlock2
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x45f916
call sym.runtime.printlock
lea rax, [0x004daaee]
mov ebx, 0x11
call sym.runtime.printstring
mov eax, dword [rsp + 0x58]
movsxd rax, eax
call sym.runtime.printhex
lea rax, [0x004d8907]
mov ebx, 6
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x20]
call sym.runtime.printhex
lea rax, [0x004da6f5]
mov ebx, 0x10
nop dword [rax + rax]
call sym.runtime.printstring
call sym.runtime.printunlock
lea rax, [0x00589480]
jmp 0x45f9a0
add rsp, 0x40
pop rbp
ret
mov rax, rcx
nop
call sym.runtime._moduledata_.textAddr
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x28], rdx
call sym.runtime.printlock
lea rax, [0x004d8ab3]
mov ebx, 7
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printhex
lea rax, [0x004d8cd2]
mov ebx, 8
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
nop
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x248]
nop dword [rax + rax]
test rax, rax
jne 0x45f92b
lea rax, [0x004e1977]
mov ebx, 0x2e
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp sym.runtime.rtype.textOff
Function at 0x4637e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46391f
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
nop
xor edi, edi
mov esi, 0x12
lea rax, [0x00588264]
mov ebx, 1
xor ecx, ecx
call sym.runtime.semacquire1
nop dword [rax]
call sym.runtime.initMetrics
mov rbx, qword [0x00596f50]
lea rax, [0x004c1be0]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
nop dword [rax]
call sym.runtime.mapaccess2_faststr
mov rdx, qword [rax]
test bl, bl
je 0x4638fc
mov qword [rsp + 0x28], rdx
lea rax, [0x004c5600]
nop dword [rax]
call sym.runtime.newobject
lea rcx, [sym.runtime.metricReader.compute_fm]
mov qword [rax], rcx
cmp dword [0x0061c240], 0
jne 0x463880
mov rdx, qword [rsp + 0x58]
jmp 0x46388d
call sym.runtime.gcWriteBarrier1
mov rdx, qword [rsp + 0x58]
mov qword [r11], rdx
mov qword [rsp + 0x30], rax
mov qword [rax + 8], rdx
mov rbx, qword [0x00596f50]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
lea rax, [0x004c1be0]
call sym.runtime.mapassign_faststr
mov rdx, qword [rsp + 0x28]
mov qword [rax], rdx
cmp dword [0x0061c240], 0
jne 0x4638cb
mov rdx, qword [rsp + 0x30]
jmp 0x4638e0
call sym.runtime.gcWriteBarrier2
mov rdx, qword [rsp + 0x30]
mov qword [r11], rdx
mov rsi, qword [rax + 8]
mov qword [r11 + 8], rsi
mov qword [rax + 8], rdx
nop
nop
lea rax, [0x00588264]
xor ebx, ebx
xor ecx, ecx
call sym.runtime.semrelease1
add rsp, 0x38
pop rbp
ret
xor eax, eax
lea rbx, [0x004e13cf]
mov ecx, 0x2c
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
call sym.runtime.concatstring2
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_godebug.registerMetric

Function at 0x463c60
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463cdf
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [rax + 0x38], 0
je 0x463ccd
nop
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x463c86
nop
cmp rcx, 1
jne 0x463cbc
nop
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x463c96
cmp rcx, 1
jne 0x463cab
mov rbx, rax
lea rax, [0x0061c250]
call sym.runtime._pollCache_.free
add rsp, 0x10
pop rbp
ret
lea rax, [0x004e0d50]
mov ebx, 0x29
call sym.runtime.throw
lea rax, [0x004e0f46]
mov ebx, 0x2a
call sym.runtime.throw
lea rax, [0x004dfb13]
mov ebx, 0x23
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.internal_poll.runtime_pollClose
Function at 0x4641e0
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x70]
nop word [rax + rax]
cmp qword [r14 + 0x70], rcx
jb 0x464446
mov qword [rsp + 0x20], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rcx + 0xb0], 0
call sym.runtime.exitsyscallfast
nop word [rax + rax]
test al, al
je 0x464403
cmp byte [0x005939a4], 0
je 0x46428d
movups xmmword [rsp + 0x50], xmm15
lea rax, [sym.runtime.exitsyscall.func1]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [0x0061bfb0]
test rdx, rdx
jne 0x4642a0
xor ebx, ebx
xor eax, eax
jmp 0x4642a5
call sym.runtime.traceAcquireEnabled
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rax
test rbx, rbx
je 0x46432f
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x28]
cmp rsi, rdi
je 0x4642d5
mov edx, 1
jmp 0x4642e1
mov edx, dword [rdx + 0x388]
cmp dword [rsi + 0x14], edx
setne dl
movups xmmword [rsp + 0x30], xmm15
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x48], 0
lea rcx, [sym.runtime.exitsyscall.func2]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x48], dl
lea rcx, [rsp + 0x30]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
call sym.runtime.casgstatus
mov rdx, qword [rsp + 0x10]
test rdx, rdx
je 0x464397
nop
mov ecx, 1
mov rdx, qword [rsp + 0x18]
lock xadd qword [rdx + 0x398], rcx
mov ecx, dword [rdx + 0xd8]
lea esi, [rcx - 1]
nop
mov dword [rdx + 0xd8], esi
nop
cmp ecx, 1
jne 0x464397
cmp byte [r14 + 0xb1], 0
je 0x464397
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], 0
mov rcx, qword [rax + 0x30]
dec dword [rcx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x4643c2
mov qword [rax + 0x10], 0xfffffffffffffade
nop
jmp 0x4643d0
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x00598620], 0
nop
je 0x4643fd
mov ebx, 1
call sym.runtime.isSystemGoroutine
test al, al
jne 0x4643fd
nop
lea rax, sym.runtime.gosched_m
call sym.runtime.mcall
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, sym.runtime.exitsyscall0
call sym.runtime.mcall
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
add rsp, 0x60
pop rbp
ret
lea rax, [0x004e163e]
mov ebx, 0x2d
call sym.runtime.throw
nop
int3
Function at 0x465920
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
movq qword [rsp + 0x60], xmm15
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
cmp rcx, 4
jge 0x4659ab
lea rdx, [rsp + 0x20]
cmp rbx, rdx
je 0x46599f
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
mov rsi, rcx
shl rsi, 3
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov edx, 4
lea rbx, [rsp + 0x20]
jmp 0x4659b8
cmp rcx, 0x2a
jg 0x465a79
mov rdx, rcx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0x234]
mov rsi, qword [r14 + 0x30]
mov rdi, r14
nop
mov qword [rsi + 0x128], rdi
mov rsi, qword [r14 + 0x30]
mov qword [r14 + 0xd0], rsi
lea rsi, sym.runtime.unlockOSThread
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x1f], 1
mov rsi, qword [r14 + 0x30]
mov qword [rsi + 0x400], rax
mov qword [rsi + 0x408], rcx
test rdx, rdx
jbe 0x465a6f
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 0x400]
mov qword [rsi + 0x410], rbx
mov rax, qword [0x00596fc0]
mov rbx, rcx
call sym.runtime.cgocall
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x418]
mov rsi, qword [rcx + 0x420]
mov rcx, qword [rcx + 0x428]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x1f], 0
call sym.runtime.unlockOSThread
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rsp, 0x68
pop rbp
ret
xor eax, eax
mov rcx, rax
call sym.runtime.panicIndex
lea rax, [0x004bcec0]
lea rbx, [0x00501b20]
call sym.runtime.gopanic
nop
call sym.runtime.deferreturn
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rsp, 0x68
pop rbp
ret

Function at 0x468a00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061bfeb], 0
je 0x468a0e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x468a20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061bfeb], 0
je 0x468a35
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x468a40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061bfeb], 0
je 0x468a75
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0061c600]
aesenc xmm0, xmmword [0x0061c610]
aesenc xmm0, xmmword [0x0061c620]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x468a80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061bfeb], 0
je 0x468ab6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0061c600]
aesenc xmm0, xmmword [0x0061c610]
aesenc xmm0, xmmword [0x0061c620]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x468b20
Capabilities:
Run powershell expression

Disassembly:
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
xorps xmm15, xmm15
jmp sym.runtime.sigpanic