joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44e237
movzx edx, byte [rax]
test edx, edx
jne 0x44e0f4
nop dword [rax]
test r8b, r8b
jne 0x44e0f4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44e107
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44e1f7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44e1e5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44e1d7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44e15d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44e1a0
mov eax, 1
cmp rax, rbx
ja 0x44e18b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44e1cf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44e193
mov rcx, r11
mov eax, r12d
jmp 0x44e162
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44e22d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44e1f0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44e10d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3
Function at 0x455640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4556ef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d8cf8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45ee00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d8aab], 0
je 0x45ee0e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45ee20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d8aab], 0
je 0x45ee35
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45ee40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d8aab], 0
je 0x45ee75
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006d90a0]
aesenc xmm0, xmmword [0x006d90b0]
aesenc xmm0, xmmword [0x006d90c0]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x45ee80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x006d8aab], 0
je 0x45eeb6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006d90a0]
aesenc xmm0, xmmword [0x006d90b0]
aesenc xmm0, xmmword [0x006d90c0]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x460780
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x460b80
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x460bb4
mov rcx, 0x28
jmp 0x460bbf
shl rcx, 3
add rcx, 0x1480
mov qword [0x006d8cf8], rcx
pop rbp
ret
Function at 0x47dac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47db8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d8cf8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47db6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004e40c0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x47db5e
mov edi, 1
lea rsi, [0x004e40c0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0052e398]
lea rsi, [0x0052dae0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x417e00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417f90
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417e65
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417e80
add rsp, 0x48
pop rbp
ret
call sym.runtime.add
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x417e9f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417eaf
cmp rbx, 0x1000
jae 0x417e6b
jmp 0x417f1a
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417ec2
xor edx, edx
nop
jmp 0x417f11
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417ea5
jmp 0x417e94
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004cd567]
mov ebx, 0x18
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004cd878]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004cf50c]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x417fc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4181ea
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x418033
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41805a
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call sym.runtime.add
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x41807c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x41808c
cmp rbx, 0x1000
jae 0x418039
jmp 0x41810e
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41809e
xor esi, esi
jmp 0x418100
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x418082
jmp 0x41806e
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x418189
call sym.runtime.printlock
lea rax, [0x004cd891]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
call sym.runtime.printuint
lea rax, [0x004cd878]
mov ebx, 0x19
nop dword [rax]
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004cadd0]
mov ebx, 0xd
call sym.runtime.throw
cmp eax, 0x5af
je 0x418131
call sym.runtime.printlock
lea rax, [0x004cd891]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004cd878]
mov ebx, 0x19
nop dword [rax]
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004cede8]
mov ebx, 0x1f
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUsedOS
Function at 0x422ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422de6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x422d23
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x422ddb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call sym.runtime._scavengeIndex_.find
test rax, rax
je 0x422ddb
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [sym.runtime._pageAlloc_.scavenge.func1]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422dc9
xor eax, eax
jmp 0x422dd3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x422d11
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.runtime._pageAlloc_.scavenge

Function at 0x45bc00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45bcaf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x465080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005a3aab], 0
je 0x46508e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback
Function at 0x4650a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005a3aab], 0
je 0x4650b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x4650c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005a3aab], 0
je 0x4650f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005a4020]
aesenc xmm0, xmmword [0x005a4030]
aesenc xmm0, xmmword [0x005a4040]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x465100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005a3aab], 0
je 0x465136
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005a4020]
aesenc xmm0, xmmword [0x005a4030]
aesenc xmm0, xmmword [0x005a4040]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x466a00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x466e00
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x466e34
mov rcx, 0x28
jmp 0x466e3f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005a3cc8], rcx
pop rbp
ret
Function at 0x48bb00
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x48bcdb
push rbp
mov rbp, rsp
sub rsp, 0xa8
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
nop dword [rax]
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x48bb89
jmp 0x48bbd2
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x004d83e8]
mov qword [rsp + 0x40], rdx
lea rdx, [0x004d7da0]
mov qword [rsp + 0x48], rdx
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
add rsp, 0xa8
pop rbp
ret
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rcx
inc rcx
mov qword [rsp + 0x30], rcx
lea rax, [0x004b51e0]
mov rbx, rcx
call sym.runtime.makeslice
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rsi
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jg 0x48bc5b
jmp 0x48bc62
mov qword [rsp + 0x28], rdx
jmp 0x48bc64
jmp 0x48bc64
mov rdx, qword [rsp + 0x90]
cmp qword [rsp + 0x50], rdx
jne 0x48bc75
jmp 0x48bc93
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x90]
call sym.runtime.memmove
jmp 0x48bc95
jmp 0x48bc95
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.ByteSliceFromString
Function at 0x48bea0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x48c052
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
nop dword [rax]
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x48bf29
jmp 0x48bf72
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x004d83e8]
mov qword [rsp + 0x48], rdx
lea rdx, [0x004d7da0]
mov qword [rsp + 0x50], rdx
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x58]
add rsp, 0xa0
pop rbp
ret
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rcx
inc rcx
lea rax, [0x004b5320]
xor ebx, ebx
call sym.runtime.makeslice
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
inc rsi
mov qword [rsp + 0x80], rsi
mov rdx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xb8]
mov rcx, rax
xor edi, edi
mov rax, rdx
call sym.syscall.encodeWTF16
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
inc rbx
cmp rcx, rbx
jae 0x48bfe7
jmp 0x48bfe9
jmp 0x48bffc
mov edi, 1
lea rsi, [0x004b5320]
call sym.runtime.growslice
jmp 0x48bffc
lea rdx, [rax + rbx*2]
lea rdx, [rdx - 2]
mov word [rdx], 0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor edi, edi
xor esi, esi
add rsp, 0xa0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4a89e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8a53
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], al
call sym.internal_bytealg.IndexByte.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.bytes.IndexByte
Function at 0x4a8ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9006
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x4a8edb
jmp 0x4a8efd
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call sym.unicode_utf8.RuneCountInString
mov qword [rsp + 0x48], rax
inc rax
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x48], rdi
cmp rdi, 1
je 0x4a8f0a
jmp 0x4a8f63
mov rdx, qword [rsp + 0x70]
test rdi, rdi
ja 0x4a8f19
jmp 0x4a8ff7
movzx eax, byte [rdx]
mov byte [rsp + 0x27], al
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], al
call sym.internal_bytealg.CountString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a3cc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x30], 0
jmp 0x4a8f6e
jmp 0x4a8f70
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
call sym.strings.Index
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x4a8f96
jmp 0x4a8fa6
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
inc qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdx
add rax, rdx
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x4a8fce
jmp 0x4a8ff2
sub rcx, rax
mov rsi, rcx
neg rcx
sar rcx, 0x3f
and rax, rcx
add rdx, rax
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
jmp 0x4a8fed
jmp 0x4a8f6e
call sym.runtime.panicSliceB
xor eax, eax
mov rcx, rdi
nop dword [rax]
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.strings.Count