joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abeb0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x4abf2d
push dword [esi + 0x20]
mov dword [ebp + 8], 0
push str.PRAGMA__Q.page_size
call fcn.004145d0
lea ecx, [ebp + 8]
mov dword [ebp - 4], eax
push ecx
mov edx, eax
mov ecx, edi
call fcn.004abe40
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4abf1c
movzx ecx, byte [esi + 0x17]
mov edx, dword [ebp + 8]
imul ecx, ecx, 0x33
add edx, 0xffffffc0
mov dword [esi + 0x10], edx
add ecx, 4
cmp ecx, edx
jge 0x4abf7c
push dword [ebp - 4]
mov dword [esi + 0x10], ecx
call fcn.00411d50
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.004a3e20
add esp, 4
push eax
push 0x4e2550
jmp 0x4abf6f
push dword [esi + 0x24]
push dword [esi + 0x20]
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.004145d0
add esp, 0xc
mov dword [ebp - 4], eax
lea ecx, [esi + 0x10]
mov edx, eax
push ecx
mov ecx, edi
call fcn.004abe40
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4abf1c
cmp dword [esi + 0x10], 0x1c0
jge 0x4abf7c
push dword [esi + 0x24]
mov ebx, 0x10b
push str.undersize_RTree_blobs_in___q_node_
call fcn.004145d0
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.00411d50
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ac7e0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x10], edx
push edi
xor edi, edi
cmp dword [esi + 0x28], edi
jne 0x4ac8e9
cmp dword [esi + 0x14], edi
jne 0x4ac819
push dword [esi + 8]
push dword [esi + 4]
push str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
push esi
call fcn.004ac700
add esp, 0x10
mov dword [esi + 0x14], eax
cmp dword [esi + 0x28], edi
jne 0x4ac8e9
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push 1
push dword [esi + 0x14]
call fcn.0043bc30
push dword [esi + 0x14]
call fcn.0043a700
add esp, 0x14
cmp eax, 0x64
jne 0x4ac8bb
push 0
push dword [esi + 0x14]
call fcn.0043ac40
push 0
push dword [esi + 0x14]
mov ebx, eax
call fcn.0043aba0
mov dword [esp + 0x20], eax
add esp, 0x10
mov eax, ebx
cdq
mov edi, eax
mov dword [esp + 0xc], edx
call fcn.004a17b0
test eax, eax
je 0x4ac87d
xor edi, edi
mov dword [esi + 0x28], 7
jmp 0x4ac8b8
mov ecx, dword [esp + 0xc]
mov eax, edi
or eax, ecx
je 0x4ac895
push ecx
push edi
call fcn.00411c10
add esp, 8
mov edi, eax
jmp 0x4ac897
xor edi, edi
test edi, edi
jne 0x4ac8a4
mov dword [esi + 0x28], 7
jmp 0x4ac8b8
push ebx
push dword [esp + 0x14]
push edi
call fcn.004b1150
mov eax, dword [esp + 0x20]
add esp, 0xc
mov dword [eax], ebx
mov ebx, dword [ebp + 0xc]
push dword [esi + 0x14]
call fcn.00439680
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x4ac8e9
mov dword [esi + 0x28], eax
test eax, eax
jne 0x4ac8e9
test edi, edi
jne 0x4ac8e9
push ebx
push dword [ebp + 8]
push str.Node__lld_missing_from_database
push esi
call fcn.004ac780
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ac900
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov esi, ecx
mov dword [ebp - 0xc], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
cmp dword [esi + edi*4 + 0x18], 0
jne 0x4ac939
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + edi*4 - 0x10]
push esi
call fcn.004ac700
add esp, 0x10
mov dword [esi + edi*4 + 0x18], eax
cmp dword [esi + 0x28], 0
jne 0x4ac9fe
push dword [ebp + 0xc]
mov ebx, dword [esi + edi*4 + 0x18]
push dword [ebp + 8]
push 1
push ebx
call fcn.0043bc30
push ebx
call fcn.0043a700
add esp, 0x14
cmp eax, 0x65
jne 0x4ac991
mov edx, dword [ebp + 8]
mov ecx, str.__parent
test edi, edi
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
push edx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.004ac780
add esp, 0x1c
jmp 0x4ac9ec
cmp eax, 0x64
jne 0x4ac9ec
push 0
push ebx
call fcn.0043af90
mov ecx, eax
add esp, 8
mov eax, edx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
cmp ecx, edx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
jne 0x4ac9b9
cmp eax, ecx
je 0x4ac9ec
push ecx
mov ecx, dword [ebp + 0xc]
test edi, edi
push edx
mov edx, dword [ebp + 8]
mov eax, str.__rowid
push ecx
push edx
mov dword [ebp - 4], str.__parent
cmove eax, dword [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ecx
push edx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.004ac780
add esp, 0x2c
push ebx
call fcn.00439680
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x4ac9fe
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bfaa0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bf763

Function at 0x4bfaab
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bf8e4
Function at 0x4f8c30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4f8d3c
test eax, eax
je 0x4f8d3c
push esi
push edi
mov ecx, 0x10
mov esi, 0x513ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x4f8d23
lea edi, [eax + 4]
jmp 0x4f8c87
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x4f8c9c
mov dword [ebp - 4], 2
jmp 0x4f8cbd
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x4f8cb3
mov dword [ebp - 4], 1
jmp 0x4f8cbd
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x4f8d33
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x4f8cf6
mov byte [ecx], 0x3d
jmp 0x4f8d02
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x4f8d0d
mov byte [ecx], 0x3d
jmp 0x4f8d13
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x4f8c84
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f8cec
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4f8d3c
test eax, eax
je 0x4f8d3c
push esi
push edi
mov ecx, 0x10
mov esi, 0x513ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x4f8d23
lea edi, [eax + 4]
jmp 0x4f8c87
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x4f8c9c
mov dword [ebp - 4], 2
jmp 0x4f8cbd
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x4f8cb3
mov dword [ebp - 4], 1
jmp 0x4f8cbd
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x4f8d33
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x4f8cf6
mov byte [ecx], 0x3d
jmp 0x4f8d02
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x4f8d0d
mov byte [ecx], 0x3d
jmp 0x4f8d13
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x4f8c84
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4034f0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4036c0
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_chacha8rand.setup
Function at 0x40ceb0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d07b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40ced9
mov eax, 0x7000000
jmp 0x40cee1
test eax, eax
je 0x40d056
mov dword [esp + 0x34], eax
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x626180]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40d06e
cmp edx, 0x21
jae 0x40d062
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x575330]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x5753a0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40d031
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x5753e0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand
Function at 0x416b40
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x416d3e
sub esp, 0x18
mov eax, dword [0x673198]
test eax, eax
jne 0x416d27
nop
nop
lea eax, [0x673188]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x67318c]
test eax, eax
je 0x416b88
cmp dword [eax + 8], 0xcc
jne 0x416bfe
mov edx, dword [0x673190]
test edx, edx
jne 0x416be0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x675a90]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x673190], eax
mov ecx, dword [0x673194]
mov dword [eax], ecx
mov eax, dword [0x673190]
mov dword [0x673194], eax
movzx eax, byte [0x673600]
test al, al
jne 0x416be0
xor eax, eax
jmp 0x416cf8
mov edx, dword [0x673190]
mov ebx, dword [edx + 4]
mov dword [0x673190], ebx
mov ebx, dword [0x67318c]
mov dword [edx + 4], ebx
mov dword [0x67318c], edx
mov edx, dword [0x67318c]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x416cd7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime_internal_atomic.Xadd
mov eax, dword [0x673320]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x416c50
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x416c90
call sym.runtime.gcWriteBarrier8
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x673188]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x673184]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.runtime_internal_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x6252b0]
movzx ebx, byte [edx + eax]
lea ebp, [0x673600]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x416be0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x416ce1
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x5484f7]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x42aba0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ace4
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.spanOfHeap
mov eax, dword [esp + 4]
test eax, eax
je 0x42accd
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x673268]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sym.runtime._mspan_.ensureSwept
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call sym.runtime.lock2
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x42ac37
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42ac62
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x42ac4c
cmp byte [ebp + 6], bl
je 0x42ac57
cmp esi, edx
ja 0x42ac5e
jne 0x42ac35
cmp byte [ebp + 6], bl
jbe 0x42ac35
jmp 0x42ac5e
mov ebx, 1
jmp 0x42ac64
xor ebx, ebx
jmp 0x42ac64
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x42ac82
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call sym.runtime.spanHasSpecials
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x673268]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x42acbd
movzx eax, byte [ebx + 0x65]
test al, al
je 0x42acbd
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x549e79]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.addspecial
Function at 0x42b160
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42b2d0
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42b260
cmp cl, 1
je 0x42b1f2
cmp cl, 2
jne 0x42b2b9
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call sym.runtime.mProf_Free
nop
nop
lea eax, [0x63f5e0]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x63f584]
sub eax, dword [0x63f568]
nop
mov dword [0x63f584], eax
mov eax, dword [0x63f574]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x63f574], ecx
nop
lea eax, [0x63f5e0]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42b2b5
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call sym.runtime.queuefinalizer
nop
nop
lea eax, [0x63f5e0]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x63f55c]
sub eax, dword [0x63f540]
nop
mov dword [0x63f55c], eax
mov eax, dword [0x63f54c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x63f54c], ecx
nop
lea eax, [0x63f5e0]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x42b2b5
cmp cl, 3
jne 0x42b26b
mov byte [eax + 8], 1
jmp 0x42b2b5
cmp cl, 4
jne 0x42b2b9
nop
nop
lea eax, [0x63f5e0]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x63f5d4]
sub eax, dword [0x63f5b8]
nop
mov dword [0x63f5d4], eax
mov eax, dword [0x63f5c4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x63f5c4], ecx
nop
nop
lea eax, [0x63f5e0]
mov dword [esp], eax
call sym.runtime.unlock2
add esp, 0x14
ret
lea eax, [0x545ad8]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.freeSpecial
Function at 0x430ef0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x430fd6
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [eax + 0x88], 0
lea ecx, [0x6735b0]
mov dword [esp], ecx
call sym.runtime_internal_atomic.Loadint32
mov eax, dword [esp + 4]
test eax, eax
je 0x430fb2
mov dword [esp + 8], 0
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x30]
lea edi, [esp + 0x10]
xor eax, eax
call fcn.00469529
lea ecx, [sym.runtime._mLockProfile_.captureStack.func1]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
call sym.runtime.systemstack
mov eax, dword [esp + 8]
cmp eax, 0x20
jge 0x430fae
jae 0x430fcb
mov ecx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 8], 0
add esp, 0x2c
ret
lea eax, [sym.runtime._LostContendedRuntimeLock]
inc eax
mov ecx, dword [esp + 0x30]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
add esp, 0x2c
ret
mov ecx, 0x20
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._mLockProfile_.captureStack