joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50077b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
nop
call sym.crypto_internal_boring_sig.StandardCrypto.abi0
xorps xmm15, xmm15
mov r14, qword [0x007c4a20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x50068a
nop dword [rax]
cmp rdx, 0x40
ja 0x50076d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x5005f9
mov rax, rdx
mov rcx, rsi
nop
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x500661
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x007c4a20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x500762
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x500697
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x500715
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x007c4a20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x500758
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x500754
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_sha256._digest_.Write
Function at 0x508540
Capabilities:
Reference sql statements

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x5087c1
push rbp
mov rbp, rsp
sub rsp, 0x138
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466a14
mov rbp, qword [rbp]
cmp byte [rax + 0x38], 0
jne 0x508782
movzx edx, byte [rax + 0x24]
cmp bl, dl
jbe 0x5085b8
mov rdx, qword [0x0075bcf0]
mov r8, qword [0x0075bcf8]
jmp 0x508636
jae 0x5085ca
mov rdx, qword [0x0075bd00]
mov r8, qword [0x0075bd08]
jmp 0x508636
mov byte [rax + 0x38], 0
cmp bl, 3
ja 0x5085eb
cmp bl, 2
jne 0x5085e0
movzx edx, word [rax + 0x1c]
jmp 0x508604
cmp bl, 3
jne 0x508602
movzx edx, word [rax + 0x1e]
jmp 0x508604
cmp bl, 4
jne 0x5085f6
movzx edx, word [rax + 0x20]
jmp 0x508604
cmp bl, 5
jne 0x508602
movzx edx, word [rax + 0x22]
nop
jmp 0x508604
xor edx, edx
movzx edx, dx
cmp qword [rax + 0x30], rdx
jne 0x508631
mov qword [rax + 0x30], 0
movzx r9d, byte [rax + 0x24]
inc r9d
mov byte [rax + 0x24], r9b
mov rdx, qword [0x0075bd00]
mov r8, qword [0x0075bd08]
jmp 0x508636
xor edx, edx
xor r8d, r8d
test rdx, rdx
jne 0x508741
mov qword [rsp + 0x258], rax
movups xmmword [rsp + 0x2c], xmm15
lea rdi, [rsp + 0x38]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466a14
mov rbp, qword [rbp]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 0x28]
lea rax, [rsp + 0x2c]
call sym.vendor_golang.org_x_net_dns_dnsmessage._ResourceHeader_.unpack
test rbx, rbx
je 0x5086c4
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466a14
mov rbp, qword [rbp]
mov rax, rbx
mov rbx, rcx
add rsp, 0x138
pop rbp
ret
mov rdi, qword [rsp + 0x258]
mov byte [rdi + 0x38], 1
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rdi + 0x3c], xmm0
lea rcx, [rdi + 0x48]
lea rsi, [rsp + 0x38]
mov rdx, rdi
mov rdi, rcx
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
mov qword [rdx + 0x28], rax
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsp + 0x148], xmm0
lea rdi, [rsp + 0x154]
lea rsi, [rsp + 0x38]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
add rsp, 0x138
pop rbp
nop
ret
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466a14
mov rbp, qword [rbp]
mov rax, rdx
mov rbx, r8
add rsp, 0x138
pop rbp
ret
movups xmm0, xmmword [rax + 0x3c]
movups xmmword [rsp + 0x148], xmm0
lea rsi, [rax + 0x48]
lea rdi, [rsp + 0x154]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
add rsp, 0x138
pop rbp
nop
ret
mov qword [rsp + 0x118], rax
mov byte [rsp + 0x120], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 0x118]
movzx ebx, byte [rsp + 0x120]
jmp sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.resourceHeader
Function at 0x508800
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5089f6
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x58], bl
cmp byte [rax + 0x38], 0
je 0x508857
movzx ecx, word [rax + 0x144]
add rcx, qword [rax + 0x28]
cmp qword [rax + 8], rcx
jge 0x508841
mov rax, qword [0x0075bd70]
mov rbx, qword [0x0075bd78]
add rsp, 0x40
pop rbp
ret
mov qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
movzx edx, byte [rax + 0x24]
cmp bl, dl
jbe 0x50886f
mov rdx, qword [0x0075bcf0]
mov rsi, qword [0x0075bcf8]
jmp 0x5088ee
jae 0x508882
mov rdx, qword [0x0075bd00]
mov rsi, qword [0x0075bd08]
nop
jmp 0x5088ee
mov byte [rax + 0x38], 0
cmp bl, 3
ja 0x5088a2
cmp bl, 2
jne 0x508896
movzx edx, word [rax + 0x1c]
jmp 0x5088ba
cmp bl, 3
jne 0x5088b8
movzx edx, word [rax + 0x1e]
nop
jmp 0x5088ba
cmp bl, 4
jne 0x5088ad
movzx edx, word [rax + 0x20]
jmp 0x5088ba
cmp bl, 5
jne 0x5088b8
movzx edx, word [rax + 0x22]
jmp 0x5088ba
xor edx, edx
movzx edx, dx
nop dword [rax]
cmp qword [rax + 0x30], rdx
jne 0x5088ea
mov qword [rax + 0x30], 0
movzx r8d, byte [rax + 0x24]
inc r8d
mov byte [rax + 0x24], r8b
mov rdx, qword [0x0075bd00]
mov rsi, qword [0x0075bd08]
jmp 0x5088ee
xor edx, edx
xor esi, esi
test rdx, rdx
jne 0x5089ea
mov qword [rsp + 0x50], rax
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax]
mov rdi, qword [rax + 0x28]
mov rax, rdx
call sym.vendor_golang.org_x_net_dns_dnsmessage.skipResource
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0x28], rax
nop dword [rax]
test rbx, rbx
je 0x5089dc
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rax, [0x005b4860]
call sym.runtime.newobject
mov qword [rsp + 0x38], rax
mov rbx, qword [0x00770098]
lea rcx, [rsp + 0x58]
lea rax, [0x005a1840]
call sym.runtime.mapaccess1
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
xor eax, eax
lea rbx, [0x005dea90]
mov ecx, 0xa
call sym.runtime.concatstring2
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], rbx
cmp dword [0x007c4ac0], 0
je 0x508997
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rdx
cmp dword [0x007c4ac0], 0
jne 0x5089b3
mov rdx, qword [rsp + 0x30]
jmp 0x5089c8
call sym.runtime.gcWriteBarrier2
mov rdx, qword [rsp + 0x30]
mov qword [r11], rdx
mov rsi, qword [rcx + 0x18]
mov qword [r11 + 8], rsi
mov qword [rcx + 0x18], rdx
lea rax, [0x00637b20]
mov rbx, rcx
add rsp, 0x40
pop rbp
ret
inc qword [rdx + 0x30]
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, rdx
mov rbx, rsi
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.skipResource
Function at 0x509180
Capabilities:
Reference sql statements

Disassembly:
lea r12, [rsp - 0x2a8]
cmp r12, qword [r14 + 0x10]
jbe 0x5092c1
push rbp
mov rbp, rsp
sub rsp, 0x320
lea rdi, [rsp + 0x330]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466a14
mov rbp, qword [rbp]
cmp byte [rax + 0x38], 0
nop dword [rax]
je 0x5092aa
cmp word [rax + 0x13c], 5
jne 0x5092aa
mov qword [rsp + 0x430], rax
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax]
mov rdi, qword [rax + 0x28]
mov rax, rdx
call sym.vendor_golang.org_x_net_dns_dnsmessage.unpackCNAMEResource
lea rdi, [rsp + 0x220]
mov rsi, rsp
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
lea rdi, [rsp + 0x120]
lea rsi, [rsp + 0x220]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
test rax, rax
je 0x50925f
lea rdi, [rsp + 0x330]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466a14
mov rbp, qword [rbp]
add rsp, 0x320
pop rbp
ret
mov rcx, qword [rsp + 0x430]
movzx edx, word [rcx + 0x144]
add qword [rcx + 0x28], rdx
mov byte [rcx + 0x38], 0
inc qword [rcx + 0x30]
lea rdi, [rsp + 0x330]
lea rsi, [rsp + 0x120]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
add rsp, 0x320
pop rbp
ret
mov rax, qword [0x0075bcf0]
mov rbx, qword [0x0075bcf8]
add rsp, 0x320
pop rbp
ret
mov qword [rsp + 0x108], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 0x108]
jmp sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.CNAMEResource

Function at 0x5092e0
Capabilities:
Reference sql statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rsp + 0x30], 0
cmp byte [rax + 0x38], 0
je 0x5093e1
cmp word [rax + 0x13c], 1
jne 0x5093e1
mov rcx, qword [rax + 0x28]
lea rsi, [rcx + 4]
mov rdx, qword [rax + 0x10]
mov rdi, qword [rax]
cmp qword [rax + 8], rsi
mov dword [rsp + 0x14], 0
mov dword [rsp + 0x1c], 0
jge 0x509340
mov rcx, qword [0x0075bd10]
mov rdx, qword [0x0075bd18]
jmp 0x509378
cmp rdx, rsi
jb 0x509405
cmp rcx, rsi
ja 0x5093f5
mov rsi, rcx
sub rcx, rdx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rdi + rsi]
lea rdx, [rsp + 0x1c]
cmp rdx, rcx
je 0x509374
mov ecx, dword [rdi + rsi]
mov dword [rsp + 0x1c], ecx
xor ecx, ecx
xor edx, edx
test rcx, rcx
je 0x509387
mov dword [rsp + 0x14], 0
jmp 0x50939b
mov dword [rsp + 0x14], 0
mov esi, dword [rsp + 0x1c]
mov dword [rsp + 0x14], esi
xor ecx, ecx
xor edx, edx
mov esi, dword [rsp + 0x14]
mov dword [rsp + 0x18], esi
test rcx, rcx
je 0x5093bc
mov dword [rsp + 0x30], 0
mov rax, rcx
mov rbx, rdx
add rsp, 0x20
pop rbp
ret
movzx ecx, word [rax + 0x144]
add qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
mov ecx, dword [rsp + 0x18]
mov dword [rsp + 0x30], ecx
xor eax, eax
xor ebx, ebx
add rsp, 0x20
pop rbp
ret
mov rax, qword [0x0075bcf0]
mov rbx, qword [0x0075bcf8]
add rsp, 0x20
pop rbp
ret
mov rax, rcx
mov rcx, rsi
nop dword [rax + rax]
call sym.runtime.panicSliceB
mov rcx, rsi
call sym.runtime.panicSliceAcap
nop
int3
Function at 0x509420
Capabilities:
Reference sql statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
movups xmmword [rsp + 0x50], xmm15
cmp byte [rax + 0x38], 0
je 0x509522
cmp word [rax + 0x13c], 0x1c
jne 0x509522
mov rcx, qword [rax + 0x28]
lea rsi, [rcx + 0x10]
mov rdx, qword [rax + 0x10]
mov rdi, qword [rax]
cmp qword [rax + 8], rsi
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x30], xmm15
jge 0x509480
mov rcx, qword [0x0075bd10]
mov rdx, qword [0x0075bd18]
jmp 0x5094b9
cmp rdx, rsi
jb 0x509545
cmp rcx, rsi
ja 0x509536
mov rsi, rcx
sub rcx, rdx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rdi + rsi]
lea rdx, [rsp + 0x30]
cmp rdx, rcx
je 0x5094b5
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm0
xor ecx, ecx
xor edx, edx
test rcx, rcx
je 0x5094c6
movups xmmword [rsp + 0x10], xmm15
jmp 0x5094da
movups xmmword [rsp + 0x10], xmm15
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x10], xmm0
xor ecx, ecx
xor edx, edx
movups xmm0, xmmword [rsp + 0x10]
movups xmmword [rsp + 0x20], xmm0
test rcx, rcx
je 0x5094fb
movups xmmword [rsp + 0x50], xmm15
mov rax, rcx
mov rbx, rdx
add rsp, 0x40
pop rbp
ret
movzx ecx, word [rax + 0x144]
add qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, qword [0x0075bcf0]
mov rbx, qword [0x0075bcf8]
add rsp, 0x40
pop rbp
ret
mov rax, rcx
mov rcx, rsi
nop dword [rax]
call sym.runtime.panicSliceB
mov rcx, rsi
call sym.runtime.panicSliceAcap
nop
int3
Function at 0x5097c0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50992a
push rbp
mov rbp, rsp
sub rsp, 0x30
movzx edx, byte [rax + 0x18]
cmp dl, 2
jb 0x509916
nop
ja 0x509902
mov qword [rsp + 0x148], rax
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 0x30]
mov r8, qword [rax + 0x28]
lea rax, [rsp + 0x40]
call sym.vendor_golang.org_x_net_dns_dnsmessage._Question_.pack
test rdi, rdi
jne 0x5098f6
mov rdx, qword [rsp + 0x148]
movzx esi, byte [rdx + 0x18]
cmp sil, 3
ja 0x509860
cmp sil, 2
jne 0x509842
lea rsi, [rdx + 0x1e]
mov rdi, qword [0x0075bdc0]
mov r8, qword [0x0075bdc8]
nop
jmp 0x5098a1
cmp sil, 3
jne 0x50989a
lea rsi, [rdx + 0x20]
mov rdi, qword [0x0075bdd0]
mov r8, qword [0x0075bdd8]
jmp 0x5098a1
cmp sil, 4
jne 0x509880
lea rsi, [rdx + 0x22]
mov rdi, qword [0x0075bde0]
mov r8, qword [0x0075bde8]
jmp 0x5098a1
cmp sil, 5
jne 0x50989a
lea rsi, [rdx + 0x24]
mov rdi, qword [0x0075bdf0]
mov r8, qword [0x0075bdf8]
jmp 0x5098a1
xor esi, esi
xor edi, edi
xor r8d, r8d
movzx r9d, word [rsi]
cmp r9w, 0xffff
je 0x5098b8
inc r9d
mov word [rsi], r9w
xor edi, edi
xor r8d, r8d
test rdi, rdi
jne 0x5098ea
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rcx
cmp dword [0x007c4ac0], 0
je 0x5098dd
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [rdx]
mov qword [r11 + 8], rcx
mov qword [rdx], rax
xor eax, eax
xor ebx, ebx
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov rbx, r8
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x30
pop rbp
ret
mov rax, qword [0x0075bd00]
mov rbx, qword [0x0075bd08]
add rsp, 0x30
pop rbp
ret
mov rax, qword [0x0075bcf0]
mov rbx, qword [0x0075bcf8]
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x110], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 0x110]
nop
jmp sym.vendor_golang.org_x_net_dns_dnsmessage._Builder_.Question
Function at 0x509e80
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x509f0e
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp byte [rax + 0x18], 0
je 0x509eed
mov byte [rax + 0x18], 6
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x28]
cmp rdx, rcx
jb 0x509f08
mov qword [rsp + 0x30], rax
lea rsi, [rax + 0x1a]
mov r8, qword [rax]
sub rdx, rcx
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and rcx, rdx
lea rbx, [r8 + rcx]
xor ecx, ecx
mov rax, rsi
call sym.vendor_golang.org_x_net_dns_dnsmessage._header_.pack
mov rdx, qword [rsp + 0x30]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
xor edi, edi
xor esi, esi
add rsp, 0x20
pop rbp
ret
mov rdi, qword [0x0075bcf0]
mov rsi, qword [0x0075bcf8]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0x20
pop rbp
ret
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp sym.vendor_golang.org_x_net_dns_dnsmessage._Builder_.Finish
Function at 0x50e980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50eace
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x0075b178]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x007c4a20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x50ea92
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x50eac8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x50eabd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x5141e0
Capabilities:
Reference sql statements

Disassembly:
lea r12, [rsp - 0x1c8]
cmp r12, qword [r14 + 0x10]
jbe 0x514383
push rbp
mov rbp, rsp
sub rsp, 0x240
cmp word [rsp + 0x25c], 3
je 0x51436c
nop
mov ebx, 3
call sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.resourceHeader
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x12c], xmm0
lea rdi, [rsp + 0x138]
lea rsi, [rsp + 0xc]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
test rax, rax
je 0x5142bc
nop dword [rax + rax]
cmp qword [0x0075bd00], rax
je 0x514270
mov ecx, 1
jmp 0x5142a1
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x238], rbx
mov rcx, qword [0x0075bd08]
call sym.runtime.ifaceeq
xor eax, 1
mov rbx, qword [rsp + 0x238]
mov ecx, eax
mov rax, qword [rsp + 0x120]
test cl, cl
je 0x5142bc
mov rax, qword [0x0075b970]
mov rbx, qword [0x0075b978]
add rsp, 0x240
pop rbp
ret
cmp word [rsp + 0x25c], 0
jne 0x514314
cmp byte [rsp + 0x256], 0
jne 0x514314
cmp byte [rsp + 0x259], 0
jne 0x514314
nop dword [rax + rax]
cmp qword [0x0075bd00], rax
je 0x5142ed
xor eax, eax
jmp 0x5142f9
mov rcx, qword [0x0075bd08]
call sym.runtime.ifaceeq
test al, al
je 0x514314
mov rax, qword [0x0075b960]
mov rbx, qword [0x0075b968]
add rsp, 0x240
pop rbp
ret
movzx ecx, word [rsp + 0x25c]
nop dword [rax]
test cx, cx
je 0x51435f
cmp cx, 3
je 0x51435f
cmp cx, 2
jne 0x514348
mov rax, qword [0x0075b9c0]
mov rbx, qword [0x0075b9c8]
add rsp, 0x240
pop rbp
ret
mov rax, qword [0x0075b990]
mov rbx, qword [0x0075b998]
add rsp, 0x240
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x240
pop rbp
ret
mov rax, qword [0x0075ba10]
mov rbx, qword [0x0075ba18]
add rsp, 0x240
pop rbp
ret
mov qword [rsp + 0x18], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 0x18]
jmp sym.net.checkHeader
Function at 0x5143a0
Capabilities:
Reference sql statements

Disassembly:
lea r12, [rsp - 0x2d0]
cmp r12, qword [r14 + 0x10]
jbe 0x514504
push rbp
mov rbp, rsp
sub rsp, 0x348
mov word [rsp + 0x360], bx
mov qword [rsp + 0x340], rax
jmp 0x5143d7
mov rax, qword [rsp + 0x340]
mov ebx, 3
nop dword [rax]
call sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.resourceHeader
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x22c], xmm0
lea rdi, [rsp + 0x238]
lea rsi, [rsp + 0xc]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
movups xmm0, xmmword [rsp + 0x22c]
movups xmmword [rsp + 0x120], xmm0
lea rdi, [rsp + 0x12c]
lea rsi, [rsp + 0x238]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466d20
mov rbp, qword [rbp]
cmp qword [0x0075bd00], rax
jne 0x514480
mov qword [rsp + 0x338], rax
mov rcx, qword [0x0075bd08]
call sym.runtime.ifaceeq
test al, al
jne 0x5144ed
mov rax, qword [rsp + 0x338]
nop dword [rax]
test rax, rax
jne 0x5144d6
movzx ecx, word [rsp + 0x360]
cmp word [rsp + 0x220], cx
je 0x5144c9
mov rax, qword [rsp + 0x340]
mov ebx, 3
call sym.vendor_golang.org_x_net_dns_dnsmessage._Parser_.skipResource
test rax, rax
je 0x5143cf
mov rax, qword [0x0075b970]
mov rbx, qword [0x0075b978]
add rsp, 0x348
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x348
pop rbp
ret
mov rax, qword [0x0075b970]
mov rbx, qword [0x0075b978]
add rsp, 0x348
pop rbp
ret
mov rax, qword [0x0075ba10]
mov rbx, qword [0x0075ba18]
add rsp, 0x348
pop rbp
ret
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
nop dword [rax]
jmp sym.net.skipToAnswer