joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58df40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58e0db
sub esp, 0x30
lea eax, [0x6ad0c0]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x58df7f
mov ecx, ebp
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
cmp ebp, ecx
jle 0x58e0ad
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x44]
mov dword [esp], esi
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x1c]
xor esi, esi
jmp 0x58e0c7
mov eax, dword [esp + 0x2c]
movzx esi, byte [eax + 3]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 3], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x58df75
movzx esi, byte [eax + 2]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 2], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x58df75
movzx esi, byte [eax + 1]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 1], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x58df75
movzx esi, byte [eax]
inc esi
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
jmp 0x58df75
add esp, 0x30
ret
movzx edi, byte [ebp + ecx]
movzx edx, byte [esi + edx]
xor edi, edx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edx, dword [esp + 0x28]
cmp esi, eax
jge 0x58e04f
cmp ebx, ebp
jle 0x58e04f
ja 0x58e0b1
mov eax, ebp
mov ecx, ebx
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.crypto_rsa.mgf1XOR
Function at 0x5937a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x59394a
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.00471fab
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x5937cf
inc ebx
cmp edx, ebx
jle 0x5938ee
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x593892
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x593843
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x5937ce
lea edi, [esp + 0x28]
call fcn.00471fab
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym.net_netip.parseIPv6
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0047248e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0047248e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.00471fab
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym.net_netip.parseIPv4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0047248e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0047248e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.00471faa
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x6fa580]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.00471fab
lea ecx, [0x6d5700]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call sym.runtime.convT
mov ecx, dword [esp + 8]
lea edx, [0x765a30]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.00471faa
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x6f92f1]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.00471fab
lea ecx, [0x6d5700]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call sym.runtime.convT
mov ecx, dword [esp + 8]
lea edx, [0x765a30]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call sym.runtime.morestack_noctxt
jmp sym.net_netip.ParseAddr
Function at 0x59bff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x59c1ac
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00471fa7
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x59c028
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x59c051
lea eax, [0x6b2120]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call sym.runtime.makeslice
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.00471fa7
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
or edx, ecx
test bl, bl
je 0x59c094
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x59c0a3
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x59c0b2
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x59c0c1
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x59c0d0
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x59c0dc
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x59c0e8
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x42], ax
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x34]
cmp eax, edx
jae 0x59c158
mov dword [esp + 0x30], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x6b2120]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x58], ebx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call sym.runtime.memmove
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.00472466
add esp, 0x5c
ret
call sym.runtime.morestack_noctxt
jmp sym.vendor_golang.org_x_net_dns_dnsmessage.NewBuilder
Function at 0x5b2d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b2e91
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x5b2db7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x5b2d56
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5b2dc3
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x5b2d81
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5b2dc3
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x20]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x5b2dc3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call sym.net.favoriteAddrFamily
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call sym.net.socket
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call sym.runtime.morestack_noctxt
jmp sym.net.internetSocket
Function at 0x5c2280
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c23f1
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5c22b1
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5c22b1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5c22b7
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5c22c5
cmp ecx, 4
jne 0x5c22f6
cmp al, 0x2c
ja 0x5c22de
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5c22f0
cmp al, 0x24
je 0x5c22f0
cmp al, 0x26
jae 0x5c22f0
jmp 0x5c22f6
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5c22f0
cmp al, 0x5b
je 0x5c22f0
cmp al, 0x5d
jne 0x5c22f6
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5c232d
cmp al, 0x26
ja 0x5c230f
cmp al, 0x24
je 0x5c234c
cmp al, 0x26
je 0x5c234c
jmp 0x5c23d3
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5c234c
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5c23cd
cmp al, 0x2f
je 0x5c234c
jmp 0x5c23d3
cmp al, 0x3d
ja 0x5c2344
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5c234c
cmp al, 0x3d
je 0x5c234c
jmp 0x5c23d3
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5c23c3
cmp ecx, 2
jg 0x5c2387
cmp ecx, 1
je 0x5c237c
cmp ecx, 2
jne 0x5c23d3
cmp al, 0x2f
je 0x5c236a
cmp al, 0x3b
je 0x5c236a
cmp al, 0x2c
jne 0x5c2371
mov eax, 1
jmp 0x5c2377
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5c23ad
cmp al, 0x40
je 0x5c239b
cmp al, 0x2f
je 0x5c239b
cmp al, 0x3f
jne 0x5c23a2
mov eax, 1
jmp 0x5c23a8
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5c23bd
cmp ecx, 7
jne 0x5c23d3
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5c23cd
cmp al, 0x7e
jne 0x5c23d3
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5c23eb
cmp al, 0x21
je 0x5c23e5
add eax, 0xffffffd8
cmp al, 2
ja 0x5c23eb
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call sym.runtime.morestack_noctxt
jmp sym.net_url.shouldEscape
Function at 0x5c7fe0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c8025
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_md5._digest_.Reset

Function at 0x5c8400
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c8468
sub esp, 8
lea eax, [0x6d35e0]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
lea ecx, [0x7667f8]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
add esp, 8
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_md5.New

Function at 0x5c9520
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c956c
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_sha1._digest_.Reset

Function at 0x5c9580
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c95ef
sub esp, 8
lea eax, [0x6d34e0]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
lea ecx, [0x7667d8]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
add esp, 8
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_sha1.New
Function at 0x5cf3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5cf51c
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call sym.vendor_golang.org_x_crypto_cryptobyte._String_.ReadASN1
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5cf438
lea eax, [0x6bde80]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x704167]
mov dword [eax], ecx
lea ecx, [0x7651c4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5cf508
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call sym.vendor_golang.org_x_crypto_cryptobyte._String_.readASN1
movzx eax, byte [esp + 0x10]
test al, al
je 0x5cf4d5
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5cf438
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0x6bde80]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x703b10]
mov dword [eax], ecx
lea ecx, [0x7651c4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_x509.forEachSAN
Function at 0x5da4e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5da714
sub esp, 0x68
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.00471fa5
lea ecx, [sym.crypto_x509._Certificate_.buildChains.func1]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x48], edx
lea edx, [esp + 0x24]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x50], edx
lea ebx, [esp + 0x84]
mov dword [esp + 0x54], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call sym.crypto_x509._CertPool_.findPotentialParents
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5da609
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
mov esi, dword [esp + 0x2c]
mov dword [esp], 2
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
lea edx, [esp + 0x2c]
call esi
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5da5d7
mov eax, dword [esp + 0x80]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
call sym.crypto_x509._CertPool_.findPotentialParents
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5da66f
mov dword [esp + 0x14], edx
lea ecx, [eax + edx*8]
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebp, dword [esp + 0x2c]
mov dword [esp], 1
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
lea edx, [esp + 0x2c]
call ebp
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5da63b
mov eax, dword [esp + 0x88]
test eax, eax
je 0x5da694
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov eax, dword [esp + 0x88]
test eax, eax
jne 0x5da710
mov eax, dword [esp + 0x90]
test eax, eax
jne 0x5da710
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x64], eax
lea eax, [0x6d5600]
mov dword [esp], eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
call sym.runtime.convT
mov eax, dword [esp + 8]
lea ecx, [0x7659b0]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x68
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_x509._Certificate_.buildChains
Function at 0x5eeea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5eefd4
sub esp, 0x48
mov edx, dword [esp + 0x4c]
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x60]
xor eax, eax
jmp 0x5eeed9
test byte [edx], al
movzx esi, byte [eax + edx + 4]
xor esi, edi
xchg esi, ebx
mov byte [eax + edx + 4], bl
xchg esi, ebx
inc eax
cmp ebp, eax
jle 0x5eeeee
lea esi, [eax + 4]
movzx edi, byte [ebx + eax]
cmp esi, 0xc
jb 0x5eeec7
jmp 0x5eefc7
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], 0xc
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x30], ecx
call eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x44], edx
mov ebx, dword [esp + 0x60]
mov ebp, dword [esp + 0x4c]
mov esi, dword [esp + 0x5c]
xor edi, edi
jmp 0x5eef90
movzx edx, byte [edi + ebp + 4]
xor edx, ecx
mov byte [edi + ebp + 4], dl
inc edi
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
cmp ebx, edi
jle 0x5eefa2
lea edx, [edi + 4]
movzx ecx, byte [edi + esi]
cmp edx, 0xc
jb 0x5eef7c
jmp 0x5eefbb
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
mov eax, edx
mov ecx, 0xc
call sym.runtime.panicIndex
mov eax, esi
mov ecx, 0xc
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.crypto_tls._xorNonceAEAD_.Seal
Function at 0x5eefe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x92707c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ef167
sub esp, 0x64
mov edx, dword [esp + 0x68]
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
xor eax, eax
jmp 0x5ef019
test byte [edx], al
movzx esi, byte [eax + edx + 4]
xor esi, edi
xchg esi, ebx
mov byte [eax + edx + 4], bl
xchg esi, ebx
inc eax
cmp ebp, eax
jle 0x5ef02e
lea esi, [eax + 4]
movzx edi, byte [ebx + eax]
cmp esi, 0xc
jb 0x5ef007
jmp 0x5ef15a
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x10]
mov eax, dword [eax + 0x10]
mov dword [esp], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], 0xc
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x30], ecx
call eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x54], ecx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x48], edx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x4c], ebx
mov ebp, dword [esp + 0x44]
mov dword [esp + 0x60], ebp
mov esi, dword [esp + 0x7c]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x58], eax
xor eax, eax
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x58]
jmp 0x5ef108
movzx ecx, byte [ebp + edi + 4]
xor ecx, edx
mov byte [ebp + edi + 4], cl
lea ecx, [ebp + 1]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
cmp esi, ebp
jle 0x5ef123
lea ecx, [ebp + 4]
mov ebx, dword [esp + 0x78]
movzx edx, byte [ebp + ebx]
cmp ecx, 0xc
jb 0x5ef0e6
jmp 0x5ef14e
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], edx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ecx
mov eax, dword [esp + 0x60]
mov dword [esp + 0xac], eax
add esp, 0x64
ret
mov eax, ecx
mov ecx, 0xc
call sym.runtime.panicIndex
mov eax, esi
mov ecx, 0xc
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.crypto_tls._xorNonceAEAD_.Open