joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bdd10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013a0b3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test byte [0x101cb200], 1
je 0x100bdd5e
push dword [0x101cb20c]
mov ecx, 0x10172518
push dword [0x101cb208]
call fcn.1005f580
add esp, 8
push 0xc
call fcn.1005f580
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
test eax, eax
je 0x100bdd97
mov dword [eax], vtable.appv::utility::scope_guard_func.0
mov byte [esp + 0x20], 1
mov dword [eax], vtable.._AV__scope_guard_func_impl_V___Bind__00XQ6AXXZ___V_std___utility_appv__.0
mov dword [eax + 4], 0x100bbe00
mov byte [esp + 0x20], 0
jmp 0x100bdd99
xor eax, eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 3
lea ecx, [esi + 0x60]
call fcn.1005f580
lea ecx, [esi + 0x50]
call fcn.1005f580
lea ecx, [esi + 0x58]
call fcn.1005f580
lea ecx, [esi + 0x28]
call fcn.1005f580
lea ecx, [esi + 0x30]
call fcn.1005f580
lea ecx, [esi + 0x38]
call fcn.1005f580
lea ecx, [esi + 0x40]
call fcn.1005f580
mov dword [esi + 0x48], 0
xorps xmm0, xmm0
mov dword [esi + 0x4c], 0
movdqu xmmword [esi + 8], xmm0
movdqu xmmword [esi + 0x18], xmm0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.1005f580
xor eax, eax
mov edx, 0x80
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c6560
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10148618
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add eax, 0xc
mov ecx, dword [0x101caba8]
mov dword [esp + 0x24], eax
mov eax, ebx
and eax, 0x300
mov dword [esp + 0x1c], 0x18
or eax, dword [esi + 4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x100c65ee
lea edx, [esp + 0x1c]
push edx
push eax
lea eax, [esp + 0x18]
push eax
call ecx
jmp 0x100c65ff
lea ecx, [esp + 0x1c]
push ecx
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x100c66b4
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x40], 1
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
push eax
movzx eax, byte [esi + 0x10]
push eax
call fcn.1005f580
mov edi, eax
add esp, 0xc
test edi, edi
js 0x100c667c
cmp byte [esi + 8], 0
je 0x100c665d
mov edx, ebx
lea ecx, [esp + 0x14]
call fcn.1005f580
mov edi, eax
test edi, edi
js 0x100c667c
mov edx, dword [ebp + 0x14]
xor edi, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [edx], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [edx + 4], ecx
mov dword [esp + 0x40], 0xffffffff
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100c66b2
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x100c66b2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x100c66b2
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100fa8e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 4]
mov edx, dword [eax + 0x14]
mov esi, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [0x101cabac]
test edx, edx
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
push edx
push esi
push edi
push ebx
push eax
push ecx
je 0x100fa924
call dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100fa940
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
call eax
test al, al
je 0x100fa95e
mov eax, 0xc0000022
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov esi, dword [esi + 4]
push ebx
push edi
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [ebp + 8], ecx
mov ecx, dword [0x101cabc4]
test ecx, ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
push ecx
push edx
push edi
push ebx
push eax
push esi
je 0x100fa99a
call dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.ntdll.dll_NtSetValueKey]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100faa40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 4]
push ebx
mov ebx, dword [0x101cabb0]
mov edx, dword [eax + 0x10]
push esi
mov esi, dword [eax + 0xc]
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 4]
push edx
push esi
push edi
push eax
push ecx
test ebx, ebx
je 0x100faa70
call ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
call dword [sym.imp.ntdll.dll_NtQueryKey]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100fb6e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014f483
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx]
mov eax, dword [eax + 0x38]
call eax
test al, al
je 0x100fb72c
mov eax, 0xc0000022
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
mov ecx, ebx
push 1
push 1
call dword [eax + 0x48]
test eax, eax
js 0x100fb81d
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.1005f580
mov esi, eax
test esi, esi
jns 0x100fb7a5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1005f580
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.1005f580
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.1005f580
mov esi, dword [ebp - 0x10]
cmp esi, dword [eax]
setne al
test al, al
je 0x100fb80c
lea esp, [esp]
mov eax, dword [esi]
mov edx, dword [0x101cabb4]
add eax, 0xc
mov ecx, dword [ebx + 4]
push eax
push ecx
test edx, edx
je 0x100fb7e8
call edx
jmp 0x100fb7ee
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov edi, eax
test edi, edi
js 0x100fb82f
mov esi, dword [esi + 0xc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.1005f580
cmp esi, dword [eax]
setne al
test al, al
jne 0x100fb7d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1005f580
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1005f580
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100fbb30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014f4f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x101caba8]
test eax, eax
je 0x100fbbaa
lea ecx, [ebp - 0x30]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
call eax
jmp 0x100fbbba
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, eax
test esi, esi
js 0x100fbc88
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword [0x101cabac]
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x2c]
mov dword [ebp - 0x10], 0
test eax, eax
je 0x100fbbf9
lea esi, [ebp - 0x10]
push esi
push ecx
push edx
push 0
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 8]
call eax
jmp 0x100fbc0e
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp esi, 0xc0000034
je 0x100fbc86
test esi, esi
jns 0x100fbcae
cmp esi, 0x80000005
je 0x100fbc30
cmp esi, 0xc0000023
jne 0x100fbc88
push dword [ebp - 0x10]
lea ecx, [edi + 0x24]
call fcn.1005f580
mov esi, eax
test esi, esi
js 0x100fbc88
mov eax, dword [0x101cabac]
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x2c]
test eax, eax
je 0x100fbc63
lea esi, [ebp - 0x10]
push esi
push ecx
push edx
push 0
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 8]
call eax
jmp 0x100fbc78
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test esi, esi
jns 0x100fbcae
cmp esi, 0xc0000034
jne 0x100fbc88
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x100fbcce
cmp byte [0x101ca990], 0
jne 0x100fbcce
mov ecx, dword [0x101cab8c]
push eax
test ecx, ecx
je 0x100fbcc1
call ecx
jmp 0x100fbcc7
mov eax, dword [edi + 0x2c]
test dword [eax + 4], 0x10000
je 0x100fbc86
mov esi, 0xc0000034
jmp 0x100fbc88
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp + 8], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101116cd
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x10151d44
call fcn.10119a04
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x101117c5
cmp byte [esi + 0x46], bl
je 0x101117c5
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x10111709
xor al, al
jmp 0x101117c7
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.1005f580
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x10111736
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1011175d
dec eax
je 0x10111761
dec eax
dec eax
je 0x101117b3
xor bl, bl
jmp 0x101117b5
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x10111771
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x10111799
cmp eax, 0x10
jae 0x10111780
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.1011d718
add esp, 0x10
cmp ebx, eax
jne 0x10111759
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x101117b3
test ebx, ebx
jne 0x1011172a
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.1005f580
jmp 0x10111724
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1005f580
mov al, bl
jmp 0x101117c7
mov al, 1
call fcn.101199c2
ret
Function at 0x10111be0
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x10151d96
call fcn.10119a04
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, 0xffff
cmp si, bx
jne 0x10111c02
xor eax, eax
jmp 0x10111d8a
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10111c2e
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x10111c2e
dec dword [edx]
mov ax, bx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x10111d8a
cmp dword [edi + 0x50], 0
je 0x10111d87
mov ecx, edi
call fcn.1011186e
xor ecx, ecx
cmp dword [edi + 0x40], ecx
jne 0x10111c61
push dword [edi + 0x50]
push ebx
call fcn.1005f580
pop ecx
pop ecx
test al, al
je 0x10111d87
movzx esi, bx
jmp 0x10111d87
push ecx
movzx eax, bx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0xf
call fcn.1005f580
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jae 0x10111c94
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp ecx, 0x10
jae 0x10111ca2
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [edi + 0x40]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov edx, dword [ecx]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x32]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [edi + 0x48]
push eax
call dword [edx + 0x1c]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x10111d7b
cmp eax, 1
jg 0x10111d5f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jb 0x10111cef
mov dword [ebp - 0x2c], eax
jmp 0x10111cf5
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
je 0x10111d27
cmp ecx, 0x10
jae 0x10111d08
lea eax, [ebp - 0x28]
push dword [edi + 0x50]
push edx
push 1
push eax
call fcn.1011d718
mov edx, dword [ebp - 0x2c]
add esp, 0x10
cmp edx, eax
jne 0x10111d57
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
lea ebx, [ebp - 0x34]
mov byte [edi + 0x46], 1
cmp dword [ebp - 0x3c], ebx
mov ebx, dword [ebp + 8]
jne 0x10111d54
test edx, edx
jne 0x10111c8c
cmp dword [ebp - 0x18], 0x20
jae 0x10111d5a
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.1005f580
jmp 0x10111c83
movzx esi, bx
movzx esi, si
movzx esi, si
jmp 0x10111d78
cmp eax, 3
jne 0x10111d7b
push dword [edi + 0x50]
push dword [ebp - 0x34]
call fcn.1005f580
pop ecx
pop ecx
test al, al
je 0x10111d78
movzx esi, bx
movzx esi, si
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1005f580
mov ax, si
call fcn.101199c2
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40de38
nop
mov ecx, 0x396168dc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x34565ed6
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40be90
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x6dded4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c05b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40beb9
mov eax, 0x7000000
jmp 0x40bec1
test eax, eax
je 0x40c036
mov dword [esp + 0x14], eax
mov ecx, dword [0x6dded4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call sym.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x6714a0]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40c04e
cmp edx, 0x21
jae 0x40c042
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call sym.runtime.int64tofloat64
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sym.runtime.uint64tofloat64
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x5b7478]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x5b74e0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40c011
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x5b7518]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicIndexU
mov eax, edx
mov ecx, 0x21
call sym.runtime.panicExtendIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.fastexprand
Function at 0x4142c0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x6dded4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4144ce
sub esp, 0x18
mov eax, dword [0x6dddf4]
test eax, eax
jne 0x4144b7
nop
nop
lea eax, [0x6ddde4]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x6ddde8]
test eax, eax
je 0x414308
cmp dword [eax + 8], 0xcc
jne 0x41437e
mov edx, dword [0x6dddec]
test edx, edx
jne 0x414360
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x6e25b0]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x6dddec], eax
mov ecx, dword [0x6dddf0]
mov dword [eax], ecx
mov eax, dword [0x6dddec]
mov dword [0x6dddf0], eax
movzx eax, byte [0x6de280]
test al, al
jne 0x414360
xor eax, eax
jmp 0x414488
mov edx, dword [0x6dddec]
mov ebx, dword [edx + 4]
mov dword [0x6dddec], ebx
mov ebx, dword [0x6ddde8]
mov dword [edx + 4], ebx
mov dword [0x6ddde8], edx
mov edx, dword [0x6ddde8]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x414467
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime_internal_atomic.Xadd
mov eax, dword [0x6ddfe0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x4143c8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x4143de
call sym.runtime.gcWriteBarrier2
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x6ddfe0]
test eax, eax
jne 0x414402
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x414430
call sym.runtime.gcWriteBarrier6
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x6ddde4]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x6ddde0]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.runtime_internal_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x66d3c4]
movzx ebx, byte [edx + eax]
lea ebp, [0x6de280]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x414360
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x414471
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x5878f3]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer
Function at 0x421fc0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x6dded4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4220a8
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x4220a2
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call sym.runtime._atomicScavChunkData_.load
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call sym.runtime._scavChunkData_.alloc
movzx eax, byte [esp + 0x18]
test al, 2
je 0x422056
cmp word [esp + 0x10], 0x1f0
jbe 0x422056
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x42209d
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call sym.runtime._atomicScavChunkData_.store
add esp, 0x1c
ret
call sym.runtime.panicIndexU
call sym.runtime.panicIndexU
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime._scavengeIndex_.alloc