joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4338c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x433b70
push rbp
mov rbp, rsp
sub rsp, 0x68
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x00596fa0]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x4339ee
jne 0x433953
cmp dword [rsp + 0x4c], 0
nop
jne 0x433953
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x4339ee
mov rax, qword [0x00596f98]
mov rcx, qword [r14 + 0x30]
movups xmmword [rcx + 0x3c0], xmm15
call sym.runtime.stdcall
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x0061cfaa]
mov ebx, 0x20
mov ecx, 0x21
call sym.runtime.readRandom
cmp rax, 0x20
je 0x4339b2
lea rax, [0x0061cfaa]
mov ebx, 0x20
mov ecx, 0x21
call sym.runtime.readTimeRandom
mov rcx, qword [0x0061c108]
nop dword [rax]
cmp rcx, 0x105
ja 0x433b65
mov qword [rsp + 0x58], rcx
lea rax, [0x0061cdc0]
lea rbx, [0x0061c7a0]
call sym.runtime.memmove
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x433a00
add rsp, 0x68
pop rbp
ret
mov byte [rdx + rbx + 1], dil
inc rax
nop dword [rax]
cmp rax, 0x20
jge 0x433a6e
lea rdx, [rcx + rax*2]
lea rbx, [0x0061cdc0]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x004da465]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x433b57
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x4339f4
jmp 0x433b4a
lea rdx, [rcx + 0x40]
jmp 0x433a82
lea rbx, [0x0061cdc0]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x433a99
cmp rdx, 0x20b
jb 0x433a74
jmp 0x433b3d
mov rax, qword [sym.imp.kernel32.dll_CreateFileA]
lea rcx, [0x0061cdc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call sym.runtime.stdcall7.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x433b30
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call sym.runtime.printlock
lea rax, [0x004e2d98]
mov ebx, 0x5f
nop
call sym.runtime.printstring
call sym.runtime.printunlock
add rsp, 0x68
pop rbp
ret
mov byte [0x0061bfe9], 1
add rsp, 0x68
pop rbp
ret
mov rax, rdx
mov ecx, 0x20b
call sym.runtime.panicIndex
mov rax, rsi
mov ecx, 0x20b
call sym.runtime.panicIndex
mov rax, rdx
mov ecx, 0x20b
nop
call sym.runtime.panicIndex
mov edx, 0x105
call sym.runtime.panicSliceAlenU
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.initLongPathSupport
Function at 0x438280
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4383c7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x10], r14
cmp qword [0x005b49e8], 0
nop
jne 0x4382bd
call sym.runtime.printlock
lea rax, [0x004e1863]
mov ebx, 0x2e
call sym.runtime.printstring
call sym.runtime.printunlock
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
jge 0x4382e3
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x438372
cmp edx, 1
je 0x438341
cmp edx, 2
jne 0x43832f
mov dword [rcx + 0xdc], 3
call sym.runtime.printlock
lea rax, [0x004dccb7]
mov ebx, 0x18
call sym.runtime.printstring
nop
call sym.runtime.printunlock
mov eax, 4
call sym.runtime.exit
mov eax, 5
call sym.runtime.exit
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov dword [rcx + 0xdc], 2
call sym.runtime.printlock
lea rax, [0x004db2e6]
mov ebx, 0x13
nop dword [rax]
call sym.runtime.printstring
call sym.runtime.printunlock
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov dword [rcx + 0xdc], 1
nop
mov ecx, 1
lea rdx, [0x0061c030]
lock xadd dword [rdx], ecx
nop
nop
lea rax, [0x0061c128]
call sym.runtime.lock2
cmp dword [0x0061c5bc], 0
jg 0x4383ad
cmp dword [0x0061c5b8], 0
jle 0x4383b7
mov eax, 1
call sym.runtime.schedtrace
call sym.runtime.freezetheworld
mov eax, 1
add rsp, 0x18
pop rbp
ret
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.startpanic_m
Function at 0x43b3a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43b64b
push rbp
mov rbp, rsp
sub rsp, 0x28
nop
mov qword [0x0061c430], 0xf
nop
mov qword [0x0061c470], 0x10
mov qword [rsp + 0x20], r14
mov dword [0x005985d8], 0x2710
lea rax, [0x0061c360]
call sym.runtime._ticksType_.init
lea rax, [0x00589480]
jmp 0x43b404
mov qword [rsp + 0x18], rax
call sym.runtime.moduledataverify1
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx + 0x248]
test rax, rax
jne 0x43b3ee
xor eax, eax
jmp 0x43b42a
mov rcx, rax
shl rcx, 6
lea rdx, [0x0061c680]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 8]
inc rax
movups xmmword [rcx], xmm15
cmp rax, 2
jl 0x43b40d
xor eax, eax
jmp 0x43b44c
mov rcx, rax
shl rcx, 4
lea rdx, [0x0061cfe8]
add rcx, rdx
inc rax
movups xmmword [rcx], xmm15
cmp rax, 0x23
jl 0x43b434
call sym.runtime.mallocinit
nop
xor eax, eax
xor ebx, ebx
nop dword [rax]
call sym.internal_cpu.Initialize
movzx eax, byte [0x0061c74d]
mov byte [0x0061bfee], al
movzx eax, byte [0x0061c752]
mov byte [0x0061bfef], al
movzx eax, byte [0x0061c74a]
mov byte [0x0061bff0], al
call sym.runtime.randinit
call sym.runtime.alginit
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
call sym.runtime.mcommoninit
call sym.runtime.modulesinit
call sym.runtime.typelinksinit
call sym.runtime.itabsinit
nop dword [rax]
call sym.runtime.stkobjinit
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x30]
test byte [rax], al
call sym.runtime.goenvs
call sym.runtime.parsedebugvars
call sym.runtime.gcinit
mov eax, 0x4000
call sym.runtime.stackalloc
mov qword [0x005979c0], rax
mov qword [0x005979c8], rbx
add rax, 0x3e8
mov qword [0x005979d0], rax
mov qword [0x005979d8], rax
cmp byte [0x0058f4a0], 0
je 0x43b51f
mov qword [0x005882c8], 0
nop
nop
lea rax, [0x005985b8]
call sym.runtime.lock2
nop
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp]
nop
lea rdx, [0x005985a8]
xchg qword [rdx], rcx
mov ecx, dword [0x0061c04c]
mov dword [rsp + 0x14], ecx
lea rax, [0x004d907e]
mov ebx, 0xa
call sym.runtime.gogetenv
call sym.runtime.atoi64
movsxd rcx, eax
cmp rax, rcx
sete cl
mov edx, 0
cmove edx, eax
and ecx, ebx
test cl, cl
je 0x43b58f
test edx, edx
jg 0x43b593
mov edx, dword [rsp + 0x14]
mov eax, edx
call sym.runtime.procresize
nop word [rax + rax]
test rax, rax
jne 0x43b639
nop
nop
lea rax, [0x005985b8]
call sym.runtime.unlock2
cmp qword [0x0058f848], 0
nop
jne 0x43b5f6
mov qword [0x0058f848], 7
cmp dword [0x0061c240], 0
je 0x43b5e8
mov rax, qword [str.go1.22.3]
nop dword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rax
lea rax, [0x004d89e1]
mov qword [str.go1.22.3], rax
cmp qword [0x0058f908], 1
nop
jne 0x43b633
mov qword [0x0058f908], 0
cmp dword [0x0061c240], 0
je 0x43b628
mov rax, qword [0x0058f900]
nop dword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rax
mov qword [0x0058f900], 0
add rsp, 0x28
pop rbp
ret
lea rax, [0x004e11f0]
mov ebx, 0x2b
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.schedinit
Function at 0x43e180
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov byte [rsp + 0x40], al
cmp byte [0x0061bfed], 0
jne 0x43e1b6
nop
mov eax, 2
lea rbx, [0x004e0f9a]
mov ecx, 0x2a
call sym.runtime.write
mov eax, 1
call sym.runtime.exit
call sym.runtime.getExtraM
mov qword [rsp + 0x28], rax
mov byte [rax + 0xf0], bl
mov qword [rsp], rax
call sym.runtime.osSetupTLS.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp], rcx
call sym.runtime.setg.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rbx, [rsp + 0x40]
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x40]
call sym.runtime.callbackUpdateSystemStack
mov rax, qword [rsp + 0x28]
mov byte [rax + 0xea], 0
call sym.runtime.asminit.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax + rax]
call sym.runtime.minit
movzx eax, byte [rsp + 0x40]
test al, al
je 0x43e254
xor ebx, ebx
xor ecx, ecx
jmp 0x43e278
mov rdx, qword [0x0061bfb0]
nop dword [rax + rax]
test rdx, rdx
jne 0x43e26b
xor ebx, ebx
xor ecx, ecx
jmp 0x43e278
call sym.runtime.traceAcquireEnabled
mov rcx, rax
movzx eax, byte [rsp + 0x40]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx + 0x90]
mov ebx, 6
mov ecx, 3
call sym.runtime.casgstatus
nop
mov edx, 0xffffffff
lea rsi, [0x005985e8]
lock xadd dword [rsi], edx
movzx edx, byte [rsp + 0x40]
test dl, dl
jne 0x43e31c
mov rbx, qword [rsp + 0x18]
nop dword [rax]
test rbx, rbx
je 0x43e31c
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdx + 0x90]
mov rax, qword [rsp + 0x20]
call sym.runtime.traceLocker.GoCreateSyscall
nop
mov edx, 1
mov rsi, qword [rsp + 0x20]
lock xadd qword [rsi + 0x398], rdx
mov edx, dword [rsi + 0xd8]
lea edi, [rdx - 1]
nop
mov dword [rsi + 0xd8], edi
nop
cmp edx, 1
jne 0x43e317
cmp byte [r14 + 0xb1], 0
je 0x43e317
mov qword [r14 + 0x10], 0xfffffffffffffade
movzx edx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x28]
mov byte [rax + 0xeb], dl
add rsp, 0x30
pop rbp
ret
Function at 0x43e940
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ea8f
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call sym.runtime.allocm
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43ea47
mov rcx, qword [rdx + 0x30]
test rcx, rcx
je 0x43ea47
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x230], 0
jne 0x43e9b5
cmp byte [rcx + 0xe8], 0
je 0x43ea47
nop
nop
lea rax, [0x0061c3c0]
nop
call sym.runtime.lock2
cmp dword [0x0061c3e0], 0
je 0x43ea7d
mov rcx, qword [0x0061c3c8]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x120], rcx
nop
mov qword [0x0061c3c8], rdx
cmp byte [0x0061c3d0], 0
je 0x43ea09
mov byte [0x0061c3d0], 0
lea rax, [0x0061c3d8]
call sym.runtime.notewakeup
nop
nop
lea rax, [0x0061c3c0]
call sym.runtime.unlock2
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43ea41
cmp byte [r14 + 0xb1], 0
je 0x43ea41
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x20
pop rbp
ret
call sym.runtime.newm1
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43ea77
cmp byte [r14 + 0xb1], 0
je 0x43ea77
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x20
pop rbp
ret
lea rax, [0x004e0fc4]
mov ebx, 0x2a
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.runtime.newm
Function at 0x43f660
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43f8bc
push rbp
mov rbp, rsp
sub rsp, 0x48
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x128]
nop dword [rax]
test rdx, rdx
je 0x43f8aa
mov rdx, qword [rdx + 0xd0]
cmp rdx, rcx
jne 0x43f8aa
mov qword [rsp + 0x38], r14
cmp qword [rcx + 0xa0], 0
je 0x43f6b2
call sym.runtime.releasep
call sym.runtime.handoffp
mov eax, 1
call sym.runtime.incidlelocked
mov qword [rsp + 0x30], r14
mov rax, qword [r14 + 0x30]
test byte [rax], al
add rax, 0x110
nop
call sym.runtime.notesleep
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x110], 0
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x128]
mov edx, dword [rdx + 0x90]
mov ebx, edx
and edx, 0xffffefff
cmp edx, 1
jne 0x43f734
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call sym.runtime.acquirep
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
add rsp, 0x48
pop rbp
ret
mov dword [rsp + 0x14], ebx
call sym.runtime.printlock
lea rax, [0x004e1246]
mov ebx, 0x2b
call sym.runtime.printstring
mov eax, dword [rsp + 0x14]
mov eax, eax
call sym.runtime.printuint
lea rax, [0x004dfed6]
mov ebx, 0x24
call sym.runtime.printstring
call sym.runtime.printunlock
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x128]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call sym.runtime.printlock
lea rax, [0x004dad9d]
mov ebx, 0x12
call sym.runtime.printstring
mov rax, qword [rsp + 0x40]
nop dword [rax]
call sym.runtime.printpointer
lea rax, [0x004d8a19]
mov ebx, 7
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004db1dc]
mov ebx, 0x13
call sym.runtime.printstring
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call sym.runtime.printlock
lea rax, [0x004dadaf]
mov ebx, 0x12
nop
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
call sym.runtime.printpointer
lea rax, [0x004d8a19]
mov ebx, 7
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x18]
call sym.runtime.printuint
lea rax, [0x004db2f9]
mov ebx, 0x13
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x20]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004dd100]
mov ebx, 0x19
call sym.runtime.throw
lea rax, [0x004df53e]
mov ebx, 0x21
call sym.runtime.throw
nop
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.stoplockedm
Function at 0x447c60
Capabilities:
Encode data using base64
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x447dc7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x447c72
cmp edx, ecx
jne 0x447db5
nop word [rax + rax]
test rsi, rsi
jne 0x447db5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x447cd4
nop
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061c200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call sym.runtime.updateTimerPMask
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x447db0
mov rdx, qword [0x005973b8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x447da5
mov rcx, qword [0x005973b0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x005985f0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x005985f0], rax
nop
mov edx, 1
lea rsi, [0x005985f8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x447d93
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004e0ac3]
mov ebx, 0x28
nop
call sym.runtime.throw
mov rax, rsi
mov rcx, rdx
call sym.runtime.panicIndex
call sym.runtime.panicshift
lea rax, [0x004dfb59]
mov ebx, 0x23
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.pidleput
Function at 0x44d360
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x48], r14
mov edx, dword [0x0061c030]
test edx, edx
je 0x44d39a
mov eax, 2
call sym.runtime.exit
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
nop
mov ecx, 1
lea rdx, [0x0061c030]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x40], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x38], rsi
mov rdi, qword [rax + 0x28]
mov qword [rsp + 0x30], rdi
mov r8, qword [rbx + 0xf8]
mov qword [rsp + 0x28], r8
call sym.runtime.printlock
lea rax, [0x004d91c8]
mov ebx, 0xa
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x40]
call sym.runtime.printhex
call sym.runtime.printsp
mov rax, qword [rsp + 0x38]
call sym.runtime.printhex
nop
call sym.runtime.printsp
mov rax, qword [rsp + 0x30]
call sym.runtime.printhex
call sym.runtime.printsp
mov rax, qword [rsp + 0x28]
call sym.runtime.printhex
nop
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x28], rcx
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004d84bf]
mov ebx, 3
call sym.runtime.printstring
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x44d4f7
mov rdx, qword [rsp + 0x78]
cmp qword [rcx], rdx
jne 0x44d4f2
cmp qword [rcx + 0x90], 0
je 0x44d4ed
cmp byte [0x0061bfec], 0
je 0x44d4e0
nop
call sym.runtime.printlock
lea rax, [0x004e18bf]
mov ebx, 0x2e
call sym.runtime.printstring
call sym.runtime.printunlock
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x44d4fc
mov rcx, rdx
jmp 0x44d4fc
mov rcx, rdx
jmp 0x44d4fc
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rcx
call sym.runtime.printlock
call sym.runtime.printnl
call sym.runtime.printunlock
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 2
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
mov qword [rax + 0x98], rcx
mov eax, dword [0x00588270]
mov rcx, qword [r14 + 0x30]
movzx edx, byte [rcx + 0xf1]
test dl, dl
jne 0x44d560
mov edx, eax
shr edx, 2
cmp dword [rcx + 0xc4], 2
mov esi, 2
cmovae edx, esi
nop
test edx, edx
jle 0x44d59d
mov dword [rsp + 0x24], eax
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
xor ecx, ecx
nop dword [rax]
call sym.runtime.tracebacktrap
mov rax, qword [rsp + 0x50]
call sym.runtime.tracebackothers
mov rax, qword [rsp + 0x70]
call sym.runtime.dumpregs
mov eax, dword [rsp + 0x24]
bt eax, 0
jae 0x44d5b2
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
call sym.runtime.dieFromException
mov eax, 2
call sym.runtime.exit
add rsp, 0x58
pop rbp
ret
Function at 0x44d5e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44d846
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x18], r14
call sym.runtime.canpanic
nop dword [rax]
test al, al
je 0x44d830
mov rcx, qword [rsp + 0x18]
mov edx, dword [rcx + 0xd8]
cmp edx, 0xc0000091
ja 0x44d7e0
lea esi, [rdx + 0x3ffffffb]
cmp esi, 1
ja 0x44d787
mov rax, qword [rcx + 0x100]
nop word [rax + rax]
nop
cmp rax, 0x1000
jb 0x44d756
cmp byte [rcx + 0xb5], 0
jne 0x44d6f1
call fcn.004053c0
nop
test al, al
je 0x44d6b0
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x100]
mov qword [rsp + 0x10], rax
call sym.runtime.printlock
lea rax, [0x004dff1e]
mov ebx, 0x24
call sym.runtime.printstring
mov rax, qword [rsp + 0x10]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d8792]
mov ebx, 5
call sym.runtime.throw
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x100]
mov qword [rsp + 0x10], rax
call sym.runtime.printlock
lea rax, [0x004dd17d]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x10]
nop dword [rax]
call sym.runtime.printhex
call sym.runtime.printnl
call sym.runtime.printunlock
jmp 0x44d69f
mov qword [rsp + 0x10], rax
nop
lea rax, [0x004e1d8b]
mov ebx, 0x31
call sym.runtime.panicCheck2
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x28], xmm15
lea rcx, [0x004e1d8b]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0x31
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x30], rcx
lea rax, [0x004cce00]
lea rbx, [rsp + 0x20]
call sym.runtime.convT
mov rbx, rax
lea rax, [0x004cce00]
call sym.runtime.gopanic
nop
lea rax, [0x004e1d8b]
mov ebx, 0x31
call sym.runtime.panicCheck2
mov rcx, qword [0x0058f8f0]
test rcx, rcx
je 0x44d778
mov rcx, qword [rcx + 8]
mov rbx, qword [0x0058f8f8]
mov rax, rcx
call sym.runtime.gopanic
lea ecx, [rdx + 0x3fffff73]
cmp ecx, 2
ja 0x44d7c5
nop
lea rax, [0x004db6a1]
mov ebx, 0x14
nop
call sym.runtime.panicCheck2
mov rcx, qword [0x0058f8e0]
test rcx, rcx
je 0x44d7b5
mov rcx, qword [rcx + 8]
mov rbx, qword [0x0058f8e8]
mov rax, rcx
nop
call sym.runtime.gopanic
cmp edx, 0xc0000091
je 0x44d792
lea rax, [0x004d8792]
mov ebx, 5
call sym.runtime.throw
nop
cmp edx, 0xc0000093
je 0x44d792
cmp edx, 0xc0000094
je 0x44d829
cmp edx, 0xc0000095
jne 0x44d7cd
nop
lea rax, [0x004da4e5]
mov ebx, 0x10
call sym.runtime.panicCheck2
mov rcx, qword [0x0058f8d0]
test rcx, rcx
je 0x44d81a
mov rcx, qword [rcx + 8]
mov rbx, qword [0x0058f8d8]
mov rax, rcx
call sym.runtime.gopanic
call sym.runtime.panicdivide
jmp 0x44d7cd
lea rax, [0x004e0fee]
mov ebx, 0x2a
nop dword [rax]
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.sigpanic
Function at 0x451720
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x451826
push rbp
mov rbp, rsp
sub rsp, 0x130
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046918b
mov rbp, qword [rbp]
lea rcx, [0x004cd280]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
nop dword [rax + rax]
test dl, 0x40
jne 0x451813
lea rdx, [0x0061c270]
lea rax, [0x00589480]
jmp 0x4517a0
mov rax, qword [rax + 0x248]
test rax, rax
je 0x4517b9
cmp qword [rax + 0x140], rdx
ja 0x451799
cmp qword [rax + 0x110], rdx
jbe 0x451799
jmp 0x4517c0
xor eax, eax
nop dword [rax + rax]
test rax, rax
je 0x451802
mov rdx, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x138]
lea rax, [rdx + 7]
and rax, 0xfffffffffffffff8
neg eax
mov dword [0x0061c270], eax
mov dword [0x0061c274], edx
mov dword [0x0061c278], ebx
mov dword [0x0061c27c], ecx
add rsp, 0x130
pop rbp
ret
lea rax, [0x004e1271]
mov ebx, 0x2b
call sym.runtime.throw
lea rax, [0x004e28dc]
mov ebx, 0x3d
nop
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.runtime.stkobjinit

Function at 0x4529e0
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x18
nop
mov eax, 2
lea rbx, [0x004e20d7]
mov ecx, 0x33
call sym.runtime.write
add rsp, 0x18
pop rbp
ret