Similarity

004317f0
004317f0github.com/bishopfox/sliver/implant/sliver/netstat.(*procFd).iterFdDir: ; void github.com/bishopfox/sliver/implant/sliver/netstat.(*procFd).iterFdDir(github.com/bishopfox/sliver/implant/sliver/netstat.procFd * p)
004317f0ldr x16, [x28+16]
004317f4sub x17, sp, 688
004317f8subs xzr, x17, x16
004317fcb.ls 0x431fbc
00431800sub x20, sp, 816
00431804stp x29, x30, [x20-8]
00431808add sp, x20, 0
0043180csub x29, sp, 8
00431810str x0, [sp+824]
00431814add x27, sp, 696
00431818stp xzr, xzr, [x27]
0043181cadd x27, sp, 712
00431820stp xzr, xzr, [x27]
00431824add x3, sp, 696
00431828str x3, [sp+552]
0043182cldrsb x27, [x3]
00431830ldr x4, [sp+824]
00431834ldrsb x27, [x4]
00431838ldr x5, [x4]
0043183cldr x4, [x4+8]
00431840str x4, [x3+8]
00431844adrp x27, 0x61a000
00431848ldr w4, [x27+3056]
0043184ccbz w4, 0x431854
00431850b 0x431858
00431854
00431854loc_431854:
00431854b 0x43186c
00431858
00431858loc_431858:
00431858bl runtime.gcWriteBarrier2
0043185cstr x5, [x25]
00431860ldr x4, [x3]
00431864str x4, [x25+8]
00431868b 0x43186c
0043186c
0043186cloc_43186c:
0043186cstr x5, [x3]
00431870ldrsb x27, [x3]
00431874orr x4, xzr, 3
00431878str x4, [x3+24]
0043187cadrp x27, 0x61a000
00431880ldr w5, [x27+3056]
00431884cbz w5, 0x43188c
00431888b 0x431890
0043188c
0043188cloc_43188c:
0043188cb 0x4318a0
00431890
00431890loc_431890:
00431890ldr x5, [x3+16]
00431894bl runtime.gcWriteBarrier1
00431898str x5, [x25]
0043189cb 0x4318a0
004318a0
004318a0loc_4318a0:
004318a0adrp x5, 0x27f000
004318a4add x5, x5, 549
004318a8str x5, [x3+16]
004318acldr x0, [sp+552]
004318b0ldrsb x27, [x0]
004318b4b 0x4318b8
004318b8
004318b8loc_4318b8:
004318b8str x0, [sp+560]
004318bcorr x2, xzr, 2
004318c0str x2, [sp+568]
004318c4str x2, [sp+576]
004318c8mov x1, x2
004318ccbl path.Join
004318d0str x0, [sp+304]
004318d4str x1, [sp+312]
004318d8str xzr, [sp+672]
004318dcadd x27, sp, 680
004318e0stp xzr, xzr, [x27]
004318e4add x27, sp, 656
004318e8stp xzr, xzr, [x27]
004318ecldr x0, [sp+304]
004318f0ldr x1, [sp+312]
004318f4bl os.ReadDir
004318f8str x0, [sp+672]
004318fcstr x1, [sp+680]
00431900str x2, [sp+688]
00431904str x3, [sp+656]
00431908str x4, [sp+664]
0043190cldr x3, [sp+680]
00431910ldr x4, [sp+688]
00431914ldr x5, [sp+672]
00431918str x5, [sp+496]
0043191cstr x3, [sp+504]
00431920str x4, [sp+512]
00431924ldr x3, [sp+656]
00431928ldr x4, [sp+664]
0043192cstr x3, [sp+392]
00431930str x4, [sp+400]
00431934ldr x3, [sp+496]
00431938ldr x4, [sp+504]
0043193cldr x5, [sp+512]
00431940str x3, [sp+280]
00431944str x4, [sp+288]
00431948str x5, [sp+296]
0043194cldr x3, [sp+400]
00431950ldr x4, [sp+392]
00431954str x4, [sp+368]
00431958str x3, [sp+376]
0043195ccbnz x4, 0x431964
00431960b 0x431970
00431964
00431964loc_431964:
00431964ldp x29, x30, [sp-8]
00431968add sp, sp, 816
0043196cret x30
00431970
00431970loc_431970:
00431970adrp x0, 0x1cd000
00431974add x0, x0, 1216
00431978bl runtime.newobject
0043197cstr x0, [sp+800]
00431980mov x20, x0
00431984adr x27, 16
00431988stp x29, x27, [sp-24]
0043198csub x29, sp, 24
00431990bl fn_87cf0
00431994sub x29, sp, 8
00431998ldr x1, [sp+288]
0043199cldr x2, [sp+280]
004319a0ldr x3, [sp+296]
004319a4str x2, [sp+672]
004319a8str x1, [sp+680]
004319acstr x3, [sp+688]
004319b0str xzr, [sp+152]
004319b4str x1, [sp+144]
004319b8ldr x1, [sp+672]
004319bcstr x1, [sp+136]
004319c0b 0x4319c4
004319c4
004319c4loc_4319c4:
004319c4ldr x1, [sp+144]
004319c8ldr x2, [sp+152]
004319ccsubs xzr, x1, x2
004319d0b.gt 0x4319d8
004319d4b 0x431b54
004319d8
004319d8loc_4319d8:
004319d8ldr x1, [sp+136]
004319dcstr x1, [sp+544]
004319e0ldr x1, [sp+544]
004319e4ldr x2, [x1]
004319e8ldr x0, [x1+8]
004319ecstr x2, [sp+264]
004319f0str x0, [sp+272]
004319f4ldrsb x27, [x2]
004319f8ldr x1, [x2+40]
004319fcblr x1
00431a00str x0, [sp+640]
00431a04str x1, [sp+648]
00431a08add x27, sp, 696
00431a0cstp xzr, xzr, [x27]
00431a10add x27, sp, 712
00431a14stp xzr, xzr, [x27]
00431a18add x1, sp, 696
00431a1cstr x1, [sp+488]
00431a20ldrsb x27, [x1]
00431a24ldr x2, [sp+304]
00431a28ldr x3, [sp+312]
00431a2cstr x3, [x1+8]
00431a30adrp x27, 0x61a000
00431a34ldr w3, [x27+3056]
00431a38cbz w3, 0x431a40
00431a3cb 0x431a44
00431a40
00431a40loc_431a40:
00431a40b 0x431a58
00431a44
00431a44loc_431a44:
00431a44bl runtime.gcWriteBarrier2
00431a48str x2, [x25]
00431a4cldr x3, [x1]
00431a50str x3, [x25+8]
00431a54b 0x431a58
00431a58
00431a58loc_431a58:
00431a58str x2, [x1]
00431a5cldrsb x27, [x1]
00431a60ldr x3, [sp+640]
00431a64ldr x4, [sp+648]
00431a68str x4, [x1+24]
00431a6cadrp x27, 0x61a000
00431a70ldr w4, [x27+3056]
00431a74cbz w4, 0x431a7c
00431a78b 0x431a80
00431a7c
00431a7cloc_431a7c:
00431a7cb 0x431a94
00431a80
00431a80loc_431a80:
00431a80bl runtime.gcWriteBarrier2
00431a84str x3, [x25]
00431a88ldr x4, [x1+16]
00431a8cstr x4, [x25+8]
00431a90b 0x431a94
00431a94
00431a94loc_431a94:
00431a94str x3, [x1+16]
00431a98ldr x0, [sp+488]
00431a9cldrsb x27, [x0]
00431aa0b 0x431aa4
00431aa4
00431aa4loc_431aa4:
00431aa4str x0, [sp+520]
00431aa8orr x2, xzr, 2
00431aacstr x2, [sp+528]
00431ab0str x2, [sp+536]
00431ab4mov x1, x2
00431ab8bl path.Join
00431abcstr x0, [sp+320]
00431ac0str x1, [sp+328]
00431ac4add x27, sp, 640
00431ac8stp xzr, xzr, [x27]
00431accadd x27, sp, 656
00431ad0stp xzr, xzr, [x27]
00431ad4ldr x0, [sp+320]
00431ad8ldr x1, [sp+328]
00431adcbl os.Readlink
00431ae0str x0, [sp+640]
00431ae4str x1, [sp+648]
00431ae8str x2, [sp+656]
00431aecstr x3, [sp+664]
00431af0ldr x3, [sp+648]
00431af4ldr x4, [sp+640]
00431af8str x4, [sp+784]
00431afcstr x3, [sp+792]
00431b00ldr x3, [sp+656]
00431b04ldr x4, [sp+664]
00431b08str x3, [sp+768]
00431b0cstr x4, [sp+776]
00431b10ldr x3, [sp+784]
00431b14ldr x4, [sp+792]
00431b18str x3, [sp+248]
00431b1cstr x4, [sp+256]
00431b20ldr x3, [sp+776]
00431b24ldr x4, [sp+768]
00431b28str x4, [sp+352]
00431b2cstr x3, [sp+360]
00431b30cbnz x4, 0x431b38
00431b34b 0x431b3c
00431b38
00431b38loc_431b38:
00431b38b 0x431f88
00431b3c
00431b3cloc_431b3c:
00431b3cstr xzr, [sp+128]
00431b40ldr x7, [sp+824]
00431b44ldrsb x27, [x7]
00431b48ldr x7, [x7+32]
00431b4cstr x7, [sp+120]
00431b50b 0x431b60
00431b54
00431b54loc_431b54:
00431b54ldp x29, x30, [sp-8]
00431b58add sp, sp, 816
00431b5cret x30
00431b60
00431b60loc_431b60:
00431b60ldr x7, [sp+120]
00431b64ldr x8, [sp+128]
00431b68subs xzr, x7, x8
00431b6cb.gt 0x431b74
00431b70b 0x431f84
00431b74
00431b74loc_431b74:
00431b74ldr x0, [sp+128]
00431b78str x0, [sp+112]
00431b7cldr x7, [sp+824]
00431b80ldrsb x27, [x7]
00431b84ldr x1, [x7+32]
00431b88ldr x7, [x7+24]
00431b8csubs xzr, x1, x0
00431b90b.hi 0x431b98
00431b94b 0x431fb4
00431b98
00431b98loc_431b98:
00431b98sub x8, x0, x0, lsl #2
00431b9csub x7, x7, x8, lsl #4
00431ba0str x7, [sp+224]
00431ba4ldrsb x27, [x7]
00431ba8ldr x3, [x7]
00431bacldr x4, [x7+8]
00431bb0str x3, [sp+472]
00431bb4str x4, [sp+480]
00431bb8adrp x27, 0x5dc000
00431bbcldr x1, [x27+2816]
00431bc0adrp x27, 0x5dc000
00431bc4ldr x2, [x27+2824]
00431bc8add x0, sp, 72
00431bccadrp x5, 0x2df000
00431bd0add x5, x5, 3144
00431bd4orr x6, xzr, 1
00431bd8bl runtime.concatstring3
00431bdcstr x0, [sp+208]
00431be0str x1, [sp+216]
00431be4ldr x7, [sp+256]
00431be8subs xzr, x1, x7
00431becb.ne 0x431bf4
00431bf0b 0x431bf8
00431bf4
00431bf4loc_431bf4:
00431bf4b 0x431f70
00431bf8
00431bf8loc_431bf8:
00431bf8ldr x3, [sp+248]
00431bfcmov x2, x1
00431c00mov x1, x3
00431c04bl runtime.memequal
00431c08tbnz w0, 0, 0x431c10
00431c0cb 0x431f6c
00431c10
00431c10loc_431c10:
00431c10ldr x7, [sp+824]
00431c14ldrsb x27, [x7]
00431c18ldr x7, [x7+48]
00431c1ccbnz x7, 0x431c24
00431c20b 0x431c28
00431c24
00431c24loc_431c24:
00431c24b 0x431f28
00431c28
00431c28loc_431c28:
00431c28add x27, sp, 696
00431c2cstp xzr, xzr, [x27]
00431c30add x27, sp, 712
00431c34stp xzr, xzr, [x27]
00431c38add x3, sp, 696
00431c3cstr x3, [sp+440]
00431c40ldrsb x27, [x3]
00431c44ldr x4, [sp+824]
00431c48ldrsb x27, [x4]
00431c4cldr x5, [x4]
00431c50ldr x4, [x4+8]
00431c54str x4, [x3+8]
00431c58adrp x27, 0x61a000
00431c5cldr w4, [x27+3056]
00431c60cbz w4, 0x431c68
00431c64b 0x431c6c
00431c68
00431c68loc_431c68:
00431c68b 0x431c80
00431c6c
00431c6cloc_431c6c:
00431c6cbl runtime.gcWriteBarrier2
00431c70str x5, [x25]
00431c74ldr x4, [x3]
00431c78str x4, [x25+8]
00431c7cb 0x431c80
00431c80
00431c80loc_431c80:
00431c80str x5, [x3]
00431c84ldrsb x27, [x3]
00431c88orr x4, xzr, 4
00431c8cstr x4, [x3+24]
00431c90adrp x27, 0x61a000
00431c94ldr w5, [x27+3056]
00431c98cbz w5, 0x431ca0
00431c9cb 0x431ca4
00431ca0
00431ca0loc_431ca0:
00431ca0b 0x431cb4
00431ca4
00431ca4loc_431ca4:
00431ca4ldr x5, [x3+16]
00431ca8bl runtime.gcWriteBarrier1
00431cacstr x5, [x25]
00431cb0b 0x431cb4
00431cb4
00431cb4loc_431cb4:
00431cb4adrp x5, 0x27f000
00431cb8add x5, x5, 746
00431cbcstr x5, [x3+16]
00431cc0ldr x0, [sp+440]
00431cc4ldrsb x27, [x0]
00431cc8b 0x431ccc
00431ccc
00431cccloc_431ccc:
00431cccstr x0, [sp+448]
00431cd0orr x2, xzr, 2
00431cd4str x2, [sp+456]
00431cd8str x2, [sp+464]
00431cdcmov x1, x2
00431ce0bl path.Join
00431ce4str x0, [sp+640]
00431ce8str x1, [sp+648]
00431cecstr xzr, [sp+632]
00431cf0add x27, sp, 656
00431cf4stp xzr, xzr, [x27]
00431cf8ldr x0, [sp+640]
00431cfcldr x1, [sp+648]
00431d00bl os.Open
00431d04str x0, [sp+632]
00431d08str x1, [sp+656]
00431d0cstr x2, [sp+664]
00431d10ldr x3, [sp+632]
00431d14str x3, [sp+760]
00431d18ldr x3, [sp+656]
00431d1cldr x4, [sp+664]
00431d20str x3, [sp+744]
00431d24str x4, [sp+752]
00431d28ldr x3, [sp+760]
00431d2cstr x3, [sp+200]
00431d30ldr x3, [sp+752]
00431d34ldr x4, [sp+744]
00431d38str x4, [sp+336]
00431d3cstr x3, [sp+344]
00431d40cbnz x4, 0x431d48
00431d44b 0x431d54
00431d48
00431d48loc_431d48:
00431d48ldp x29, x30, [sp-8]
00431d4cadd sp, sp, 816
00431d50ret x30
00431d54
00431d54loc_431d54:
00431d54ldr x4, [sp+800]
00431d58ldrsb x27, [x4]
00431d5cb 0x431d60
00431d60
00431d60loc_431d60:
00431d60str x4, [sp+608]
00431d64orr x4, xzr, 128
00431d68str x4, [sp+616]
00431d6cstr x4, [sp+624]
00431d70add x27, sp, 656
00431d74stp xzr, xzr, [x27]
00431d78ldr x0, [sp+200]
00431d7cldr x1, [sp+608]
00431d80ldr x2, [sp+616]
00431d84ldr x3, [sp+624]
00431d88bl os.(*File).Read
00431d8cstr x0, [sp+160]
00431d90str x1, [sp+656]
00431d94str x2, [sp+664]
00431d98ldr x4, [sp+160]
00431d9cstr x4, [sp+168]
00431da0str x1, [sp+728]
00431da4str x2, [sp+736]
00431da8ldr x4, [sp+168]
00431dacstr x4, [sp+104]
00431db0str x1, [sp+336]
00431db4str x2, [sp+344]
00431db8ldr x0, [sp+200]
00431dbcbl os.(*File).Close
00431dc0ldr x4, [sp+336]
00431dc4cbnz x4, 0x431dcc
00431dc8b 0x431dd8
00431dcc
00431dccloc_431dcc:
00431dccldp x29, x30, [sp-8]
00431dd0add sp, sp, 816
00431dd4ret x30
00431dd8
00431dd8loc_431dd8:
00431dd8ldr x1, [sp+104]
00431ddcldr x7, [sp+800]
00431de0ldrsb x27, [x7]
00431de4subs xzr, x1, 128
00431de8b.ls 0x431df0
00431decb 0x431fac
00431df0
00431df0loc_431df0:
00431df0b 0x431df4
00431df4
00431df4loc_431df4:
00431df4str x7, [sp+608]
00431df8str x1, [sp+616]
00431dfcorr x7, xzr, 128
00431e00str x7, [sp+624]
00431e04add x8, sp, 71
00431e08str x8, [sp+432]
00431e0cldrsb x27, [x8]
00431e10orr x9, xzr, 32
00431e14strb w9, [x8]
00431e18ldr x3, [sp+432]
00431e1cldrsb x27, [x3]
00431e20b 0x431e24
00431e24
00431e24loc_431e24:
00431e24str x3, [sp+584]
00431e28orr x5, xzr, 1
00431e2cstr x5, [sp+592]
00431e30str x5, [sp+600]
00431e34ldr x0, [sp+608]
00431e38ldr x1, [sp+616]
00431e3cldr x2, [sp+624]
00431e40mov x4, x5
00431e44orr x6, xzr, 3
00431e48bl bytes.SplitN
00431e4cstr x0, [sp+176]
00431e50str x1, [sp+184]
00431e54str x2, [sp+192]
00431e58subs xzr, x1, 1
00431e5cb.hi 0x431e64
00431e60b 0x431fa4
00431e64
00431e64loc_431e64:
00431e64ldr x3, [x0+24]
00431e68ldr x1, [x0+32]
00431e6cldr x2, [x0+40]
00431e70str x3, [sp+408]
00431e74str x1, [sp+416]
00431e78str x2, [sp+424]
00431e7cmov x0, x3
00431e80bl github.com/bishopfox/sliver/implant/sliver/netstat.getProcName
00431e84str x0, [sp+232]
00431e88str x1, [sp+240]
00431e8cadrp x0, 0x211000
00431e90add x0, x0, 2912
00431e94bl runtime.newobject
00431e98str x0, [sp+384]
00431e9cldr x3, [sp+824]
00431ea0ldrsb x27, [x3]
00431ea4ldr x3, [x3+16]
00431ea8str x3, [x0]
00431eacldr x3, [sp+384]
00431eb0ldrsb x27, [x3]
00431eb4ldr x4, [sp+232]
00431eb8ldr x5, [sp+240]
00431ebcstr x5, [x3+16]
00431ec0adrp x27, 0x61a000
00431ec4ldr w5, [x27+3056]
00431ec8cbz w5, 0x431ed0
00431eccb 0x431ed4
00431ed0
00431ed0loc_431ed0:
00431ed0b 0x431ee8
00431ed4
00431ed4loc_431ed4:
00431ed4bl runtime.gcWriteBarrier2
00431ed8str x4, [x25]
00431edcldr x7, [x3+8]
00431ee0str x7, [x25+8]
00431ee4b 0x431ee8
00431ee8
00431ee8loc_431ee8:
00431ee8str x4, [x3+8]
00431eecldr x7, [sp+824]
00431ef0ldrsb x27, [x7]
00431ef4ldr x8, [sp+384]
00431ef8adrp x27, 0x61a000
00431efcldr w9, [x27+3056]
00431f00cbz w9, 0x431f08
00431f04b 0x431f0c
00431f08
00431f08loc_431f08:
00431f08b 0x431f20
00431f0c
00431f0cloc_431f0c:
00431f0cbl runtime.gcWriteBarrier2
00431f10str x8, [x25]
00431f14ldr x9, [x7+48]
00431f18str x9, [x25+8]
00431f1cb 0x431f20
00431f20
00431f20loc_431f20:
00431f20str x8, [x7+48]
00431f24b 0x431f28
00431f28
00431f28loc_431f28:
00431f28ldr x7, [sp+224]
00431f2cldrsb x27, [x7]
00431f30ldr x8, [sp+824]
00431f34ldrsb x27, [x8]
00431f38ldr x8, [x8+48]
00431f3cadrp x27, 0x61a000
00431f40ldr w9, [x27+3056]
00431f44cbz w9, 0x431f4c
00431f48b 0x431f50
00431f4c
00431f4cloc_431f4c:
00431f4cb 0x431f64
00431f50
00431f50loc_431f50:
00431f50bl runtime.gcWriteBarrier2
00431f54str x8, [x25]
00431f58ldr x9, [x7+40]
00431f5cstr x9, [x25+8]
00431f60b 0x431f64
00431f64
00431f64loc_431f64:
00431f64str x8, [x7+40]
00431f68b 0x431f74
00431f6c
00431f6cloc_431f6c:
00431f6cb 0x431f70
00431f70
00431f70loc_431f70:
00431f70b 0x431f74
00431f74
00431f74loc_431f74:
00431f74ldr x7, [sp+128]
00431f78add x7, x7, 1
00431f7cstr x7, [sp+128]
00431f80b 0x431b60
00431f84
00431f84loc_431f84:
00431f84b 0x431f88
00431f88
00431f88loc_431f88:
00431f88ldr x1, [sp+152]
00431f8cadd x1, x1, 1
00431f90str x1, [sp+152]
00431f94ldr x1, [sp+544]
00431f98add x1, x1, 16
00431f9cstr x1, [sp+136]
00431fa0b 0x4319c4
00431fa4
00431fa4loc_431fa4:
00431fa4orr x0, xzr, 1
00431fa8bl runtime.panicIndex
00431fac
00431facloc_431fac:
00431facorr x2, xzr, 128
00431fb0bl runtime.panicSliceAlen
00431fb4
00431fb4loc_431fb4:
00431fb4bl runtime.panicIndex
00431fb8hint
00431fbc
00431fbcloc_431fbc:
00431fbcstr x0, [sp+8]
00431fc0mov x3, x30
00431fc4bl runtime.morestack_noctxt.abi0
00431fc8ldr x0, [sp+8]
00431fccb 0x4317f0
004317f0

00431fd0
00431fd0github.com/bishopfox/sliver/implant/sliver/netstat.extractProcInfo: ; void github.com/bishopfox/sliver/implant/sliver/netstat.extractProcInfo(struct []github.com/bishopfox/sliver/implant/sliver/netstat.SockTabEntry sktab)
00431fd0ldr x16, [x28+16]
00431fd4sub x17, sp, 368
00431fd8subs xzr, x17, x16
00431fdcb.ls 0x4322e0
00431fe0sub x20, sp, 496
00431fe4stp x29, x30, [x20-8]
00431fe8add sp, x20, 0
00431fecsub x29, sp, 8
00431ff0str x0, [sp+504]
00431ff4str x1, [sp+512]
00431ff8str x2, [sp+520]
00431ffcadrp x2, 0x27f000
00432000add x2, x2, 1757
00432004str x2, [sp+216]
00432008movz x2, 5
0043200cstr x2, [sp+224]
00432010str xzr, [sp+448]
00432014stp xzr, xzr, [sp+456]
00432018stp xzr, xzr, [sp+432]
0043201cldr x0, [sp+216]
00432020ldr x1, [sp+224]
00432024bl os.ReadDir
00432028str x0, [sp+448]
0043202cstr x1, [sp+456]
00432030str x2, [sp+464]
00432034str x3, [sp+432]
00432038str x4, [sp+440]
0043203cldr x2, [sp+456]
00432040ldr x3, [sp+464]
00432044ldr x4, [sp+448]
00432048str x4, [sp+264]
0043204cstr x2, [sp+272]
00432050str x3, [sp+280]
00432054ldr x2, [sp+432]
00432058ldr x3, [sp+440]
0043205cstr x2, [sp+248]
00432060str x3, [sp+256]
00432064ldr x2, [sp+264]
00432068ldr x3, [sp+272]
0043206cldr x4, [sp+280]
00432070str x2, [sp+160]
00432074str x3, [sp+168]
00432078str x4, [sp+176]
0043207cldr x2, [sp+256]
00432080ldr x3, [sp+248]
00432084str x3, [sp+200]
00432088str x2, [sp+208]
0043208ccbnz x3, 0x432094
00432090b 0x4320a0
00432094
00432094loc_432094:
00432094ldp x29, x30, [sp-8]
00432098add sp, sp, 496
0043209cret x30
004320a0
004320a0loc_4320a0:
004320a0ldr x1, [sp+168]
004320a4ldr x2, [sp+160]
004320a8ldr x3, [sp+176]
004320acstr x2, [sp+448]
004320b0str x1, [sp+456]
004320b4str x3, [sp+464]
004320b8str xzr, [sp+72]
004320bcstr x1, [sp+64]
004320c0ldr x1, [sp+448]
004320c4str x1, [sp+56]
004320c8b 0x4320cc
004320cc
004320ccloc_4320cc:
004320ccldr x1, [sp+64]
004320d0ldr x2, [sp+72]
004320d4subs xzr, x1, x2
004320d8b.gt 0x4320e0
004320dcb 0x4322d4
004320e0
004320e0loc_4320e0:
004320e0ldr x1, [sp+56]
004320e4str x1, [sp+376]
004320e8ldr x1, [sp+376]
004320ecldr x2, [x1]
004320f0ldr x0, [x1+8]
004320f4str x2, [sp+144]
004320f8str x0, [sp+152]
004320fcldrsb x27, [x2]
00432100ldr x1, [x2+32]
00432104blr x1
00432108strb w0, [sp+39]
0043210ctbnz w0, 0, 0x432114
00432110b 0x4322b4
00432114
00432114loc_432114:
00432114ldr x1, [sp+144]
00432118ldrsb x27, [x1]
0043211cldr x1, [x1+40]
00432120ldr x0, [sp+152]
00432124blr x1
00432128str x0, [sp+416]
0043212cstr x1, [sp+424]
00432130stp xzr, xzr, [sp+432]
00432134ldr x1, [sp+424]
00432138ldr x0, [sp+416]
0043213cbl strconv.Atoi
00432140str x0, [sp+80]
00432144str x1, [sp+432]
00432148str x2, [sp+440]
0043214cldr x3, [sp+80]
00432150str x3, [sp+48]
00432154str x1, [sp+472]
00432158str x2, [sp+480]
0043215cldr x3, [sp+48]
00432160str x3, [sp+40]
00432164str x1, [sp+184]
00432168str x2, [sp+192]
0043216ccbnz x1, 0x432174
00432170b 0x432178
00432174
00432174loc_432174:
00432174b 0x4322b8
00432178
00432178loc_432178:
00432178ldr x1, [sp+144]
0043217cldrsb x27, [x1]
00432180ldr x1, [x1+40]
00432184ldr x0, [sp+152]
00432188blr x1
0043218cstr x0, [sp+416]
00432190str x1, [sp+424]
00432194stp xzr, xzr, [sp+384]
00432198stp xzr, xzr, [sp+400]
0043219cadd x1, sp, 384
004321a0str x1, [sp+344]
004321a4ldrsb x27, [x1]
004321a8ldr x2, [sp+216]
004321acldr x3, [sp+224]
004321b0str x3, [x1+8]
004321b4adrp x27, 0x619000
004321b8ldr w3, [x27+3056]
004321bccbz w3, 0x4321c4
004321c0b 0x4321c8
004321c4
004321c4loc_4321c4:
004321c4b 0x4321dc
004321c8
004321c8loc_4321c8:
004321c8bl runtime.gcWriteBarrier2
004321ccstr x2, [x25]
004321d0ldr x3, [x1]
004321d4str x3, [x25+8]
004321d8b 0x4321dc
004321dc
004321dcloc_4321dc:
004321dcstr x2, [x1]
004321e0ldrsb x27, [x1]
004321e4ldr x3, [sp+416]
004321e8ldr x4, [sp+424]
004321ecstr x4, [x1+24]
004321f0adrp x27, 0x619000
004321f4ldr w4, [x27+3056]
004321f8cbz w4, 0x432200
004321fcb 0x432204
00432200
00432200loc_432200:
00432200b 0x432218
00432204
00432204loc_432204:
00432204bl runtime.gcWriteBarrier2
00432208str x3, [x25]
0043220cldr x4, [x1+16]
00432210str x4, [x25+8]
00432214b 0x432218
00432218
00432218loc_432218:
00432218str x3, [x1+16]
0043221cldr x0, [sp+344]
00432220ldrsb x27, [x0]
00432224b 0x432228
00432228
00432228loc_432228:
00432228str x0, [sp+352]
0043222corr x2, xzr, 2
00432230str x2, [sp+360]
00432234str x2, [sp+368]
00432238mov x1, x2
0043223cbl path.Join
00432240str x0, [sp+232]
00432244str x1, [sp+240]
00432248stp xzr, xzr, [sp+288]
0043224cstp xzr, xzr, [sp+304]
00432250stp xzr, xzr, [sp+320]
00432254str xzr, [sp+336]
00432258ldr x3, [sp+232]
0043225cldr x4, [sp+240]
00432260str x3, [sp+288]
00432264str x4, [sp+296]
00432268ldr x3, [sp+40]
0043226cstr x3, [sp+304]
00432270ldr x3, [sp+504]
00432274ldr x4, [sp+512]
00432278ldr x5, [sp+520]
0043227cstr x3, [sp+312]
00432280str x4, [sp+320]
00432284str x5, [sp+328]
00432288ldp x3, x4, [sp+288]
0043228cldp x5, x6, [sp+304]
00432290ldp x7, x8, [sp+320]
00432294stp x3, x4, [sp+88]
00432298stp x5, x6, [sp+104]
0043229cstp x7, x8, [sp+120]
004322a0ldr x3, [sp+336]
004322a4str x3, [sp+136]
004322a8add x0, sp, 88
004322acbl github.com/bishopfox/sliver/implant/sliver/netstat.(*procFd).iterFdDir
004322b0b 0x4322b8
004322b4
004322b4loc_4322b4:
004322b4b 0x4322b8
004322b8
004322b8loc_4322b8:
004322b8ldr x1, [sp+72]
004322bcadd x1, x1, 1
004322c0str x1, [sp+72]
004322c4ldr x1, [sp+376]
004322c8add x1, x1, 16
004322ccstr x1, [sp+56]
004322d0b 0x4320cc
004322d4
004322d4loc_4322d4:
004322d4ldp x29, x30, [sp-8]
004322d8add sp, sp, 496
004322dcret x30
004322e0
004322e0loc_4322e0:
004322e0stp x0, x1, [sp+8]
004322e4str x2, [sp+24]
004322e8mov x3, x30
004322ecbl runtime.morestack_noctxt.abi0
004322f0ldp x0, x1, [sp+8]
004322f4ldr x2, [sp+24]
004322f8b 0x431fd0
004322fcudf 0
00431fd0

00432300
00432300github.com/bishopfox/sliver/implant/sliver/netstat.doNetstat: ; void github.com/bishopfox/sliver/implant/sliver/netstat.doNetstat(struct string path, github.com/bishopfox/sliver/implant/sliver/netstat.AcceptFn fn)
00432300ldr x16, [x28+16]
00432304sub x17, sp, 112
00432308subs xzr, x17, x16
0043230cb.ls 0x4324d8
00432310str x30, [sp-240]!
00432314stur x29, [sp-8]
00432318sub x29, sp, 8
0043231cstr x0, [sp+248]
00432320str x1, [sp+256]
00432324str x2, [sp+264]
00432328str xzr, [sp+48]
0043232cstp xzr, xzr, [sp+56]
00432330stp xzr, xzr, [sp+32]
00432334str xzr, [sp+208]
00432338stp xzr, xzr, [sp+192]
0043233cldr x0, [sp+248]
00432340ldr x1, [sp+256]
00432344bl os.Open
00432348str x0, [sp+208]
0043234cstr x1, [sp+192]
00432350str x2, [sp+200]
00432354ldr x2, [sp+208]
00432358str x2, [sp+160]
0043235cldr x2, [sp+200]
00432360ldr x3, [sp+192]
00432364str x3, [sp+144]
00432368str x2, [sp+152]
0043236cldr x2, [sp+160]
00432370str x2, [sp+96]
00432374ldr x2, [sp+152]
00432378ldr x3, [sp+144]
0043237cstr x3, [sp+104]
00432380str x2, [sp+112]
00432384cbnz x3, 0x43238c
00432388b 0x4323bc
0043238c
0043238cloc_43238c:
0043238cstr xzr, [sp+48]
00432390stp xzr, xzr, [sp+56]
00432394ldr x3, [sp+104]
00432398ldr x4, [sp+112]
0043239cstr x3, [sp+32]
004323a0str x4, [sp+40]
004323a4ldr x0, [sp+48]
004323a8ldr x1, [sp+56]
004323acldr x2, [sp+64]
004323b0ldur x29, [sp-8]
004323b4ldr x30, [sp], 240
004323b8ret x30
004323bc
004323bcloc_4323bc:
004323bcldr x3, [sp+96]
004323c0str x3, [sp+208]
004323c4str xzr, [sp+168]
004323c8stp xzr, xzr, [sp+176]
004323ccstp xzr, xzr, [sp+192]
004323d0ldr x2, [sp+264]
004323d4ldr x1, [sp+208]
004323d8adrp x0, 0x2e1000
004323dcadd x0, x0, 2456
004323e0bl github.com/bishopfox/sliver/implant/sliver/netstat.parseSocktab
004323e4str x0, [sp+168]
004323e8str x1, [sp+176]
004323ecstr x2, [sp+184]
004323f0str x3, [sp+192]
004323f4str x4, [sp+200]
004323f8ldr x3, [sp+168]
004323fcldr x4, [sp+176]
00432400ldr x5, [sp+184]
00432404str x3, [sp+120]
00432408str x4, [sp+128]
0043240cstr x5, [sp+136]
00432410ldr x3, [sp+192]
00432414ldr x4, [sp+200]
00432418str x3, [sp+216]
0043241cstr x4, [sp+224]
00432420ldr x3, [sp+120]
00432424ldr x4, [sp+128]
00432428ldr x5, [sp+136]
0043242cstr x3, [sp+72]
00432430str x4, [sp+80]
00432434str x5, [sp+88]
00432438ldr x3, [sp+216]
0043243cldr x4, [sp+224]
00432440str x3, [sp+104]
00432444str x4, [sp+112]
00432448ldr x0, [sp+96]
0043244cbl os.(*File).Close
00432450ldr x3, [sp+104]
00432454cbnz x3, 0x43245c
00432458b 0x43248c
0043245c
0043245cloc_43245c:
0043245cstr xzr, [sp+48]
00432460stp xzr, xzr, [sp+56]
00432464ldr x3, [sp+104]
00432468ldr x4, [sp+112]
0043246cstr x3, [sp+32]
00432470str x4, [sp+40]
00432474ldr x0, [sp+48]
00432478ldr x1, [sp+56]
0043247cldr x2, [sp+64]
00432480ldur x29, [sp-8]
00432484ldr x30, [sp], 240
00432488ret x30
0043248c
0043248cloc_43248c:
0043248cldr x0, [sp+72]
00432490ldr x1, [sp+80]
00432494ldr x2, [sp+88]
00432498bl github.com/bishopfox/sliver/implant/sliver/netstat.extractProcInfo
0043249cldr x3, [sp+72]
004324a0ldr x4, [sp+80]
004324a4ldr x5, [sp+88]
004324a8str x3, [sp+48]
004324acstr x4, [sp+56]
004324b0str x5, [sp+64]
004324b4stp xzr, xzr, [sp+32]
004324b8ldr x0, [sp+48]
004324bcldr x1, [sp+56]
004324c0ldr x2, [sp+64]
004324c4mov x3, xzr
004324c8mov x4, xzr
004324ccldur x29, [sp-8]
004324d0ldr x30, [sp], 240
004324d4ret x30
004324d8
004324d8loc_4324d8:
004324d8stp x0, x1, [sp+8]
004324dcstr x2, [sp+24]
004324e0mov x3, x30
004324e4bl runtime.morestack_noctxt.abi0
004324e8ldp x0, x1, [sp+8]
004324ecldr x2, [sp+24]
004324f0b 0x432300
004324f4udf 0
004324f8udf 0
004324fcudf 0
00432300

00432500
00432500github.com/bishopfox/sliver/implant/sliver/netstat.osTCPSocks: ; void github.com/bishopfox/sliver/implant/sliver/netstat.osTCPSocks(github.com/bishopfox/sliver/implant/sliver/netstat.AcceptFn accept)
00432500ldr x16, [x28+16]
00432504sub x17, sp, 32
00432508subs xzr, x17, x16
0043250cb.ls 0x4325c8
00432510str x30, [sp-160]!
00432514stur x29, [sp-8]
00432518sub x29, sp, 8
0043251cstr x0, [sp+168]
00432520str xzr, [sp+48]
00432524stp xzr, xzr, [sp+56]
00432528stp xzr, xzr, [sp+32]
0043252cstr xzr, [sp+88]
00432530stp xzr, xzr, [sp+96]
00432534stp xzr, xzr, [sp+72]
00432538ldr x2, [sp+168]
0043253cadrp x0, 0x281000
00432540add x0, x0, 2265
00432544movz x1, 13
00432548bl github.com/bishopfox/sliver/implant/sliver/netstat.doNetstat
0043254cstr x0, [sp+88]
00432550str x1, [sp+96]
00432554str x2, [sp+104]
00432558str x3, [sp+72]
0043255cstr x4, [sp+80]
00432560ldr x3, [sp+88]
00432564ldr x4, [sp+96]
00432568ldr x5, [sp+104]
0043256cstr x3, [sp+128]
00432570str x4, [sp+136]
00432574str x5, [sp+144]
00432578ldr x3, [sp+72]
0043257cldr x4, [sp+80]
00432580str x3, [sp+112]
00432584str x4, [sp+120]
00432588ldr x3, [sp+128]
0043258cldr x4, [sp+136]
00432590ldr x5, [sp+144]
00432594str x3, [sp+48]
00432598str x4, [sp+56]
0043259cstr x5, [sp+64]
004325a0ldr x3, [sp+112]
004325a4ldr x4, [sp+120]
004325a8str x3, [sp+32]
004325acstr x4, [sp+40]
004325b0ldr x0, [sp+48]
004325b4ldr x1, [sp+56]
004325b8ldr x2, [sp+64]
004325bcldur x29, [sp-8]
004325c0ldr x30, [sp], 160
004325c4ret x30
004325c8
004325c8loc_4325c8:
004325c8str x0, [sp+8]
004325ccmov x3, x30
004325d0bl runtime.morestack_noctxt.abi0
004325d4ldr x0, [sp+8]
004325d8b 0x432500
004325dcudf 0
00432500

004325e0
004325e0github.com/bishopfox/sliver/implant/sliver/netstat.osTCP6Socks: ; void github.com/bishopfox/sliver/implant/sliver/netstat.osTCP6Socks(github.com/bishopfox/sliver/implant/sliver/netstat.AcceptFn accept)
004325e0ldr x16, [x28+16]
004325e4sub x17, sp, 32
004325e8subs xzr, x17, x16
004325ecb.ls 0x4326a8
004325f0str x30, [sp-160]!
004325f4stur x29, [sp-8]
004325f8sub x29, sp, 8
004325fcstr x0, [sp+168]
00432600str xzr, [sp+48]
00432604stp xzr, xzr, [sp+56]
00432608stp xzr, xzr, [sp+32]
0043260cstr xzr, [sp+88]
00432610stp xzr, xzr, [sp+96]
00432614stp xzr, xzr, [sp+72]
00432618ldr x2, [sp+168]
0043261cadrp x0, 0x281000
00432620add x0, x0, 4032
00432624orr x1, xzr, 14
00432628bl github.com/bishopfox/sliver/implant/sliver/netstat.doNetstat
0043262cstr x0, [sp+88]
00432630str x1, [sp+96]
00432634str x2, [sp+104]
00432638str x3, [sp+72]
0043263cstr x4, [sp+80]
00432640ldr x3, [sp+88]
00432644ldr x4, [sp+96]
00432648ldr x5, [sp+104]
0043264cstr x3, [sp+128]
00432650str x4, [sp+136]
00432654str x5, [sp+144]
00432658ldr x3, [sp+72]
0043265cldr x4, [sp+80]
00432660str x3, [sp+112]
00432664str x4, [sp+120]
00432668ldr x3, [sp+128]
0043266cldr x4, [sp+136]
00432670ldr x5, [sp+144]
00432674str x3, [sp+48]
00432678str x4, [sp+56]
0043267cstr x5, [sp+64]
00432680ldr x3, [sp+112]
00432684ldr x4, [sp+120]
00432688str x3, [sp+32]
0043268cstr x4, [sp+40]
00432690ldr x0, [sp+48]
00432694ldr x1, [sp+56]
00432698ldr x2, [sp+64]
0043269cldur x29, [sp-8]
004326a0ldr x30, [sp], 160
004326a4ret x30
004326a8
004326a8loc_4326a8:
004326a8str x0, [sp+8]
004326acmov x3, x30
004326b0bl runtime.morestack_noctxt.abi0
004326b4ldr x0, [sp+8]
004326b8b 0x4325e0
004326bcudf 0
004325e0

004326c0
004326c0github.com/bishopfox/sliver/implant/sliver/netstat.osUDPSocks: ; void github.com/bishopfox/sliver/implant/sliver/netstat.osUDPSocks(github.com/bishopfox/sliver/implant/sliver/netstat.AcceptFn accept)
004326c0ldr x16, [x28+16]
004326c4sub x17, sp, 32
004326c8subs xzr, x17, x16
004326ccb.ls 0x432788
004326d0str x30, [sp-160]!
004326d4stur x29, [sp-8]
004326d8sub x29, sp, 8
004326dcstr x0, [sp+168]
004326e0str xzr, [sp+48]
004326e4stp xzr, xzr, [sp+56]
004326e8stp xzr, xzr, [sp+32]
004326ecstr xzr, [sp+88]
004326f0stp xzr, xzr, [sp+96]
004326f4stp xzr, xzr, [sp+72]
004326f8ldr x2, [sp+168]
004326fcadrp x0, 0x281000
00432700add x0, x0, 2278
00432704movz x1, 13
00432708bl github.com/bishopfox/sliver/implant/sliver/netstat.doNetstat
0043270cstr x0, [sp+88]
00432710str x1, [sp+96]
00432714str x2, [sp+104]
00432718str x3, [sp+72]
0043271cstr x4, [sp+80]
00432720ldr x3, [sp+88]
00432724ldr x4, [sp+96]
00432728ldr x5, [sp+104]
0043272cstr x3, [sp+128]
00432730str x4, [sp+136]
00432734str x5, [sp+144]
00432738ldr x3, [sp+72]
0043273cldr x4, [sp+80]
00432740str x3, [sp+112]
00432744str x4, [sp+120]
00432748ldr x3, [sp+128]
0043274cldr x4, [sp+136]
00432750ldr x5, [sp+144]
00432754str x3, [sp+48]
00432758str x4, [sp+56]
0043275cstr x5, [sp+64]
00432760ldr x3, [sp+112]
00432764ldr x4, [sp+120]
00432768str x3, [sp+32]
0043276cstr x4, [sp+40]
00432770ldr x0, [sp+48]
00432774ldr x1, [sp+56]
00432778ldr x2, [sp+64]
0043277cldur x29, [sp-8]
00432780ldr x30, [sp], 160
00432784ret x30
00432788
00432788loc_432788:
00432788str x0, [sp+8]
0043278cmov x3, x30
00432790bl runtime.morestack_noctxt.abi0
00432794ldr x0, [sp+8]
00432798b 0x4326c0
0043279cudf 0
004326c0

004327a0
004327a0github.com/bishopfox/sliver/implant/sliver/netstat.osUDP6Socks: ; void github.com/bishopfox/sliver/implant/sliver/netstat.osUDP6Socks(github.com/bishopfox/sliver/implant/sliver/netstat.AcceptFn accept)
004327a0ldr x16, [x28+16]
004327a4sub x17, sp, 32
004327a8subs xzr, x17, x16
004327acb.ls 0x432868
004327b0str x30, [sp-160]!
004327b4stur x29, [sp-8]
004327b8sub x29, sp, 8
004327bcstr x0, [sp+168]
004327c0str xzr, [sp+48]
004327c4stp xzr, xzr, [sp+56]
004327c8stp xzr, xzr, [sp+32]
004327ccstr xzr, [sp+88]
004327d0stp xzr, xzr, [sp+96]
004327d4stp xzr, xzr, [sp+72]
004327d8ldr x2, [sp+168]
004327dcadrp x0, 0x281000
004327e0add x0, x0, 4046
004327e4orr x1, xzr, 14
004327e8bl github.com/bishopfox/sliver/implant/sliver/netstat.doNetstat
004327ecstr x0, [sp+88]
004327f0str x1, [sp+96]
004327f4str x2, [sp+104]
004327f8str x3, [sp+72]
004327fcstr x4, [sp+80]
00432800ldr x3, [sp+88]
00432804ldr x4, [sp+96]
00432808ldr x5, [sp+104]
0043280cstr x3, [sp+128]
00432810str x4, [sp+136]
00432814str x5, [sp+144]
00432818ldr x3, [sp+72]
0043281cldr x4, [sp+80]
00432820str x3, [sp+112]
00432824str x4, [sp+120]
00432828ldr x3, [sp+128]
0043282cldr x4, [sp+136]
00432830ldr x5, [sp+144]
00432834str x3, [sp+48]
00432838str x4, [sp+56]
0043283cstr x5, [sp+64]
00432840ldr x3, [sp+112]
00432844ldr x4, [sp+120]
00432848str x3, [sp+32]
0043284cstr x4, [sp+40]
00432850ldr x0, [sp+48]
00432854ldr x1, [sp+56]
00432858ldr x2, [sp+64]
0043285cldur x29, [sp-8]
00432860ldr x30, [sp], 160
00432864ret x30
00432868
00432868loc_432868:
00432868str x0, [sp+8]
0043286cmov x3, x30
00432870bl runtime.morestack_noctxt.abi0
00432874ldr x0, [sp+8]
00432878b 0x4327a0
0043287cudf 0
004327a0

00432880
00432880type:.eq.github.com/bishopfox/sliver/implant/sliver/netstat.SockTabEntry: ; void type:.eq.github.com/bishopfox/sliver/implant/sliver/netstat.SockTabEntry(github.com/bishopfox/sliver/implant/sliver/netstat.SockTabEntry * p, github.com/bishopfox/sliver/implant/sliver/netstat.SockTabEntry * q)
00432880ldr x16, [x28+16]
00432884subs xzr, sp, x16
00432888b.ls 0x4329a4
0043288cstr x30, [sp-80]!
00432890stur x29, [sp-8]
00432894sub x29, sp, 8
00432898str x0, [sp+88]
0043289cstr x1, [sp+96]
004328a0strb wzr, [sp+39]
004328a4ldr x3, [sp+88]
004328a8ldr x3, [x3+8]
004328acstr x3, [sp+48]
004328b0ldr x4, [x1+8]
004328b4str x4, [sp+40]
004328b8subs xzr, x3, x4
004328bcb.eq 0x4328c4
004328c0b 0x432988
004328c4
004328c4loc_4328c4:
004328c4ldr x3, [sp+88]
004328c8ldr x3, [x3+16]
004328ccldr x4, [x1+16]
004328d0subs xzr, x4, x3
004328d4b.eq 0x4328dc
004328d8b 0x432984
004328dc
004328dcloc_4328dc:
004328dcldr x3, [sp+88]
004328e0ldr x3, [x3+24]
004328e4ldr x4, [x1+24]
004328e8subs xzr, x4, x3
004328ecb.eq 0x4328f4
004328f0b 0x432980
004328f4
004328f4loc_4328f4:
004328f4ldr x3, [sp+88]
004328f8ldrb w3, [x3+32]
004328fcldrb w4, [x1+32]
00432900subs wzr, w3, w4
00432904b.eq 0x43290c
00432908b 0x43297c
0043290c
0043290cloc_43290c:
0043290cldr x3, [sp+88]
00432910ldr w3, [x3+36]
00432914ldr w4, [x1+36]
00432918subs wzr, w4, w3
0043291cb.eq 0x432924
00432920b 0x432978
00432924
00432924loc_432924:
00432924ldr x3, [sp+88]
00432928ldr x3, [x3+40]
0043292cldr x4, [x1+40]
00432930subs xzr, x4, x3
00432934b.eq 0x43293c
00432938b 0x432974
0043293c
0043293cloc_43293c:
0043293cldr x3, [sp+88]
00432940ldr x3, [x3+8]
00432944str x3, [sp+40]
00432948ldr x3, [sp+88]
0043294cldr x3, [x3]
00432950str x3, [sp+64]
00432954ldr x3, [sp+96]
00432958ldr x1, [x3]
0043295cstr x1, [sp+56]
00432960ldr x2, [sp+40]
00432964ldr x0, [sp+64]
00432968bl runtime.memequal
0043296cstrb w0, [sp+39]
00432970b 0x432994
00432974
00432974loc_432974:
00432974b 0x43298c
00432978
00432978loc_432978:
00432978b 0x43298c
0043297c
0043297cloc_43297c:
0043297cb 0x43298c
00432980
00432980loc_432980:
00432980b 0x43298c
00432984
00432984loc_432984:
00432984b 0x43298c
00432988
00432988loc_432988:
00432988b 0x43298c
0043298c
0043298cloc_43298c:
0043298cstrb wzr, [sp+39]
00432990b 0x432994
00432994
00432994loc_432994:
00432994ldrb w0, [sp+39]
00432998ldur x29, [sp-8]
0043299cldr x30, [sp], 80
004329a0ret x30
004329a4
004329a4loc_4329a4:
004329a4stp x0, x1, [sp+8]
004329a8mov x3, x30
004329acbl runtime.morestack_noctxt.abi0
004329b0ldp x0, x1, [sp+8]
004329b4b 0x432880
004329b8udf 0
004329bcudf 0
00432880

004329c0
004329c0type:.eq.github.com/bishopfox/sliver/implant/sliver/netstat.Process: ; void type:.eq.github.com/bishopfox/sliver/implant/sliver/netstat.Process(github.com/bishopfox/sliver/implant/sliver/netstat.Process * p, github.com/bishopfox/sliver/implant/sliver/netstat.Process * q)
004329c0ldr x16, [x28+16]
004329c4subs xzr, sp, x16
004329c8b.ls 0x432a78
004329ccstr x30, [sp-80]!
004329d0stur x29, [sp-8]
004329d4sub x29, sp, 8
004329d8str x0, [sp+88]
004329dcstr x1, [sp+96]
004329e0strb wzr, [sp+39]
004329e4ldr x3, [sp+88]
004329e8ldr x3, [x3]
004329ecldr x4, [sp+96]
004329f0ldr x4, [x4]
004329f4subs xzr, x4, x3
004329f8b.eq 0x432a00
004329fcb 0x432a5c
00432a00
00432a00loc_432a00:
00432a00ldr x3, [sp+88]
00432a04ldr x3, [x3+16]
00432a08str x3, [sp+48]
00432a0cldr x4, [x1+16]
00432a10str x4, [sp+40]
00432a14subs xzr, x3, x4
00432a18b.eq 0x432a20
00432a1cb 0x432a58
00432a20
00432a20loc_432a20:
00432a20ldr x3, [sp+88]
00432a24ldr x3, [x3+16]
00432a28str x3, [sp+40]
00432a2cldr x3, [sp+88]
00432a30ldr x3, [x3+8]
00432a34str x3, [sp+64]
00432a38ldr x3, [sp+96]
00432a3cldr x1, [x3+8]
00432a40str x1, [sp+56]
00432a44ldr x2, [sp+40]
00432a48ldr x0, [sp+64]
00432a4cbl runtime.memequal
00432a50strb w0, [sp+39]
00432a54b 0x432a68
00432a58
00432a58loc_432a58:
00432a58b 0x432a60
00432a5c
00432a5cloc_432a5c:
00432a5cb 0x432a60
00432a60
00432a60loc_432a60:
00432a60strb wzr, [sp+39]
00432a64b 0x432a68
00432a68
00432a68loc_432a68:
00432a68ldrb w0, [sp+39]
00432a6cldur x29, [sp-8]
00432a70ldr x30, [sp], 80
00432a74ret x30
00432a78
00432a78loc_432a78:
00432a78stp x0, x1, [sp+8]
00432a7cmov x3, x30
00432a80bl runtime.morestack_noctxt.abi0
00432a84ldp x0, x1, [sp+8]
00432a88b 0x4329c0
00432a8cudf 0
004329c0

00432a90
00432a90github.com/bishopfox/sliver/implant/sliver/ps.Processes: ; void github.com/bishopfox/sliver/implant/sliver/ps.Processes(bool fullInfo)
00432a90ldr x16, [x28+16]
00432a94sub x17, sp, 16
00432a98subs xzr, x17, x16
00432a9cb.ls 0x432b4c
00432aa0str x30, [sp-144]!
00432aa4stur x29, [sp-8]
00432aa8sub x29, sp, 8
00432aacstrb w0, [sp+152]
00432ab0str xzr, [sp+32]
00432ab4stp xzr, xzr, [sp+40]
00432ab8stp xzr, xzr, [sp+16]
00432abcstr xzr, [sp+72]
00432ac0stp xzr, xzr, [sp+80]
00432ac4stp xzr, xzr, [sp+56]
00432ac8ldrb w0, [sp+152]
00432accbl github.com/bishopfox/sliver/implant/sliver/ps.processes
00432ad0str x0, [sp+72]
00432ad4str x1, [sp+80]
00432ad8str x2, [sp+88]
00432adcstr x3, [sp+56]
00432ae0str x4, [sp+64]
00432ae4ldr x1, [sp+72]
00432ae8ldr x2, [sp+80]
00432aecldr x3, [sp+88]
00432af0str x1, [sp+112]
00432af4str x2, [sp+120]
00432af8str x3, [sp+128]
00432afcldr x1, [sp+56]
00432b00ldr x2, [sp+64]
00432b04str x1, [sp+96]
00432b08str x2, [sp+104]
00432b0cldr x1, [sp+112]
00432b10ldr x2, [sp+120]
00432b14ldr x3, [sp+128]
00432b18str x1, [sp+32]
00432b1cstr x2, [sp+40]
00432b20str x3, [sp+48]
00432b24ldr x3, [sp+96]
00432b28ldr x4, [sp+104]
00432b2cstr x3, [sp+16]
00432b30str x4, [sp+24]
00432b34ldr x0, [sp+32]
00432b38ldr x1, [sp+40]
00432b3cldr x2, [sp+48]
00432b40ldur x29, [sp-8]
00432b44ldr x30, [sp], 144
00432b48ret x30
00432b4c
00432b4cloc_432b4c:
00432b4cstrb w0, [sp+8]
00432b50mov x3, x30
00432b54bl runtime.morestack_noctxt.abi0
00432b58ldrb w0, [sp+8]
00432b5cb 0x432a90
00432a90

00432b60
00432b60github.com/bishopfox/sliver/implant/sliver/ps.Kill: ; void github.com/bishopfox/sliver/implant/sliver/ps.Kill(int pid)
00432b60ldr x16, [x28+16]
00432b64subs xzr, sp, x16
00432b68b.ls 0x432c0c
00432b6cstr x30, [sp-112]!
00432b70stur x29, [sp-8]
00432b74sub x29, sp, 8
00432b78str x0, [sp+120]
00432b7cstp xzr, xzr, [sp+16]
00432b80str xzr, [sp+72]
00432b84stp xzr, xzr, [sp+56]
00432b88ldr x0, [sp+120]
00432b8cbl os.FindProcess
00432b90str x0, [sp+72]
00432b94str x1, [sp+56]
00432b98str x2, [sp+64]
00432b9cldr x1, [sp+72]
00432ba0str x1, [sp+96]
00432ba4ldr x1, [sp+56]
00432ba8ldr x2, [sp+64]
00432bacstr x1, [sp+80]
00432bb0str x2, [sp+88]
00432bb4ldr x1, [sp+96]
00432bb8str x1, [sp+32]
00432bbcldr x1, [sp+88]
00432bc0ldr x0, [sp+80]
00432bc4str x0, [sp+40]
00432bc8str x1, [sp+48]
00432bcccbnz x0, 0x432bd4
00432bd0b 0x432be8
00432bd4
00432bd4loc_432bd4:
00432bd4str x0, [sp+16]
00432bd8str x1, [sp+24]
00432bdcldur x29, [sp-8]
00432be0ldr x30, [sp], 112
00432be4ret x30
00432be8
00432be8loc_432be8:
00432be8ldr x0, [sp+32]
00432becbl os.(*Process).Kill
00432bf0str x0, [sp+56]
00432bf4str x1, [sp+64]
00432bf8str x0, [sp+16]
00432bfcstr x1, [sp+24]
00432c00ldur x29, [sp-8]
00432c04ldr x30, [sp], 112
00432c08ret x30
00432c0c
00432c0cloc_432c0c:
00432c0cstr x0, [sp+8]
00432c10mov x3, x30
00432c14bl runtime.morestack_noctxt.abi0
00432c18ldr x0, [sp+8]
00432c1cb 0x432b60
00432b60

00432c20
00432c20github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Pid: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Pid(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432c20str x30, [sp-32]!
00432c24stur x29, [sp-8]
00432c28sub x29, sp, 8
00432c2cstr x0, [sp+40]
00432c30str xzr, [sp+16]
00432c34ldrsb x27, [x0]
00432c38ldr x0, [x0]
00432c3cstr x0, [sp+16]
00432c40add x29, sp, 24
00432c44add sp, sp, 32
00432c48ret x30
00432c4cudf 0
00432c20

00432c50
00432c50github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).PPid: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).PPid(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432c50str x30, [sp-32]!
00432c54stur x29, [sp-8]
00432c58sub x29, sp, 8
00432c5cstr x0, [sp+40]
00432c60str xzr, [sp+16]
00432c64ldrsb x27, [x0]
00432c68ldr x0, [x0+8]
00432c6cstr x0, [sp+16]
00432c70add x29, sp, 24
00432c74add sp, sp, 32
00432c78ret x30
00432c7cudf 0
00432c50

00432c80
00432c80github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Executable: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Executable(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432c80str x30, [sp-32]!
00432c84stur x29, [sp-8]
00432c88sub x29, sp, 8
00432c8cstr x0, [sp+40]
00432c90stp xzr, xzr, [sp+8]
00432c94ldr x2, [sp+40]
00432c98ldrsb x27, [x2]
00432c9cldr x0, [x2+80]
00432ca0ldr x1, [x2+88]
00432ca4str x0, [sp+8]
00432ca8str x1, [sp+16]
00432cacadd x29, sp, 24
00432cb0add sp, sp, 32
00432cb4ret x30
00432cb8udf 0
00432cbcudf 0
00432c80

00432cc0
00432cc0github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Owner: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Owner(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432cc0str x30, [sp-32]!
00432cc4stur x29, [sp-8]
00432cc8sub x29, sp, 8
00432cccstr x0, [sp+40]
00432cd0stp xzr, xzr, [sp+8]
00432cd4ldr x2, [sp+40]
00432cd8ldrsb x27, [x2]
00432cdcldr x0, [x2+96]
00432ce0ldr x1, [x2+104]
00432ce4str x0, [sp+8]
00432ce8str x1, [sp+16]
00432cecadd x29, sp, 24
00432cf0add sp, sp, 32
00432cf4ret x30
00432cf8udf 0
00432cfcudf 0
00432cc0

00432d00
00432d00github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).CmdLine: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).CmdLine(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432d00str x30, [sp-48]!
00432d04stur x29, [sp-8]
00432d08sub x29, sp, 8
00432d0cstr x0, [sp+56]
00432d10str xzr, [sp+16]
00432d14stp xzr, xzr, [sp+24]
00432d18ldr x3, [sp+56]
00432d1cldrsb x27, [x3]
00432d20ldr x0, [x3+56]
00432d24ldr x1, [x3+64]
00432d28ldr x2, [x3+72]
00432d2cstr x0, [sp+16]
00432d30str x1, [sp+24]
00432d34str x2, [sp+32]
00432d38add x29, sp, 40
00432d3cadd sp, sp, 48
00432d40ret x30
00432d44udf 0
00432d48udf 0
00432d4cudf 0
00432d00

00432d50
00432d50github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Architecture: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Architecture(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432d50str x30, [sp-32]!
00432d54stur x29, [sp-8]
00432d58sub x29, sp, 8
00432d5cstr x0, [sp+40]
00432d60stp xzr, xzr, [sp+8]
00432d64ldr x2, [sp+40]
00432d68ldrsb x27, [x2]
00432d6cldr x0, [x2+40]
00432d70ldr x1, [x2+48]
00432d74str x0, [sp+8]
00432d78str x1, [sp+16]
00432d7cadd x29, sp, 24
00432d80add sp, sp, 32
00432d84ret x30
00432d88udf 0
00432d8cudf 0
00432d50

00432d90
00432d90github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid(int pid)
00432d90ldr x16, [x28+16]
00432d94sub x17, sp, 368
00432d98subs xzr, x17, x16
00432d9cb.ls 0x43303c
00432da0sub x20, sp, 496
00432da4stp x29, x30, [x20-8]
00432da8add sp, x20, 0
00432dacsub x29, sp, 8
00432db0str x0, [sp+504]
00432db4str wzr, [sp+60]
00432db8stp xzr, xzr, [sp+248]
00432dbcstp xzr, xzr, [sp+472]
00432dc0add x1, sp, 472
00432dc4str x1, [sp+416]
00432dc8ldr x0, [sp+504]
00432dccbl runtime.convT64
00432dd0str x0, [sp+408]
00432dd4ldr x1, [sp+416]
00432dd8ldrsb x27, [x1]
00432ddcadrp x2, 0x1c3000
00432de0add x2, x2, 3520
00432de4str x2, [x1]
00432de8adrp x27, 0x619000
00432decldr w2, [x27+3056]
00432df0cbz w2, 0x432df8
00432df4b 0x432dfc
00432df8
00432df8loc_432df8:
00432df8b 0x432e10
00432dfc
00432dfcloc_432dfc:
00432dfcbl runtime.gcWriteBarrier2
00432e00str x0, [x25]
00432e04ldr x5, [x1+8]
00432e08str x5, [x25+8]
00432e0cb 0x432e10
00432e10
00432e10loc_432e10:
00432e10str x0, [x1+8]
00432e14ldr x2, [sp+416]
00432e18ldrsb x27, [x2]
00432e1cb 0x432e20
00432e20
00432e20loc_432e20:
00432e20str x2, [sp+424]
00432e24orr x4, xzr, 1
00432e28str x4, [sp+432]
00432e2cstr x4, [sp+440]
00432e30adrp x0, 0x281000
00432e34add x0, x0, 2291
00432e38movz x1, 13
00432e3cmov x3, x4
00432e40bl fmt.Sprintf
00432e44str x0, [sp+264]
00432e48str x1, [sp+272]
00432e4cstr xzr, [sp+464]
00432e50stp xzr, xzr, [sp+448]
00432e54ldr x0, [sp+264]
00432e58ldr x1, [sp+272]
00432e5cbl os.Open
00432e60str x0, [sp+464]
00432e64str x1, [sp+448]
00432e68str x2, [sp+456]
00432e6cldr x5, [sp+464]
00432e70str x5, [sp+336]
00432e74ldr x5, [sp+456]
00432e78ldr x6, [sp+448]
00432e7cstr x6, [sp+320]
00432e80str x5, [sp+328]
00432e84ldr x5, [sp+336]
00432e88str x5, [sp+288]
00432e8cldr x5, [sp+328]
00432e90ldr x6, [sp+320]
00432e94str x6, [sp+296]
00432e98str x5, [sp+304]
00432e9ccbnz x6, 0x432ea4
00432ea0b 0x432ed4
00432ea4
00432ea4loc_432ea4:
00432ea4str wzr, [sp+60]
00432ea8ldr x0, [sp+296]
00432eacldr x1, [sp+304]
00432eb0str x0, [sp+248]
00432eb4str x1, [sp+256]
00432eb8bl runtime.deferreturn
00432ebcldr w0, [sp+60]
00432ec0ldr x1, [sp+248]
00432ec4ldr x2, [sp+256]
00432ec8ldp x29, x30, [sp-8]
00432eccadd sp, sp, 496
00432ed0ret x30
00432ed4
00432ed4loc_432ed4:
00432ed4ldr x1, [sp+288]
00432ed8str x1, [sp+312]
00432edcstp xzr, xzr, [sp+384]
00432ee0add x1, sp, 384
00432ee4str x1, [sp+400]
00432ee8ldrsb x27, [x1]
00432eecadrp x2, 4096
00432ef0add x2, x2, 80
00432ef4str x2, [x1]
00432ef8ldrsb x27, [x1]
00432efcldr x2, [sp+312]
00432f00adrp x27, 0x619000
00432f04ldr w3, [x27+3056]
00432f08cbz w3, 0x432f10
00432f0cb 0x432f14
00432f10
00432f10loc_432f10:
00432f10b 0x432f28
00432f14
00432f14loc_432f14:
00432f14bl runtime.gcWriteBarrier2
00432f18str x2, [x25]
00432f1cldr x3, [x1+8]
00432f20str x3, [x25+8]
00432f24b 0x432f28
00432f28
00432f28loc_432f28:
00432f28str x2, [x1+8]
00432f2cstr x1, [sp+88]
00432f30add x0, sp, 64
00432f34bl runtime.deferprocStack
00432f38subs xzr, x0, 0
00432f3cb.ne 0x433020
00432f40b 0x432f44
00432f44
00432f44loc_432f44:
00432f44add x20, sp, 112
00432f48adr x27, 16
00432f4cstp x29, x27, [sp-24]
00432f50sub x29, sp, 24
00432f54bl fn_87cf0
00432f58sub x29, sp, 8
00432f5cadd x20, sp, 112
00432f60str x20, [sp+376]
00432f64ldrsb x27, [x20]
00432f68adr x27, 16
00432f6cstp x29, x27, [sp-24]
00432f70sub x29, sp, 24
00432f74bl fn_87cf0
00432f78sub x29, sp, 8
00432f7cldr x1, [sp+376]
00432f80str x1, [sp+280]
00432f84ldr x0, [sp+288]
00432f88bl os.(*File).Fd
00432f8cstr x0, [sp+240]
00432f90ldr x1, [sp+280]
00432f94bl syscall.Fstat
00432f98str x0, [sp+296]
00432f9cstr x1, [sp+304]
00432fa0cbnz x0, 0x432fa8
00432fa4b 0x432fe0
00432fa8
00432fa8loc_432fa8:
00432fa8str x0, [sp+360]
00432facstr x1, [sp+368]
00432fb0str wzr, [sp+60]
00432fb4ldr x0, [sp+360]
00432fb8ldr x1, [sp+368]
00432fbcstr x0, [sp+248]
00432fc0str x1, [sp+256]
00432fc4bl runtime.deferreturn
00432fc8ldr w0, [sp+60]
00432fccldr x1, [sp+248]
00432fd0ldr x2, [sp+256]
00432fd4ldp x29, x30, [sp-8]
00432fd8add sp, sp, 496
00432fdcret x30
00432fe0
00432fe0loc_432fe0:
00432fe0stp xzr, xzr, [sp+344]
00432fe4ldr x0, [sp+280]
00432fe8ldrsb x27, [x0]
00432fecldr w0, [x0+24]
00432ff0str w0, [sp+60]
00432ff4ldr x0, [sp+344]
00432ff8ldr x1, [sp+352]
00432ffcstr x0, [sp+248]
00433000str x1, [sp+256]
00433004bl runtime.deferreturn
00433008ldr w0, [sp+60]
0043300cldr x1, [sp+248]
00433010ldr x2, [sp+256]
00433014ldp x29, x30, [sp-8]
00433018add sp, sp, 496
0043301cret x30
00433020
00433020loc_433020:
00433020bl runtime.deferreturn
00433024ldr w0, [sp+60]
00433028ldr x1, [sp+248]
0043302cldr x2, [sp+256]
00433030ldp x29, x30, [sp-8]
00433034add sp, sp, 496
00433038ret x30
0043303c
0043303cloc_43303c:
0043303cstr x0, [sp+8]
00433040mov x3, x30
00433044bl runtime.morestack_noctxt.abi0
00433048ldr x0, [sp+8]
0043304cb 0x432d90
00432d90

00433050
00433050github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid.deferwrap1: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid.deferwrap1(void)
00433050ldr x16, [x28+16]
00433054subs xzr, sp, x16
00433058b.ls 0x433088
0043305cstr x30, [sp-32]!
00433060stur x29, [sp-8]
00433064sub x29, sp, 8
00433068ldr x16, [x28+32]
0043306ccbnz x16, 0x433094
00433070
00433070loc_433070:
00433070ldr x0, [x26+8]
00433074str x0, [sp+16]
00433078bl os.(*File).Close
0043307cldur x29, [sp-8]
00433080ldr x30, [sp], 32
00433084ret x30
00433088
00433088loc_433088:
00433088mov x3, x30
0043308cbl runtime.morestack.abi0
00433090b 0x433050
00433094
00433094loc_433094:
00433094ldr x17, [x16]
00433098add x20, sp, 40
0043309csubs xzr, x20, x17
004330a0b.ne 0x433070
004330a4add x20, sp, 8
004330a8str x20, [x16]
004330acb 0x433070
00433050

004330b0
004330b0github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwner: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwner(int pid)
004330b0ldr x16, [x28+16]
004330b4sub x17, sp, 176
004330b8subs xzr, x17, x16
004330bcb.ls 0x433330
004330c0sub x20, sp, 304
004330c4stp x29, x30, [x20-8]
004330c8add sp, x20, 0
004330ccsub x29, sp, 8
004330d0str x0, [sp+312]
004330d4stp xzr, xzr, [sp+80]
004330d8stp xzr, xzr, [sp+64]
004330dcstp xzr, xzr, [sp+280]
004330e0ldr x0, [sp+312]
004330e4bl github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid
004330e8str w0, [sp+60]
004330ecstr x1, [sp+280]
004330f0str x2, [sp+288]
004330f4ldr w1, [sp+60]
004330f8str w1, [sp+56]
004330fcldr x1, [sp+280]
00433100ldr x2, [sp+288]
00433104str x1, [sp+144]
00433108str x2, [sp+152]
0043310cldr w1, [sp+56]
00433110str w1, [sp+52]
00433114ldr x1, [sp+152]
00433118ldr x2, [sp+144]
0043311cstr x2, [sp+104]
00433120str x1, [sp+112]
00433124cbnz x2, 0x43312c
00433128b 0x433154
0043312c
0043312cloc_43312c:
0043312cstp xzr, xzr, [sp+80]
00433130ldr x3, [sp+112]
00433134ldr x2, [sp+104]
00433138str x2, [sp+64]
0043313cstr x3, [sp+72]
00433140ldr x0, [sp+80]
00433144ldr x1, [sp+88]
00433148ldp x29, x30, [sp-8]
0043314cadd sp, sp, 304
00433150ret x30
00433154
00433154loc_433154:
00433154stp xzr, xzr, [sp+264]
00433158add x1, sp, 264
0043315cstr x1, [sp+208]
00433160ldr w0, [sp+52]
00433164bl runtime.convT32
00433168str x0, [sp+200]
0043316cldr x1, [sp+208]
00433170ldrsb x27, [x1]
00433174adrp x2, 0x1c2000
00433178add x2, x2, 3328
0043317cstr x2, [x1]
00433180adrp x27, 0x618000
00433184ldr w2, [x27+3056]
00433188cbz w2, 0x433190
0043318cb 0x433194
00433190
00433190loc_433190:
00433190b 0x4331a8
00433194
00433194loc_433194:
00433194bl runtime.gcWriteBarrier2
00433198str x0, [x25]
0043319cldr x5, [x1+8]
004331a0str x5, [x25+8]
004331a4b 0x4331a8
004331a8
004331a8loc_4331a8:
004331a8str x0, [x1+8]
004331acldr x2, [sp+208]
004331b0ldrsb x27, [x2]
004331b4b 0x4331b8
004331b8
004331b8loc_4331b8:
004331b8str x2, [sp+216]
004331bcorr x4, xzr, 1
004331c0str x4, [sp+224]
004331c4str x4, [sp+232]
004331c8adrp x0, 0x27d000
004331ccadd x0, x0, 21
004331d0orr x1, xzr, 2
004331d4mov x3, x4
004331d8bl fmt.Sprintf
004331dcstr x0, [sp+248]
004331e0str x1, [sp+256]
004331e4str xzr, [sp+240]
004331e8stp xzr, xzr, [sp+280]
004331ecldr x0, [sp+248]
004331f0ldr x1, [sp+256]
004331f4bl os/user.LookupId
004331f8str x0, [sp+240]
004331fcstr x1, [sp+280]
00433200str x2, [sp+288]
00433204ldr x5, [sp+240]
00433208str x5, [sp+136]
0043320cldr x5, [sp+280]
00433210ldr x6, [sp+288]
00433214str x5, [sp+120]
00433218str x6, [sp+128]
0043321cldr x5, [sp+136]
00433220str x5, [sp+96]
00433224ldr x5, [sp+128]
00433228ldr x6, [sp+120]
0043322cstr x6, [sp+104]
00433230str x5, [sp+112]
00433234cbnz x6, 0x43323c
00433238b 0x4332f4
0043323c
0043323cloc_43323c:
0043323cstp xzr, xzr, [sp+264]
00433240add x1, sp, 264
00433244str x1, [sp+168]
00433248ldr w0, [sp+52]
0043324cbl runtime.convT32
00433250str x0, [sp+160]
00433254ldr x1, [sp+168]
00433258ldrsb x27, [x1]
0043325cadrp x2, 0x1c2000
00433260add x2, x2, 3328
00433264str x2, [x1]
00433268adrp x27, 0x618000
0043326cldr w2, [x27+3056]
00433270cbz w2, 0x433278
00433274b 0x43327c
00433278
00433278loc_433278:
00433278b 0x433290
0043327c
0043327cloc_43327c:
0043327cbl runtime.gcWriteBarrier2
00433280str x0, [x25]
00433284ldr x5, [x1+8]
00433288str x5, [x25+8]
0043328cb 0x433290
00433290
00433290loc_433290:
00433290str x0, [x1+8]
00433294ldr x2, [sp+168]
00433298ldrsb x27, [x2]
0043329cb 0x4332a0
004332a0
004332a0loc_4332a0:
004332a0str x2, [sp+176]
004332a4orr x4, xzr, 1
004332a8str x4, [sp+184]
004332acstr x4, [sp+192]
004332b0adrp x0, 0x27d000
004332b4add x0, x0, 21
004332b8orr x1, xzr, 2
004332bcmov x3, x4
004332c0bl fmt.Sprintf
004332c4str x0, [sp+248]
004332c8str x1, [sp+256]
004332ccstr x0, [sp+80]
004332d0str x1, [sp+88]
004332d4stp xzr, xzr, [sp+64]
004332d8ldr x0, [sp+80]
004332dcldr x1, [sp+88]
004332e0mov x2, xzr
004332e4mov x3, xzr
004332e8ldp x29, x30, [sp-8]
004332ecadd sp, sp, 304
004332f0ret x30
004332f4
004332f4loc_4332f4:
004332f4ldr x4, [sp+96]
004332f8ldrsb x27, [x4]
004332fcldr x5, [x4+32]
00433300ldr x4, [x4+40]
00433304str x5, [sp+80]
00433308str x4, [sp+88]
0043330cldr x2, [sp+104]
00433310ldr x3, [sp+112]
00433314str x2, [sp+64]
00433318str x3, [sp+72]
0043331cldr x0, [sp+80]
00433320ldr x1, [sp+88]
00433324ldp x29, x30, [sp-8]
00433328add sp, sp, 304
0043332cret x30
00433330
00433330loc_433330:
00433330str x0, [sp+8]
00433334mov x3, x30
00433338bl runtime.morestack_noctxt.abi0
0043333cldr x0, [sp+8]
00433340b 0x4330b0
00433344udf 0
00433348udf 0
0043334cudf 0
004330b0

00433350
00433350github.com/bishopfox/sliver/implant/sliver/ps.getProcessCmdLine: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessCmdLine(int pid)
00433350ldr x16, [x28+16]
00433354sub x17, sp, 208
00433358subs xzr, x17, x16
0043335cb.ls 0x433578
00433360sub x20, sp, 336
00433364stp x29, x30, [x20-8]
00433368add sp, x20, 0
0043336csub x29, sp, 8
00433370str x0, [sp+344]
00433374stp xzr, xzr, [sp+64]
00433378str xzr, [sp+80]
0043337cstp xzr, xzr, [sp+48]
00433380stp xzr, xzr, [sp+168]
00433384add x1, sp, 168
00433388str x1, [sp+256]
0043338cldr x0, [sp+344]
00433390bl runtime.convT64
00433394str x0, [sp+248]
00433398ldr x1, [sp+256]
0043339cldrsb x27, [x1]
004333a0adrp x2, 0x1c2000
004333a4add x2, x2, 3520
004333a8str x2, [x1]
004333acadrp x27, 0x618000
004333b0ldr w2, [x27+3056]
004333b4cbz w2, 0x4333bc
004333b8b 0x4333c0
004333bc
004333bcloc_4333bc:
004333bcb 0x4333d4
004333c0
004333c0loc_4333c0:
004333c0bl runtime.gcWriteBarrier2
004333c4str x0, [x25]
004333c8ldr x5, [x1+8]
004333ccstr x5, [x25+8]
004333d0b 0x4333d4
004333d4
004333d4loc_4333d4:
004333d4str x0, [x1+8]
004333d8ldr x2, [sp+256]
004333dcldrsb x27, [x2]
004333e0b 0x4333e4
004333e4
004333e4loc_4333e4:
004333e4str x2, [sp+264]
004333e8orr x4, xzr, 1
004333ecstr x4, [sp+272]
004333f0str x4, [sp+280]
004333f4adrp x0, 0x281000
004333f8add x0, x0, 3300
004333fcorr x1, xzr, 16
00433400mov x3, x4
00433404bl fmt.Sprintf
00433408str x0, [sp+128]
0043340cstr x1, [sp+136]
00433410str xzr, [sp+304]
00433414stp xzr, xzr, [sp+312]
00433418stp xzr, xzr, [sp+288]
0043341cldr x0, [sp+128]
00433420ldr x1, [sp+136]
00433424bl os.ReadFile
00433428str x0, [sp+304]
0043342cstr x1, [sp+312]
00433430str x2, [sp+320]
00433434str x3, [sp+288]
00433438str x4, [sp+296]
0043343cldr x5, [sp+312]
00433440ldr x6, [sp+320]
00433444ldr x7, [sp+304]
00433448str x7, [sp+200]
0043344cstr x5, [sp+208]
00433450str x6, [sp+216]
00433454ldr x5, [sp+288]
00433458ldr x6, [sp+296]
0043345cstr x5, [sp+184]
00433460str x6, [sp+192]
00433464ldr x5, [sp+200]
00433468ldr x6, [sp+208]
0043346cldr x7, [sp+216]
00433470str x5, [sp+104]
00433474str x6, [sp+112]
00433478str x7, [sp+120]
0043347cldr x5, [sp+192]
00433480ldr x6, [sp+184]
00433484str x6, [sp+88]
00433488str x5, [sp+96]
0043348ccbnz x6, 0x433494
00433490b 0x433514
00433494
00433494loc_433494:
00433494adrp x0, 0x1ca000
00433498add x0, x0, 1568
0043349cbl runtime.newobject
004334a0str x0, [sp+240]
004334a4str xzr, [x0+8]
004334a8adrp x27, 0x618000
004334acldr w1, [x27+3056]
004334b0cbz w1, 0x4334b8
004334b4b 0x4334bc
004334b8
004334b8loc_4334b8:
004334b8b 0x4334cc
004334bc
004334bcloc_4334bc:
004334bcldr x5, [x0]
004334c0bl runtime.gcWriteBarrier1
004334c4str x5, [x25]
004334c8b 0x4334cc
004334cc
004334ccloc_4334cc:
004334ccstr xzr, [x0]
004334d0ldr x5, [sp+240]
004334d4ldrsb x27, [x5]
004334d8b 0x4334dc
004334dc
004334dcloc_4334dc:
004334dcstr x5, [sp+64]
004334e0orr x5, xzr, 1
004334e4str x5, [sp+72]
004334e8str x5, [sp+80]
004334ecldr x3, [sp+88]
004334f0ldr x4, [sp+96]
004334f4str x3, [sp+48]
004334f8str x4, [sp+56]
004334fcldr x0, [sp+64]
00433500ldr x1, [sp+72]
00433504ldr x2, [sp+80]
00433508ldp x29, x30, [sp-8]
0043350cadd sp, sp, 336
00433510ret x30
00433514
00433514loc_433514:
00433514ldr x1, [sp+104]
00433518ldr x2, [sp+112]
0043351cmov x0, xzr
00433520bl runtime.slicebytetostring
00433524str x0, [sp+224]
00433528str x1, [sp+232]
0043352cadrp x2, 0x2dd000
00433530add x2, x2, 3040
00433534orr x3, xzr, 1
00433538bl strings.Split
0043353cstr x0, [sp+144]
00433540str x1, [sp+152]
00433544str x2, [sp+160]
00433548str x0, [sp+64]
0043354cstr x1, [sp+72]
00433550str x2, [sp+80]
00433554stp xzr, xzr, [sp+48]
00433558ldr x0, [sp+64]
0043355cldr x1, [sp+72]
00433560ldr x2, [sp+80]
00433564mov x3, xzr
00433568mov x4, xzr
0043356cldp x29, x30, [sp-8]
00433570add sp, sp, 336
00433574ret x30
00433578
00433578loc_433578:
00433578str x0, [sp+8]
0043357cmov x3, x30
00433580bl runtime.morestack_noctxt.abi0
00433584ldr x0, [sp+8]
00433588b 0x433350
0043358cudf 0
00433350

00433590
00433590github.com/bishopfox/sliver/implant/sliver/ps.getProcessArchitecture: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessArchitecture(int pid)
00433590ldr x16, [x28+16]
00433594sub x17, sp, 224
00433598subs xzr, x17, x16
0043359cb.ls 0x433960
004335a0sub x20, sp, 352
004335a4stp x29, x30, [x20-8]
004335a8add sp, x20, 0
004335acsub x29, sp, 8
004335b0str x0, [sp+360]
004335b4stp xzr, xzr, [sp+128]
004335b8stp xzr, xzr, [sp+112]
004335bcstp xzr, xzr, [sp+312]
004335c0add x1, sp, 312
004335c4str x1, [sp+256]
004335c8ldr x0, [sp+360]
004335ccbl runtime.convT64
004335d0str x0, [sp+248]
004335d4ldr x1, [sp+256]
004335d8ldrsb x27, [x1]
004335dcadrp x2, 0x1c2000
004335e0add x2, x2, 3520
004335e4str x2, [x1]
004335e8adrp x27, 0x618000
004335ecldr w2, [x27+3056]
004335f0cbz w2, 0x4335f8
004335f4b 0x4335fc
004335f8
004335f8loc_4335f8:
004335f8b 0x433610
004335fc
004335fcloc_4335fc:
004335fcbl runtime.gcWriteBarrier2
00433600str x0, [x25]
00433604ldr x5, [x1+8]
00433608str x5, [x25+8]
0043360cb 0x433610
00433610
00433610loc_433610:
00433610str x0, [x1+8]
00433614ldr x2, [sp+256]
00433618ldrsb x27, [x2]
0043361cb 0x433620
00433620
00433620loc_433620:
00433620str x2, [sp+264]
00433624orr x4, xzr, 1
00433628str x4, [sp+272]
0043362cstr x4, [sp+280]
00433630adrp x0, 0x280000
00433634add x0, x0, 648
00433638orr x1, xzr, 12
0043363cmov x3, x4
00433640bl fmt.Sprintf
00433644str x0, [sp+176]
00433648str x1, [sp+184]
0043364cstr xzr, [sp+304]
00433650stp xzr, xzr, [sp+288]
00433654ldr x0, [sp+176]
00433658ldr x1, [sp+184]
0043365cbl os.Open
00433660str x0, [sp+304]
00433664str x1, [sp+288]
00433668str x2, [sp+296]
0043366cldr x5, [sp+304]
00433670str x5, [sp+240]
00433674ldr x5, [sp+296]
00433678ldr x6, [sp+288]
0043367cstr x6, [sp+224]
00433680str x5, [sp+232]
00433684ldr x5, [sp+240]
00433688str x5, [sp+168]
0043368cldr x5, [sp+232]
00433690ldr x6, [sp+224]
00433694str x6, [sp+192]
00433698str x5, [sp+200]
0043369ccbnz x6, 0x4336a4
004336a0b 0x4336cc
004336a4
004336a4loc_4336a4:
004336a4stp xzr, xzr, [sp+128]
004336a8ldr x3, [sp+200]
004336acldr x2, [sp+192]
004336b0str x2, [sp+112]
004336b4str x3, [sp+120]
004336b8ldr x0, [sp+128]
004336bcldr x1, [sp+136]
004336c0ldp x29, x30, [sp-8]
004336c4add sp, sp, 352
004336c8ret x30
004336cc
004336ccloc_4336cc:
004336ccstp xzr, xzr, [sp+288]
004336d0ldr x0, [sp+168]
004336d4movz x1, 18
004336d8mov x2, xzr
004336dcbl os.(*File).Seek
004336e0str x0, [sp+96]
004336e4str x1, [sp+288]
004336e8str x2, [sp+296]
004336ecldr x3, [sp+96]
004336f0str x3, [sp+80]
004336f4str x1, [sp+208]
004336f8str x2, [sp+216]
004336fcstr x1, [sp+192]
00433700str x2, [sp+200]
00433704cbnz x1, 0x43370c
00433708b 0x433734
0043370c
0043370cloc_43370c:
0043370cstp xzr, xzr, [sp+128]
00433710ldr x3, [sp+200]
00433714ldr x2, [sp+192]
00433718str x2, [sp+112]
0043371cstr x3, [sp+120]
00433720ldr x0, [sp+128]
00433724ldr x1, [sp+136]
00433728ldp x29, x30, [sp-8]
0043372cadd sp, sp, 352
00433730ret x30
00433734
00433734loc_433734:
00433734adrp x0, 0x1c2000
00433738add x0, x0, 3072
0043373corr x1, xzr, 2
00433740mov x2, x1
00433744bl runtime.makeslice
00433748str x0, [sp+144]
0043374corr x5, xzr, 2
00433750str x5, [sp+152]
00433754str x5, [sp+160]
00433758ldr x3, [sp+168]
0043375cstr x3, [sp+304]
00433760stp xzr, xzr, [sp+288]
00433764ldr x2, [sp+144]
00433768ldr x3, [sp+152]
0043376cldr x4, [sp+160]
00433770ldr x1, [sp+304]
00433774adrp x0, 0x2e0000
00433778add x0, x0, 2456
0043377cbl io.ReadAtLeast
00433780str x0, [sp+88]
00433784str x1, [sp+288]
00433788str x2, [sp+296]
0043378cldr x3, [sp+88]
00433790str x3, [sp+104]
00433794str x1, [sp+328]
00433798str x2, [sp+336]
0043379cldr x3, [sp+104]
004337a0str x3, [sp+72]
004337a4str x1, [sp+192]
004337a8str x2, [sp+200]
004337acldr x0, [sp+168]
004337b0bl os.(*File).Close
004337b4ldr x3, [sp+192]
004337b8subs xzr, x3, 0
004337bccset x4, ne
004337c0strb w4, [sp+71]
004337c4cbnz x3, 0x4337cc
004337c8b 0x4337d0
004337cc
004337ccloc_4337cc:
004337ccb 0x4337e4
004337d0
004337d0loc_4337d0:
004337d0ldr x4, [sp+72]
004337d4subs xzr, x4, 2
004337d8cset x4, lt
004337dcstrb w4, [sp+71]
004337e0b 0x4337e4
004337e4
004337e4loc_4337e4:
004337e4ldrb w4, [sp+71]
004337e8tbnz w4, 0, 0x4337f0
004337ecb 0x433814
004337f0
004337f0loc_4337f0:
004337f0stp xzr, xzr, [sp+128]
004337f4stp xzr, xzr, [sp+112]
004337f8ldr x1, [sp+136]
004337fcldr x0, [sp+128]
00433800mov x2, xzr
00433804mov x3, xzr
00433808ldp x29, x30, [sp-8]
0043380cadd sp, sp, 352
00433810ret x30
00433814
00433814loc_433814:
00433814ldr x1, [sp+152]
00433818ldr x4, [sp+144]
0043381csubs xzr, x1, 0
00433820b.hi 0x433828
00433824b 0x433954
00433828
00433828loc_433828:
00433828ldrb w4, [x4]
0043382csubs wzr, w4, 179
00433830b.eq 0x433838
00433834b 0x43386c
00433838
00433838loc_433838:
00433838adrp x4, 0x27d000
0043383cadd x4, x4, 3969
00433840str x4, [sp+128]
00433844orr x4, xzr, 7
00433848str x4, [sp+136]
0043384cstp xzr, xzr, [sp+112]
00433850ldr x0, [sp+128]
00433854ldr x1, [sp+136]
00433858mov x2, xzr
0043385cmov x3, xzr
00433860ldp x29, x30, [sp-8]
00433864add sp, sp, 352
00433868ret x30
0043386c
0043386cloc_43386c:
0043386cldr x1, [sp+152]
00433870ldr x4, [sp+144]
00433874subs xzr, x1, 0
00433878b.hi 0x433880
0043387cb 0x43394c
00433880
00433880loc_433880:
00433880ldrb w4, [x4]
00433884subs wzr, w4, 3
00433888b.eq 0x433890
0043388cb 0x4338c4
00433890
00433890loc_433890:
00433890adrp x4, 0x27d000
00433894add x4, x4, 552
00433898str x4, [sp+128]
0043389corr x4, xzr, 3
004338a0str x4, [sp+136]
004338a4stp xzr, xzr, [sp+112]
004338a8ldr x0, [sp+128]
004338acldr x1, [sp+136]
004338b0mov x2, xzr
004338b4mov x3, xzr
004338b8ldp x29, x30, [sp-8]
004338bcadd sp, sp, 352
004338c0ret x30
004338c4
004338c4loc_4338c4:
004338c4ldr x1, [sp+152]
004338c8ldr x4, [sp+144]
004338ccsubs xzr, x1, 0
004338d0b.hi 0x4338d8
004338d4b 0x433944
004338d8
004338d8loc_4338d8:
004338d8ldrb w4, [x4]
004338dcsubs wzr, w4, 62
004338e0b.eq 0x4338e8
004338e4b 0x43391c
004338e8
004338e8loc_4338e8:
004338e8adrp x4, 0x27d000
004338ecadd x4, x4, 2923
004338f0str x4, [sp+128]
004338f4orr x4, xzr, 6
004338f8str x4, [sp+136]
004338fcstp xzr, xzr, [sp+112]
00433900ldr x0, [sp+128]
00433904ldr x1, [sp+136]
00433908mov x2, xzr
0043390cmov x3, xzr
00433910ldp x29, x30, [sp-8]
00433914add sp, sp, 352
00433918ret x30
0043391c
0043391cloc_43391c:
0043391cstp xzr, xzr, [sp+128]
00433920ldr x3, [sp+200]
00433924ldr x2, [sp+192]
00433928str x2, [sp+112]
0043392cstr x3, [sp+120]
00433930ldr x0, [sp+128]
00433934ldr x1, [sp+136]
00433938ldp x29, x30, [sp-8]
0043393cadd sp, sp, 352
00433940ret x30
00433944
00433944loc_433944:
00433944mov x0, xzr
00433948bl runtime.panicIndex
0043394c
0043394cloc_43394c:
0043394cmov x0, xzr
00433950bl runtime.panicIndex
00433954
00433954loc_433954:
00433954mov x0, xzr
00433958bl runtime.panicIndex
0043395chint
00433960
00433960loc_433960:
00433960str x0, [sp+8]
00433964mov x3, x30
00433968bl runtime.morestack_noctxt.abi0
0043396cldr x0, [sp+8]
00433970b 0x433590
00433974udf 0
00433978udf 0
0043397cudf 0
00433590