Similarity

00432a90
00432a90github.com/bishopfox/sliver/implant/sliver/ps.Processes: ; void github.com/bishopfox/sliver/implant/sliver/ps.Processes(bool fullInfo)
00432a90ldr x16, [x28+16]
00432a94sub x17, sp, 16
00432a98subs xzr, x17, x16
00432a9cb.ls 0x432b4c
00432aa0str x30, [sp-144]!
00432aa4stur x29, [sp-8]
00432aa8sub x29, sp, 8
00432aacstrb w0, [sp+152]
00432ab0str xzr, [sp+32]
00432ab4stp xzr, xzr, [sp+40]
00432ab8stp xzr, xzr, [sp+16]
00432abcstr xzr, [sp+72]
00432ac0stp xzr, xzr, [sp+80]
00432ac4stp xzr, xzr, [sp+56]
00432ac8ldrb w0, [sp+152]
00432accbl github.com/bishopfox/sliver/implant/sliver/ps.processes
00432ad0str x0, [sp+72]
00432ad4str x1, [sp+80]
00432ad8str x2, [sp+88]
00432adcstr x3, [sp+56]
00432ae0str x4, [sp+64]
00432ae4ldr x1, [sp+72]
00432ae8ldr x2, [sp+80]
00432aecldr x3, [sp+88]
00432af0str x1, [sp+112]
00432af4str x2, [sp+120]
00432af8str x3, [sp+128]
00432afcldr x1, [sp+56]
00432b00ldr x2, [sp+64]
00432b04str x1, [sp+96]
00432b08str x2, [sp+104]
00432b0cldr x1, [sp+112]
00432b10ldr x2, [sp+120]
00432b14ldr x3, [sp+128]
00432b18str x1, [sp+32]
00432b1cstr x2, [sp+40]
00432b20str x3, [sp+48]
00432b24ldr x3, [sp+96]
00432b28ldr x4, [sp+104]
00432b2cstr x3, [sp+16]
00432b30str x4, [sp+24]
00432b34ldr x0, [sp+32]
00432b38ldr x1, [sp+40]
00432b3cldr x2, [sp+48]
00432b40ldur x29, [sp-8]
00432b44ldr x30, [sp], 144
00432b48ret x30
00432b4c
00432b4cloc_432b4c:
00432b4cstrb w0, [sp+8]
00432b50mov x3, x30
00432b54bl runtime.morestack_noctxt.abi0
00432b58ldrb w0, [sp+8]
00432b5cb 0x432a90
00432a90

00432b60
00432b60github.com/bishopfox/sliver/implant/sliver/ps.Kill: ; void github.com/bishopfox/sliver/implant/sliver/ps.Kill(int pid)
00432b60ldr x16, [x28+16]
00432b64subs xzr, sp, x16
00432b68b.ls 0x432c0c
00432b6cstr x30, [sp-112]!
00432b70stur x29, [sp-8]
00432b74sub x29, sp, 8
00432b78str x0, [sp+120]
00432b7cstp xzr, xzr, [sp+16]
00432b80str xzr, [sp+72]
00432b84stp xzr, xzr, [sp+56]
00432b88ldr x0, [sp+120]
00432b8cbl os.FindProcess
00432b90str x0, [sp+72]
00432b94str x1, [sp+56]
00432b98str x2, [sp+64]
00432b9cldr x1, [sp+72]
00432ba0str x1, [sp+96]
00432ba4ldr x1, [sp+56]
00432ba8ldr x2, [sp+64]
00432bacstr x1, [sp+80]
00432bb0str x2, [sp+88]
00432bb4ldr x1, [sp+96]
00432bb8str x1, [sp+32]
00432bbcldr x1, [sp+88]
00432bc0ldr x0, [sp+80]
00432bc4str x0, [sp+40]
00432bc8str x1, [sp+48]
00432bcccbnz x0, 0x432bd4
00432bd0b 0x432be8
00432bd4
00432bd4loc_432bd4:
00432bd4str x0, [sp+16]
00432bd8str x1, [sp+24]
00432bdcldur x29, [sp-8]
00432be0ldr x30, [sp], 112
00432be4ret x30
00432be8
00432be8loc_432be8:
00432be8ldr x0, [sp+32]
00432becbl os.(*Process).Kill
00432bf0str x0, [sp+56]
00432bf4str x1, [sp+64]
00432bf8str x0, [sp+16]
00432bfcstr x1, [sp+24]
00432c00ldur x29, [sp-8]
00432c04ldr x30, [sp], 112
00432c08ret x30
00432c0c
00432c0cloc_432c0c:
00432c0cstr x0, [sp+8]
00432c10mov x3, x30
00432c14bl runtime.morestack_noctxt.abi0
00432c18ldr x0, [sp+8]
00432c1cb 0x432b60
00432b60

00432c20
00432c20github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Pid: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Pid(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432c20str x30, [sp-32]!
00432c24stur x29, [sp-8]
00432c28sub x29, sp, 8
00432c2cstr x0, [sp+40]
00432c30str xzr, [sp+16]
00432c34ldrsb x27, [x0]
00432c38ldr x0, [x0]
00432c3cstr x0, [sp+16]
00432c40add x29, sp, 24
00432c44add sp, sp, 32
00432c48ret x30
00432c4cudf 0
00432c20

00432c50
00432c50github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).PPid: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).PPid(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432c50str x30, [sp-32]!
00432c54stur x29, [sp-8]
00432c58sub x29, sp, 8
00432c5cstr x0, [sp+40]
00432c60str xzr, [sp+16]
00432c64ldrsb x27, [x0]
00432c68ldr x0, [x0+8]
00432c6cstr x0, [sp+16]
00432c70add x29, sp, 24
00432c74add sp, sp, 32
00432c78ret x30
00432c7cudf 0
00432c50

00432c80
00432c80github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Executable: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Executable(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432c80str x30, [sp-32]!
00432c84stur x29, [sp-8]
00432c88sub x29, sp, 8
00432c8cstr x0, [sp+40]
00432c90stp xzr, xzr, [sp+8]
00432c94ldr x2, [sp+40]
00432c98ldrsb x27, [x2]
00432c9cldr x0, [x2+80]
00432ca0ldr x1, [x2+88]
00432ca4str x0, [sp+8]
00432ca8str x1, [sp+16]
00432cacadd x29, sp, 24
00432cb0add sp, sp, 32
00432cb4ret x30
00432cb8udf 0
00432cbcudf 0
00432c80

00432cc0
00432cc0github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Owner: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Owner(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432cc0str x30, [sp-32]!
00432cc4stur x29, [sp-8]
00432cc8sub x29, sp, 8
00432cccstr x0, [sp+40]
00432cd0stp xzr, xzr, [sp+8]
00432cd4ldr x2, [sp+40]
00432cd8ldrsb x27, [x2]
00432cdcldr x0, [x2+96]
00432ce0ldr x1, [x2+104]
00432ce4str x0, [sp+8]
00432ce8str x1, [sp+16]
00432cecadd x29, sp, 24
00432cf0add sp, sp, 32
00432cf4ret x30
00432cf8udf 0
00432cfcudf 0
00432cc0

00432d00
00432d00github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).CmdLine: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).CmdLine(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432d00str x30, [sp-48]!
00432d04stur x29, [sp-8]
00432d08sub x29, sp, 8
00432d0cstr x0, [sp+56]
00432d10str xzr, [sp+16]
00432d14stp xzr, xzr, [sp+24]
00432d18ldr x3, [sp+56]
00432d1cldrsb x27, [x3]
00432d20ldr x0, [x3+56]
00432d24ldr x1, [x3+64]
00432d28ldr x2, [x3+72]
00432d2cstr x0, [sp+16]
00432d30str x1, [sp+24]
00432d34str x2, [sp+32]
00432d38add x29, sp, 40
00432d3cadd sp, sp, 48
00432d40ret x30
00432d44udf 0
00432d48udf 0
00432d4cudf 0
00432d00

00432d50
00432d50github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Architecture: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Architecture(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00432d50str x30, [sp-32]!
00432d54stur x29, [sp-8]
00432d58sub x29, sp, 8
00432d5cstr x0, [sp+40]
00432d60stp xzr, xzr, [sp+8]
00432d64ldr x2, [sp+40]
00432d68ldrsb x27, [x2]
00432d6cldr x0, [x2+40]
00432d70ldr x1, [x2+48]
00432d74str x0, [sp+8]
00432d78str x1, [sp+16]
00432d7cadd x29, sp, 24
00432d80add sp, sp, 32
00432d84ret x30
00432d88udf 0
00432d8cudf 0
00432d50

00432d90
00432d90github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid(int pid)
00432d90ldr x16, [x28+16]
00432d94sub x17, sp, 368
00432d98subs xzr, x17, x16
00432d9cb.ls 0x43303c
00432da0sub x20, sp, 496
00432da4stp x29, x30, [x20-8]
00432da8add sp, x20, 0
00432dacsub x29, sp, 8
00432db0str x0, [sp+504]
00432db4str wzr, [sp+60]
00432db8stp xzr, xzr, [sp+248]
00432dbcstp xzr, xzr, [sp+472]
00432dc0add x1, sp, 472
00432dc4str x1, [sp+416]
00432dc8ldr x0, [sp+504]
00432dccbl runtime.convT64
00432dd0str x0, [sp+408]
00432dd4ldr x1, [sp+416]
00432dd8ldrsb x27, [x1]
00432ddcadrp x2, 0x1c3000
00432de0add x2, x2, 3520
00432de4str x2, [x1]
00432de8adrp x27, 0x619000
00432decldr w2, [x27+3056]
00432df0cbz w2, 0x432df8
00432df4b 0x432dfc
00432df8
00432df8loc_432df8:
00432df8b 0x432e10
00432dfc
00432dfcloc_432dfc:
00432dfcbl runtime.gcWriteBarrier2
00432e00str x0, [x25]
00432e04ldr x5, [x1+8]
00432e08str x5, [x25+8]
00432e0cb 0x432e10
00432e10
00432e10loc_432e10:
00432e10str x0, [x1+8]
00432e14ldr x2, [sp+416]
00432e18ldrsb x27, [x2]
00432e1cb 0x432e20
00432e20
00432e20loc_432e20:
00432e20str x2, [sp+424]
00432e24orr x4, xzr, 1
00432e28str x4, [sp+432]
00432e2cstr x4, [sp+440]
00432e30adrp x0, 0x281000
00432e34add x0, x0, 2291
00432e38movz x1, 13
00432e3cmov x3, x4
00432e40bl fmt.Sprintf
00432e44str x0, [sp+264]
00432e48str x1, [sp+272]
00432e4cstr xzr, [sp+464]
00432e50stp xzr, xzr, [sp+448]
00432e54ldr x0, [sp+264]
00432e58ldr x1, [sp+272]
00432e5cbl os.Open
00432e60str x0, [sp+464]
00432e64str x1, [sp+448]
00432e68str x2, [sp+456]
00432e6cldr x5, [sp+464]
00432e70str x5, [sp+336]
00432e74ldr x5, [sp+456]
00432e78ldr x6, [sp+448]
00432e7cstr x6, [sp+320]
00432e80str x5, [sp+328]
00432e84ldr x5, [sp+336]
00432e88str x5, [sp+288]
00432e8cldr x5, [sp+328]
00432e90ldr x6, [sp+320]
00432e94str x6, [sp+296]
00432e98str x5, [sp+304]
00432e9ccbnz x6, 0x432ea4
00432ea0b 0x432ed4
00432ea4
00432ea4loc_432ea4:
00432ea4str wzr, [sp+60]
00432ea8ldr x0, [sp+296]
00432eacldr x1, [sp+304]
00432eb0str x0, [sp+248]
00432eb4str x1, [sp+256]
00432eb8bl runtime.deferreturn
00432ebcldr w0, [sp+60]
00432ec0ldr x1, [sp+248]
00432ec4ldr x2, [sp+256]
00432ec8ldp x29, x30, [sp-8]
00432eccadd sp, sp, 496
00432ed0ret x30
00432ed4
00432ed4loc_432ed4:
00432ed4ldr x1, [sp+288]
00432ed8str x1, [sp+312]
00432edcstp xzr, xzr, [sp+384]
00432ee0add x1, sp, 384
00432ee4str x1, [sp+400]
00432ee8ldrsb x27, [x1]
00432eecadrp x2, 4096
00432ef0add x2, x2, 80
00432ef4str x2, [x1]
00432ef8ldrsb x27, [x1]
00432efcldr x2, [sp+312]
00432f00adrp x27, 0x619000
00432f04ldr w3, [x27+3056]
00432f08cbz w3, 0x432f10
00432f0cb 0x432f14
00432f10
00432f10loc_432f10:
00432f10b 0x432f28
00432f14
00432f14loc_432f14:
00432f14bl runtime.gcWriteBarrier2
00432f18str x2, [x25]
00432f1cldr x3, [x1+8]
00432f20str x3, [x25+8]
00432f24b 0x432f28
00432f28
00432f28loc_432f28:
00432f28str x2, [x1+8]
00432f2cstr x1, [sp+88]
00432f30add x0, sp, 64
00432f34bl runtime.deferprocStack
00432f38subs xzr, x0, 0
00432f3cb.ne 0x433020
00432f40b 0x432f44
00432f44
00432f44loc_432f44:
00432f44add x20, sp, 112
00432f48adr x27, 16
00432f4cstp x29, x27, [sp-24]
00432f50sub x29, sp, 24
00432f54bl fn_87cf0
00432f58sub x29, sp, 8
00432f5cadd x20, sp, 112
00432f60str x20, [sp+376]
00432f64ldrsb x27, [x20]
00432f68adr x27, 16
00432f6cstp x29, x27, [sp-24]
00432f70sub x29, sp, 24
00432f74bl fn_87cf0
00432f78sub x29, sp, 8
00432f7cldr x1, [sp+376]
00432f80str x1, [sp+280]
00432f84ldr x0, [sp+288]
00432f88bl os.(*File).Fd
00432f8cstr x0, [sp+240]
00432f90ldr x1, [sp+280]
00432f94bl syscall.Fstat
00432f98str x0, [sp+296]
00432f9cstr x1, [sp+304]
00432fa0cbnz x0, 0x432fa8
00432fa4b 0x432fe0
00432fa8
00432fa8loc_432fa8:
00432fa8str x0, [sp+360]
00432facstr x1, [sp+368]
00432fb0str wzr, [sp+60]
00432fb4ldr x0, [sp+360]
00432fb8ldr x1, [sp+368]
00432fbcstr x0, [sp+248]
00432fc0str x1, [sp+256]
00432fc4bl runtime.deferreturn
00432fc8ldr w0, [sp+60]
00432fccldr x1, [sp+248]
00432fd0ldr x2, [sp+256]
00432fd4ldp x29, x30, [sp-8]
00432fd8add sp, sp, 496
00432fdcret x30
00432fe0
00432fe0loc_432fe0:
00432fe0stp xzr, xzr, [sp+344]
00432fe4ldr x0, [sp+280]
00432fe8ldrsb x27, [x0]
00432fecldr w0, [x0+24]
00432ff0str w0, [sp+60]
00432ff4ldr x0, [sp+344]
00432ff8ldr x1, [sp+352]
00432ffcstr x0, [sp+248]
00433000str x1, [sp+256]
00433004bl runtime.deferreturn
00433008ldr w0, [sp+60]
0043300cldr x1, [sp+248]
00433010ldr x2, [sp+256]
00433014ldp x29, x30, [sp-8]
00433018add sp, sp, 496
0043301cret x30
00433020
00433020loc_433020:
00433020bl runtime.deferreturn
00433024ldr w0, [sp+60]
00433028ldr x1, [sp+248]
0043302cldr x2, [sp+256]
00433030ldp x29, x30, [sp-8]
00433034add sp, sp, 496
00433038ret x30
0043303c
0043303cloc_43303c:
0043303cstr x0, [sp+8]
00433040mov x3, x30
00433044bl runtime.morestack_noctxt.abi0
00433048ldr x0, [sp+8]
0043304cb 0x432d90
00432d90

00433050
00433050github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid.deferwrap1: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid.deferwrap1(void)
00433050ldr x16, [x28+16]
00433054subs xzr, sp, x16
00433058b.ls 0x433088
0043305cstr x30, [sp-32]!
00433060stur x29, [sp-8]
00433064sub x29, sp, 8
00433068ldr x16, [x28+32]
0043306ccbnz x16, 0x433094
00433070
00433070loc_433070:
00433070ldr x0, [x26+8]
00433074str x0, [sp+16]
00433078bl os.(*File).Close
0043307cldur x29, [sp-8]
00433080ldr x30, [sp], 32
00433084ret x30
00433088
00433088loc_433088:
00433088mov x3, x30
0043308cbl runtime.morestack.abi0
00433090b 0x433050
00433094
00433094loc_433094:
00433094ldr x17, [x16]
00433098add x20, sp, 40
0043309csubs xzr, x20, x17
004330a0b.ne 0x433070
004330a4add x20, sp, 8
004330a8str x20, [x16]
004330acb 0x433070
00433050

004330b0
004330b0github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwner: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwner(int pid)
004330b0ldr x16, [x28+16]
004330b4sub x17, sp, 176
004330b8subs xzr, x17, x16
004330bcb.ls 0x433330
004330c0sub x20, sp, 304
004330c4stp x29, x30, [x20-8]
004330c8add sp, x20, 0
004330ccsub x29, sp, 8
004330d0str x0, [sp+312]
004330d4stp xzr, xzr, [sp+80]
004330d8stp xzr, xzr, [sp+64]
004330dcstp xzr, xzr, [sp+280]
004330e0ldr x0, [sp+312]
004330e4bl github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwnerUid
004330e8str w0, [sp+60]
004330ecstr x1, [sp+280]
004330f0str x2, [sp+288]
004330f4ldr w1, [sp+60]
004330f8str w1, [sp+56]
004330fcldr x1, [sp+280]
00433100ldr x2, [sp+288]
00433104str x1, [sp+144]
00433108str x2, [sp+152]
0043310cldr w1, [sp+56]
00433110str w1, [sp+52]
00433114ldr x1, [sp+152]
00433118ldr x2, [sp+144]
0043311cstr x2, [sp+104]
00433120str x1, [sp+112]
00433124cbnz x2, 0x43312c
00433128b 0x433154
0043312c
0043312cloc_43312c:
0043312cstp xzr, xzr, [sp+80]
00433130ldr x3, [sp+112]
00433134ldr x2, [sp+104]
00433138str x2, [sp+64]
0043313cstr x3, [sp+72]
00433140ldr x0, [sp+80]
00433144ldr x1, [sp+88]
00433148ldp x29, x30, [sp-8]
0043314cadd sp, sp, 304
00433150ret x30
00433154
00433154loc_433154:
00433154stp xzr, xzr, [sp+264]
00433158add x1, sp, 264
0043315cstr x1, [sp+208]
00433160ldr w0, [sp+52]
00433164bl runtime.convT32
00433168str x0, [sp+200]
0043316cldr x1, [sp+208]
00433170ldrsb x27, [x1]
00433174adrp x2, 0x1c2000
00433178add x2, x2, 3328
0043317cstr x2, [x1]
00433180adrp x27, 0x618000
00433184ldr w2, [x27+3056]
00433188cbz w2, 0x433190
0043318cb 0x433194
00433190
00433190loc_433190:
00433190b 0x4331a8
00433194
00433194loc_433194:
00433194bl runtime.gcWriteBarrier2
00433198str x0, [x25]
0043319cldr x5, [x1+8]
004331a0str x5, [x25+8]
004331a4b 0x4331a8
004331a8
004331a8loc_4331a8:
004331a8str x0, [x1+8]
004331acldr x2, [sp+208]
004331b0ldrsb x27, [x2]
004331b4b 0x4331b8
004331b8
004331b8loc_4331b8:
004331b8str x2, [sp+216]
004331bcorr x4, xzr, 1
004331c0str x4, [sp+224]
004331c4str x4, [sp+232]
004331c8adrp x0, 0x27d000
004331ccadd x0, x0, 21
004331d0orr x1, xzr, 2
004331d4mov x3, x4
004331d8bl fmt.Sprintf
004331dcstr x0, [sp+248]
004331e0str x1, [sp+256]
004331e4str xzr, [sp+240]
004331e8stp xzr, xzr, [sp+280]
004331ecldr x0, [sp+248]
004331f0ldr x1, [sp+256]
004331f4bl os/user.LookupId
004331f8str x0, [sp+240]
004331fcstr x1, [sp+280]
00433200str x2, [sp+288]
00433204ldr x5, [sp+240]
00433208str x5, [sp+136]
0043320cldr x5, [sp+280]
00433210ldr x6, [sp+288]
00433214str x5, [sp+120]
00433218str x6, [sp+128]
0043321cldr x5, [sp+136]
00433220str x5, [sp+96]
00433224ldr x5, [sp+128]
00433228ldr x6, [sp+120]
0043322cstr x6, [sp+104]
00433230str x5, [sp+112]
00433234cbnz x6, 0x43323c
00433238b 0x4332f4
0043323c
0043323cloc_43323c:
0043323cstp xzr, xzr, [sp+264]
00433240add x1, sp, 264
00433244str x1, [sp+168]
00433248ldr w0, [sp+52]
0043324cbl runtime.convT32
00433250str x0, [sp+160]
00433254ldr x1, [sp+168]
00433258ldrsb x27, [x1]
0043325cadrp x2, 0x1c2000
00433260add x2, x2, 3328
00433264str x2, [x1]
00433268adrp x27, 0x618000
0043326cldr w2, [x27+3056]
00433270cbz w2, 0x433278
00433274b 0x43327c
00433278
00433278loc_433278:
00433278b 0x433290
0043327c
0043327cloc_43327c:
0043327cbl runtime.gcWriteBarrier2
00433280str x0, [x25]
00433284ldr x5, [x1+8]
00433288str x5, [x25+8]
0043328cb 0x433290
00433290
00433290loc_433290:
00433290str x0, [x1+8]
00433294ldr x2, [sp+168]
00433298ldrsb x27, [x2]
0043329cb 0x4332a0
004332a0
004332a0loc_4332a0:
004332a0str x2, [sp+176]
004332a4orr x4, xzr, 1
004332a8str x4, [sp+184]
004332acstr x4, [sp+192]
004332b0adrp x0, 0x27d000
004332b4add x0, x0, 21
004332b8orr x1, xzr, 2
004332bcmov x3, x4
004332c0bl fmt.Sprintf
004332c4str x0, [sp+248]
004332c8str x1, [sp+256]
004332ccstr x0, [sp+80]
004332d0str x1, [sp+88]
004332d4stp xzr, xzr, [sp+64]
004332d8ldr x0, [sp+80]
004332dcldr x1, [sp+88]
004332e0mov x2, xzr
004332e4mov x3, xzr
004332e8ldp x29, x30, [sp-8]
004332ecadd sp, sp, 304
004332f0ret x30
004332f4
004332f4loc_4332f4:
004332f4ldr x4, [sp+96]
004332f8ldrsb x27, [x4]
004332fcldr x5, [x4+32]
00433300ldr x4, [x4+40]
00433304str x5, [sp+80]
00433308str x4, [sp+88]
0043330cldr x2, [sp+104]
00433310ldr x3, [sp+112]
00433314str x2, [sp+64]
00433318str x3, [sp+72]
0043331cldr x0, [sp+80]
00433320ldr x1, [sp+88]
00433324ldp x29, x30, [sp-8]
00433328add sp, sp, 304
0043332cret x30
00433330
00433330loc_433330:
00433330str x0, [sp+8]
00433334mov x3, x30
00433338bl runtime.morestack_noctxt.abi0
0043333cldr x0, [sp+8]
00433340b 0x4330b0
00433344udf 0
00433348udf 0
0043334cudf 0
004330b0

00433350
00433350github.com/bishopfox/sliver/implant/sliver/ps.getProcessCmdLine: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessCmdLine(int pid)
00433350ldr x16, [x28+16]
00433354sub x17, sp, 208
00433358subs xzr, x17, x16
0043335cb.ls 0x433578
00433360sub x20, sp, 336
00433364stp x29, x30, [x20-8]
00433368add sp, x20, 0
0043336csub x29, sp, 8
00433370str x0, [sp+344]
00433374stp xzr, xzr, [sp+64]
00433378str xzr, [sp+80]
0043337cstp xzr, xzr, [sp+48]
00433380stp xzr, xzr, [sp+168]
00433384add x1, sp, 168
00433388str x1, [sp+256]
0043338cldr x0, [sp+344]
00433390bl runtime.convT64
00433394str x0, [sp+248]
00433398ldr x1, [sp+256]
0043339cldrsb x27, [x1]
004333a0adrp x2, 0x1c2000
004333a4add x2, x2, 3520
004333a8str x2, [x1]
004333acadrp x27, 0x618000
004333b0ldr w2, [x27+3056]
004333b4cbz w2, 0x4333bc
004333b8b 0x4333c0
004333bc
004333bcloc_4333bc:
004333bcb 0x4333d4
004333c0
004333c0loc_4333c0:
004333c0bl runtime.gcWriteBarrier2
004333c4str x0, [x25]
004333c8ldr x5, [x1+8]
004333ccstr x5, [x25+8]
004333d0b 0x4333d4
004333d4
004333d4loc_4333d4:
004333d4str x0, [x1+8]
004333d8ldr x2, [sp+256]
004333dcldrsb x27, [x2]
004333e0b 0x4333e4
004333e4
004333e4loc_4333e4:
004333e4str x2, [sp+264]
004333e8orr x4, xzr, 1
004333ecstr x4, [sp+272]
004333f0str x4, [sp+280]
004333f4adrp x0, 0x281000
004333f8add x0, x0, 3300
004333fcorr x1, xzr, 16
00433400mov x3, x4
00433404bl fmt.Sprintf
00433408str x0, [sp+128]
0043340cstr x1, [sp+136]
00433410str xzr, [sp+304]
00433414stp xzr, xzr, [sp+312]
00433418stp xzr, xzr, [sp+288]
0043341cldr x0, [sp+128]
00433420ldr x1, [sp+136]
00433424bl os.ReadFile
00433428str x0, [sp+304]
0043342cstr x1, [sp+312]
00433430str x2, [sp+320]
00433434str x3, [sp+288]
00433438str x4, [sp+296]
0043343cldr x5, [sp+312]
00433440ldr x6, [sp+320]
00433444ldr x7, [sp+304]
00433448str x7, [sp+200]
0043344cstr x5, [sp+208]
00433450str x6, [sp+216]
00433454ldr x5, [sp+288]
00433458ldr x6, [sp+296]
0043345cstr x5, [sp+184]
00433460str x6, [sp+192]
00433464ldr x5, [sp+200]
00433468ldr x6, [sp+208]
0043346cldr x7, [sp+216]
00433470str x5, [sp+104]
00433474str x6, [sp+112]
00433478str x7, [sp+120]
0043347cldr x5, [sp+192]
00433480ldr x6, [sp+184]
00433484str x6, [sp+88]
00433488str x5, [sp+96]
0043348ccbnz x6, 0x433494
00433490b 0x433514
00433494
00433494loc_433494:
00433494adrp x0, 0x1ca000
00433498add x0, x0, 1568
0043349cbl runtime.newobject
004334a0str x0, [sp+240]
004334a4str xzr, [x0+8]
004334a8adrp x27, 0x618000
004334acldr w1, [x27+3056]
004334b0cbz w1, 0x4334b8
004334b4b 0x4334bc
004334b8
004334b8loc_4334b8:
004334b8b 0x4334cc
004334bc
004334bcloc_4334bc:
004334bcldr x5, [x0]
004334c0bl runtime.gcWriteBarrier1
004334c4str x5, [x25]
004334c8b 0x4334cc
004334cc
004334ccloc_4334cc:
004334ccstr xzr, [x0]
004334d0ldr x5, [sp+240]
004334d4ldrsb x27, [x5]
004334d8b 0x4334dc
004334dc
004334dcloc_4334dc:
004334dcstr x5, [sp+64]
004334e0orr x5, xzr, 1
004334e4str x5, [sp+72]
004334e8str x5, [sp+80]
004334ecldr x3, [sp+88]
004334f0ldr x4, [sp+96]
004334f4str x3, [sp+48]
004334f8str x4, [sp+56]
004334fcldr x0, [sp+64]
00433500ldr x1, [sp+72]
00433504ldr x2, [sp+80]
00433508ldp x29, x30, [sp-8]
0043350cadd sp, sp, 336
00433510ret x30
00433514
00433514loc_433514:
00433514ldr x1, [sp+104]
00433518ldr x2, [sp+112]
0043351cmov x0, xzr
00433520bl runtime.slicebytetostring
00433524str x0, [sp+224]
00433528str x1, [sp+232]
0043352cadrp x2, 0x2dd000
00433530add x2, x2, 3040
00433534orr x3, xzr, 1
00433538bl strings.Split
0043353cstr x0, [sp+144]
00433540str x1, [sp+152]
00433544str x2, [sp+160]
00433548str x0, [sp+64]
0043354cstr x1, [sp+72]
00433550str x2, [sp+80]
00433554stp xzr, xzr, [sp+48]
00433558ldr x0, [sp+64]
0043355cldr x1, [sp+72]
00433560ldr x2, [sp+80]
00433564mov x3, xzr
00433568mov x4, xzr
0043356cldp x29, x30, [sp-8]
00433570add sp, sp, 336
00433574ret x30
00433578
00433578loc_433578:
00433578str x0, [sp+8]
0043357cmov x3, x30
00433580bl runtime.morestack_noctxt.abi0
00433584ldr x0, [sp+8]
00433588b 0x433350
0043358cudf 0
00433350

00433590
00433590github.com/bishopfox/sliver/implant/sliver/ps.getProcessArchitecture: ; void github.com/bishopfox/sliver/implant/sliver/ps.getProcessArchitecture(int pid)
00433590ldr x16, [x28+16]
00433594sub x17, sp, 224
00433598subs xzr, x17, x16
0043359cb.ls 0x433960
004335a0sub x20, sp, 352
004335a4stp x29, x30, [x20-8]
004335a8add sp, x20, 0
004335acsub x29, sp, 8
004335b0str x0, [sp+360]
004335b4stp xzr, xzr, [sp+128]
004335b8stp xzr, xzr, [sp+112]
004335bcstp xzr, xzr, [sp+312]
004335c0add x1, sp, 312
004335c4str x1, [sp+256]
004335c8ldr x0, [sp+360]
004335ccbl runtime.convT64
004335d0str x0, [sp+248]
004335d4ldr x1, [sp+256]
004335d8ldrsb x27, [x1]
004335dcadrp x2, 0x1c2000
004335e0add x2, x2, 3520
004335e4str x2, [x1]
004335e8adrp x27, 0x618000
004335ecldr w2, [x27+3056]
004335f0cbz w2, 0x4335f8
004335f4b 0x4335fc
004335f8
004335f8loc_4335f8:
004335f8b 0x433610
004335fc
004335fcloc_4335fc:
004335fcbl runtime.gcWriteBarrier2
00433600str x0, [x25]
00433604ldr x5, [x1+8]
00433608str x5, [x25+8]
0043360cb 0x433610
00433610
00433610loc_433610:
00433610str x0, [x1+8]
00433614ldr x2, [sp+256]
00433618ldrsb x27, [x2]
0043361cb 0x433620
00433620
00433620loc_433620:
00433620str x2, [sp+264]
00433624orr x4, xzr, 1
00433628str x4, [sp+272]
0043362cstr x4, [sp+280]
00433630adrp x0, 0x280000
00433634add x0, x0, 648
00433638orr x1, xzr, 12
0043363cmov x3, x4
00433640bl fmt.Sprintf
00433644str x0, [sp+176]
00433648str x1, [sp+184]
0043364cstr xzr, [sp+304]
00433650stp xzr, xzr, [sp+288]
00433654ldr x0, [sp+176]
00433658ldr x1, [sp+184]
0043365cbl os.Open
00433660str x0, [sp+304]
00433664str x1, [sp+288]
00433668str x2, [sp+296]
0043366cldr x5, [sp+304]
00433670str x5, [sp+240]
00433674ldr x5, [sp+296]
00433678ldr x6, [sp+288]
0043367cstr x6, [sp+224]
00433680str x5, [sp+232]
00433684ldr x5, [sp+240]
00433688str x5, [sp+168]
0043368cldr x5, [sp+232]
00433690ldr x6, [sp+224]
00433694str x6, [sp+192]
00433698str x5, [sp+200]
0043369ccbnz x6, 0x4336a4
004336a0b 0x4336cc
004336a4
004336a4loc_4336a4:
004336a4stp xzr, xzr, [sp+128]
004336a8ldr x3, [sp+200]
004336acldr x2, [sp+192]
004336b0str x2, [sp+112]
004336b4str x3, [sp+120]
004336b8ldr x0, [sp+128]
004336bcldr x1, [sp+136]
004336c0ldp x29, x30, [sp-8]
004336c4add sp, sp, 352
004336c8ret x30
004336cc
004336ccloc_4336cc:
004336ccstp xzr, xzr, [sp+288]
004336d0ldr x0, [sp+168]
004336d4movz x1, 18
004336d8mov x2, xzr
004336dcbl os.(*File).Seek
004336e0str x0, [sp+96]
004336e4str x1, [sp+288]
004336e8str x2, [sp+296]
004336ecldr x3, [sp+96]
004336f0str x3, [sp+80]
004336f4str x1, [sp+208]
004336f8str x2, [sp+216]
004336fcstr x1, [sp+192]
00433700str x2, [sp+200]
00433704cbnz x1, 0x43370c
00433708b 0x433734
0043370c
0043370cloc_43370c:
0043370cstp xzr, xzr, [sp+128]
00433710ldr x3, [sp+200]
00433714ldr x2, [sp+192]
00433718str x2, [sp+112]
0043371cstr x3, [sp+120]
00433720ldr x0, [sp+128]
00433724ldr x1, [sp+136]
00433728ldp x29, x30, [sp-8]
0043372cadd sp, sp, 352
00433730ret x30
00433734
00433734loc_433734:
00433734adrp x0, 0x1c2000
00433738add x0, x0, 3072
0043373corr x1, xzr, 2
00433740mov x2, x1
00433744bl runtime.makeslice
00433748str x0, [sp+144]
0043374corr x5, xzr, 2
00433750str x5, [sp+152]
00433754str x5, [sp+160]
00433758ldr x3, [sp+168]
0043375cstr x3, [sp+304]
00433760stp xzr, xzr, [sp+288]
00433764ldr x2, [sp+144]
00433768ldr x3, [sp+152]
0043376cldr x4, [sp+160]
00433770ldr x1, [sp+304]
00433774adrp x0, 0x2e0000
00433778add x0, x0, 2456
0043377cbl io.ReadAtLeast
00433780str x0, [sp+88]
00433784str x1, [sp+288]
00433788str x2, [sp+296]
0043378cldr x3, [sp+88]
00433790str x3, [sp+104]
00433794str x1, [sp+328]
00433798str x2, [sp+336]
0043379cldr x3, [sp+104]
004337a0str x3, [sp+72]
004337a4str x1, [sp+192]
004337a8str x2, [sp+200]
004337acldr x0, [sp+168]
004337b0bl os.(*File).Close
004337b4ldr x3, [sp+192]
004337b8subs xzr, x3, 0
004337bccset x4, ne
004337c0strb w4, [sp+71]
004337c4cbnz x3, 0x4337cc
004337c8b 0x4337d0
004337cc
004337ccloc_4337cc:
004337ccb 0x4337e4
004337d0
004337d0loc_4337d0:
004337d0ldr x4, [sp+72]
004337d4subs xzr, x4, 2
004337d8cset x4, lt
004337dcstrb w4, [sp+71]
004337e0b 0x4337e4
004337e4
004337e4loc_4337e4:
004337e4ldrb w4, [sp+71]
004337e8tbnz w4, 0, 0x4337f0
004337ecb 0x433814
004337f0
004337f0loc_4337f0:
004337f0stp xzr, xzr, [sp+128]
004337f4stp xzr, xzr, [sp+112]
004337f8ldr x1, [sp+136]
004337fcldr x0, [sp+128]
00433800mov x2, xzr
00433804mov x3, xzr
00433808ldp x29, x30, [sp-8]
0043380cadd sp, sp, 352
00433810ret x30
00433814
00433814loc_433814:
00433814ldr x1, [sp+152]
00433818ldr x4, [sp+144]
0043381csubs xzr, x1, 0
00433820b.hi 0x433828
00433824b 0x433954
00433828
00433828loc_433828:
00433828ldrb w4, [x4]
0043382csubs wzr, w4, 179
00433830b.eq 0x433838
00433834b 0x43386c
00433838
00433838loc_433838:
00433838adrp x4, 0x27d000
0043383cadd x4, x4, 3969
00433840str x4, [sp+128]
00433844orr x4, xzr, 7
00433848str x4, [sp+136]
0043384cstp xzr, xzr, [sp+112]
00433850ldr x0, [sp+128]
00433854ldr x1, [sp+136]
00433858mov x2, xzr
0043385cmov x3, xzr
00433860ldp x29, x30, [sp-8]
00433864add sp, sp, 352
00433868ret x30
0043386c
0043386cloc_43386c:
0043386cldr x1, [sp+152]
00433870ldr x4, [sp+144]
00433874subs xzr, x1, 0
00433878b.hi 0x433880
0043387cb 0x43394c
00433880
00433880loc_433880:
00433880ldrb w4, [x4]
00433884subs wzr, w4, 3
00433888b.eq 0x433890
0043388cb 0x4338c4
00433890
00433890loc_433890:
00433890adrp x4, 0x27d000
00433894add x4, x4, 552
00433898str x4, [sp+128]
0043389corr x4, xzr, 3
004338a0str x4, [sp+136]
004338a4stp xzr, xzr, [sp+112]
004338a8ldr x0, [sp+128]
004338acldr x1, [sp+136]
004338b0mov x2, xzr
004338b4mov x3, xzr
004338b8ldp x29, x30, [sp-8]
004338bcadd sp, sp, 352
004338c0ret x30
004338c4
004338c4loc_4338c4:
004338c4ldr x1, [sp+152]
004338c8ldr x4, [sp+144]
004338ccsubs xzr, x1, 0
004338d0b.hi 0x4338d8
004338d4b 0x433944
004338d8
004338d8loc_4338d8:
004338d8ldrb w4, [x4]
004338dcsubs wzr, w4, 62
004338e0b.eq 0x4338e8
004338e4b 0x43391c
004338e8
004338e8loc_4338e8:
004338e8adrp x4, 0x27d000
004338ecadd x4, x4, 2923
004338f0str x4, [sp+128]
004338f4orr x4, xzr, 6
004338f8str x4, [sp+136]
004338fcstp xzr, xzr, [sp+112]
00433900ldr x0, [sp+128]
00433904ldr x1, [sp+136]
00433908mov x2, xzr
0043390cmov x3, xzr
00433910ldp x29, x30, [sp-8]
00433914add sp, sp, 352
00433918ret x30
0043391c
0043391cloc_43391c:
0043391cstp xzr, xzr, [sp+128]
00433920ldr x3, [sp+200]
00433924ldr x2, [sp+192]
00433928str x2, [sp+112]
0043392cstr x3, [sp+120]
00433930ldr x0, [sp+128]
00433934ldr x1, [sp+136]
00433938ldp x29, x30, [sp-8]
0043393cadd sp, sp, 352
00433940ret x30
00433944
00433944loc_433944:
00433944mov x0, xzr
00433948bl runtime.panicIndex
0043394c
0043394cloc_43394c:
0043394cmov x0, xzr
00433950bl runtime.panicIndex
00433954
00433954loc_433954:
00433954mov x0, xzr
00433958bl runtime.panicIndex
0043395chint
00433960
00433960loc_433960:
00433960str x0, [sp+8]
00433964mov x3, x30
00433968bl runtime.morestack_noctxt.abi0
0043396cldr x0, [sp+8]
00433970b 0x433590
00433974udf 0
00433978udf 0
0043397cudf 0
00433590

00433980
00433980github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Refresh: ; void github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Refresh(github.com/bishopfox/sliver/implant/sliver/ps.UnixProcess * p)
00433980ldr x16, [x28+16]
00433984sub x17, sp, 400
00433988subs xzr, x17, x16
0043398cb.ls 0x433e18
00433990sub x20, sp, 528
00433994stp x29, x30, [x20-8]
00433998add sp, x20, 0
0043399csub x29, sp, 8
004339a0str x0, [sp+536]
004339a4stp xzr, xzr, [sp+104]
004339a8stp xzr, xzr, [sp+488]
004339acadd x1, sp, 488
004339b0str x1, [sp+304]
004339b4ldr x1, [sp+536]
004339b8ldrsb x27, [x1]
004339bcldr x1, [x1]
004339c0str x1, [sp+80]
004339c4ldr x0, [sp+80]
004339c8bl runtime.convT64
004339ccstr x0, [sp+296]
004339d0ldr x1, [sp+304]
004339d4ldrsb x27, [x1]
004339d8adrp x2, 0x1c2000
004339dcadd x2, x2, 3520
004339e0str x2, [x1]
004339e4adrp x27, 0x618000
004339e8ldr w2, [x27+3056]
004339eccbz w2, 0x4339f4
004339f0b 0x4339f8
004339f4
004339f4loc_4339f4:
004339f4b 0x433a0c
004339f8
004339f8loc_4339f8:
004339f8bl runtime.gcWriteBarrier2
004339fcstr x0, [x25]
00433a00ldr x5, [x1+8]
00433a04str x5, [x25+8]
00433a08b 0x433a0c
00433a0c
00433a0cloc_433a0c:
00433a0cstr x0, [x1+8]
00433a10ldr x2, [sp+304]
00433a14ldrsb x27, [x2]
00433a18b 0x433a1c
00433a1c
00433a1cloc_433a1c:
00433a1cstr x2, [sp+312]
00433a20orr x4, xzr, 1
00433a24str x4, [sp+320]
00433a28str x4, [sp+328]
00433a2cadrp x0, 0x280000
00433a30add x0, x0, 2304
00433a34movz x1, 13
00433a38mov x3, x4
00433a3cbl fmt.Sprintf
00433a40str x0, [sp+120]
00433a44str x1, [sp+128]
00433a48str xzr, [sp+464]
00433a4cstp xzr, xzr, [sp+472]
00433a50stp xzr, xzr, [sp+448]
00433a54ldr x0, [sp+120]
00433a58ldr x1, [sp+128]
00433a5cbl os.ReadFile
00433a60str x0, [sp+464]
00433a64str x1, [sp+472]
00433a68str x2, [sp+480]
00433a6cstr x3, [sp+448]
00433a70str x4, [sp+456]
00433a74ldr x5, [sp+472]
00433a78ldr x6, [sp+480]
00433a7cldr x7, [sp+464]
00433a80str x7, [sp+208]
00433a84str x5, [sp+216]
00433a88str x6, [sp+224]
00433a8cldr x5, [sp+448]
00433a90ldr x6, [sp+456]
00433a94str x5, [sp+192]
00433a98str x6, [sp+200]
00433a9cldr x5, [sp+208]
00433aa0ldr x6, [sp+216]
00433aa4ldr x7, [sp+224]
00433aa8str x5, [sp+152]
00433aacstr x6, [sp+160]
00433ab0str x7, [sp+168]
00433ab4ldr x1, [sp+200]
00433ab8ldr x0, [sp+192]
00433abcstr x0, [sp+136]
00433ac0str x1, [sp+144]
00433ac4cbnz x0, 0x433acc
00433ac8b 0x433ae0
00433acc
00433accloc_433acc:
00433accstr x0, [sp+104]
00433ad0str x1, [sp+112]
00433ad4ldp x29, x30, [sp-8]
00433ad8add sp, sp, 528
00433adcret x30
00433ae0
00433ae0loc_433ae0:
00433ae0ldr x1, [sp+152]
00433ae4ldr x2, [sp+160]
00433ae8mov x0, xzr
00433aecbl runtime.slicebytetostring
00433af0str x0, [sp+176]
00433af4str x1, [sp+184]
00433af8movz x2, 40
00433afcbl strings.IndexRune
00433b00str x0, [sp+88]
00433b04add x3, x0, 1
00433b08str x3, [sp+64]
00433b0cldr x1, [sp+184]
00433b10ldr x4, [sp+176]
00433b14subs xzr, x1, x3
00433b18b.hs 0x433b20
00433b1cb 0x433e0c
00433b20
00433b20loc_433b20:
00433b20sub x5, x1, x0
00433b24sub x1, x5, 1
00433b28sub x5, xzr, x1
00433b2cand x3, x3, x5, asr #63
00433b30add x0, x4, x3
00433b34str x0, [sp+432]
00433b38str x1, [sp+440]
00433b3cmovz x2, 41
00433b40bl strings.IndexRune
00433b44str x0, [sp+72]
00433b48ldr x3, [sp+64]
00433b4cadd x1, x3, x0
00433b50str x1, [sp+88]
00433b54ldr x0, [sp+64]
00433b58ldr x2, [sp+184]
00433b5cldr x3, [sp+176]
00433b60subs xzr, x2, x1
00433b64b.hs 0x433b6c
00433b68b 0x433e08
00433b6c
00433b6cloc_433b6c:
00433b6csubs xzr, x0, x1
00433b70b.ls 0x433b78
00433b74b 0x433e04
00433b78
00433b78loc_433b78:
00433b78sub x7, x1, x0
00433b7csub x8, xzr, x7
00433b80and x8, x0, x8, asr #63
00433b84add x8, x3, x8
00433b88str x8, [sp+432]
00433b8cstr x7, [sp+440]
00433b90ldr x9, [sp+536]
00433b94ldrsb x27, [x9]
00433b98str x7, [x9+88]
00433b9cadrp x27, 0x618000
00433ba0ldr w7, [x27+3056]
00433ba4cbz w7, 0x433bac
00433ba8b 0x433bb0
00433bac
00433bacloc_433bac:
00433bacb 0x433bc4
00433bb0
00433bb0loc_433bb0:
00433bb0bl runtime.gcWriteBarrier2
00433bb4str x8, [x25]
00433bb8ldr x7, [x9+80]
00433bbcstr x7, [x25+8]
00433bc0b 0x433bc4
00433bc4
00433bc4loc_433bc4:
00433bc4str x8, [x9+80]
00433bc8ldr x7, [sp+72]
00433bccldr x8, [sp+64]
00433bd0add x7, x8, x7
00433bd4add x0, x7, 2
00433bd8str x0, [sp+88]
00433bdcldr x1, [sp+184]
00433be0ldr x8, [sp+176]
00433be4subs xzr, x1, x0
00433be8b.hs 0x433bf0
00433becb 0x433e00
00433bf0
00433bf0loc_433bf0:
00433bf0sub x7, x1, x7
00433bf4sub x7, x7, 2
00433bf8sub x9, xzr, x7
00433bfcand x9, x0, x9, asr #63
00433c00add x8, x8, x9
00433c04str x8, [sp+176]
00433c08str x7, [sp+184]
00433c0cldr x7, [sp+536]
00433c10ldrsb x27, [x7]
00433c14add x7, x7, 16
00433c18str x7, [sp+424]
00433c1cldr x7, [sp+536]
00433c20ldrsb x27, [x7]
00433c24add x7, x7, 8
00433c28str x7, [sp+416]
00433c2cldr x7, [sp+536]
00433c30ldrsb x27, [x7]
00433c34add x7, x7, 24
00433c38str x7, [sp+408]
00433c3cldr x7, [sp+536]
00433c40ldrsb x27, [x7]
00433c44add x7, x7, 32
00433c48str x7, [sp+400]
00433c4cstp xzr, xzr, [sp+448]
00433c50stp xzr, xzr, [sp+336]
00433c54stp xzr, xzr, [sp+352]
00433c58stp xzr, xzr, [sp+368]
00433c5cstp xzr, xzr, [sp+384]
00433c60add x7, sp, 336
00433c64str x7, [sp+264]
00433c68ldr x7, [sp+424]
00433c6cstr x7, [sp+256]
00433c70ldr x8, [sp+264]
00433c74ldrsb x27, [x8]
00433c78adrp x9, 0x1b0000
00433c7cadd x9, x9, 3328
00433c80str x9, [x8]
00433c84adrp x27, 0x618000
00433c88ldr w9, [x27+3056]
00433c8ccbz w9, 0x433c94
00433c90b 0x433c98
00433c94
00433c94loc_433c94:
00433c94b 0x433cac
00433c98
00433c98loc_433c98:
00433c98bl runtime.gcWriteBarrier2
00433c9cstr x7, [x25]
00433ca0ldr x9, [x8+8]
00433ca4str x9, [x25+8]
00433ca8b 0x433cac
00433cac
00433cacloc_433cac:
00433cacstr x7, [x8+8]
00433cb0ldr x7, [sp+416]
00433cb4str x7, [sp+248]
00433cb8ldr x8, [sp+264]
00433cbcldrsb x27, [x8]
00433cc0adrp x9, 0x1b0000
00433cc4add x9, x9, 3584
00433cc8str x9, [x8+16]
00433cccadrp x27, 0x618000
00433cd0ldr w9, [x27+3056]
00433cd4cbz w9, 0x433cdc
00433cd8b 0x433ce0
00433cdc
00433cdcloc_433cdc:
00433cdcb 0x433cf4
00433ce0
00433ce0loc_433ce0:
00433ce0bl runtime.gcWriteBarrier2
00433ce4str x7, [x25]
00433ce8ldr x9, [x8+24]
00433cecstr x9, [x25+8]
00433cf0b 0x433cf4
00433cf4
00433cf4loc_433cf4:
00433cf4str x7, [x8+24]
00433cf8ldr x7, [sp+408]
00433cfcstr x7, [sp+240]
00433d00ldr x8, [sp+264]
00433d04ldrsb x27, [x8]
00433d08adrp x9, 0x1b0000
00433d0cadd x9, x9, 3584
00433d10str x9, [x8+32]
00433d14adrp x27, 0x618000
00433d18ldr w9, [x27+3056]
00433d1ccbz w9, 0x433d24
00433d20b 0x433d28
00433d24
00433d24loc_433d24:
00433d24b 0x433d3c
00433d28
00433d28loc_433d28:
00433d28bl runtime.gcWriteBarrier2
00433d2cstr x7, [x25]
00433d30ldr x9, [x8+40]
00433d34str x9, [x25+8]
00433d38b 0x433d3c
00433d3c
00433d3cloc_433d3c:
00433d3cstr x7, [x8+40]
00433d40ldr x7, [sp+400]
00433d44str x7, [sp+232]
00433d48ldr x8, [sp+264]
00433d4cldrsb x27, [x8]
00433d50adrp x9, 0x1b0000
00433d54add x9, x9, 3584
00433d58str x9, [x8+48]
00433d5cadrp x27, 0x618000
00433d60ldr w9, [x27+3056]
00433d64cbz w9, 0x433d6c
00433d68b 0x433d70
00433d6c
00433d6cloc_433d6c:
00433d6cb 0x433d84
00433d70
00433d70loc_433d70:
00433d70bl runtime.gcWriteBarrier2
00433d74str x7, [x25]
00433d78ldr x9, [x8+56]
00433d7cstr x9, [x25+8]
00433d80b 0x433d84
00433d84
00433d84loc_433d84:
00433d84str x7, [x8+56]
00433d88ldr x4, [sp+264]
00433d8cldrsb x27, [x4]
00433d90b 0x433d94
00433d94
00433d94loc_433d94:
00433d94str x4, [sp+272]
00433d98orr x6, xzr, 4
00433d9cstr x6, [sp+280]
00433da0str x6, [sp+288]
00433da4ldr x0, [sp+176]
00433da8ldr x1, [sp+184]
00433dacadrp x2, 0x27f000
00433db0add x2, x2, 2813
00433db4movz x3, 11
00433db8mov x5, x6
00433dbcbl fmt.Sscanf
00433dc0str x0, [sp+88]
00433dc4str x1, [sp+448]
00433dc8str x2, [sp+456]
00433dccldr x7, [sp+88]
00433dd0str x7, [sp+96]
00433dd4str x1, [sp+504]
00433dd8str x2, [sp+512]
00433ddcstr x1, [sp+136]
00433de0str x2, [sp+144]
00433de4str x1, [sp+104]
00433de8str x2, [sp+112]
00433decmov x0, x1
00433df0mov x1, x2
00433df4ldp x29, x30, [sp-8]
00433df8add sp, sp, 528
00433dfcret x30
00433e00
00433e00loc_433e00:
00433e00bl runtime.panicSliceB
00433e04
00433e04loc_433e04:
00433e04bl runtime.panicSliceB
00433e08
00433e08loc_433e08:
00433e08bl runtime.panicSliceAlen
00433e0c
00433e0cloc_433e0c:
00433e0cmov x0, x3
00433e10bl runtime.panicSliceB
00433e14hint
00433e18
00433e18loc_433e18:
00433e18str x0, [sp+8]
00433e1cmov x3, x30
00433e20bl runtime.morestack_noctxt.abi0
00433e24ldr x0, [sp+8]
00433e28b 0x433980
00433e2cudf 0
00433980

00433e30
00433e30github.com/bishopfox/sliver/implant/sliver/ps.processes: ; void github.com/bishopfox/sliver/implant/sliver/ps.processes(bool fullInfo)
00433e30ldr x16, [x28+16]
00433e34sub x17, sp, 688
00433e38subs xzr, x17, x16
00433e3cb.ls 0x434734
00433e40sub x20, sp, 816
00433e44stp x29, x30, [x20-8]
00433e48add sp, x20, 0
00433e4csub x29, sp, 8
00433e50strb w0, [sp+824]
00433e54str xzr, [sp+208]
00433e58stp xzr, xzr, [sp+216]
00433e5cstp xzr, xzr, [sp+192]
00433e60str xzr, [sp+616]
00433e64add x27, sp, 600
00433e68stp xzr, xzr, [x27]
00433e6cadrp x0, 0x27d000
00433e70add x0, x0, 1757
00433e74movz x1, 5
00433e78bl os.Open
00433e7cstr x0, [sp+616]
00433e80str x1, [sp+600]
00433e84str x2, [sp+608]
00433e88ldr x2, [sp+616]
00433e8cstr x2, [sp+424]
00433e90ldr x2, [sp+600]
00433e94ldr x3, [sp+608]
00433e98str x2, [sp+408]
00433e9cstr x3, [sp+416]
00433ea0ldr x2, [sp+424]
00433ea4str x2, [sp+368]
00433ea8ldr x2, [sp+416]
00433eacldr x3, [sp+408]
00433eb0str x3, [sp+352]
00433eb4str x2, [sp+360]
00433eb8cbnz x3, 0x433ec0
00433ebcb 0x433efc
00433ec0
00433ec0loc_433ec0:
00433ec0str xzr, [sp+208]
00433ec4stp xzr, xzr, [sp+216]
00433ec8ldr x0, [sp+352]
00433eccldr x1, [sp+360]
00433ed0str x0, [sp+192]
00433ed4str x1, [sp+200]
00433ed8bl runtime.deferreturn
00433edcldr x3, [sp+192]
00433ee0ldr x0, [sp+208]
00433ee4ldr x1, [sp+216]
00433ee8ldr x4, [sp+200]
00433eecldr x2, [sp+224]
00433ef0ldp x29, x30, [sp-8]
00433ef4add sp, sp, 816
00433ef8ret x30
00433efc
00433efcloc_433efc:
00433efcldr x1, [sp+368]
00433f00str x1, [sp+400]
00433f04stp xzr, xzr, [sp+504]
00433f08add x1, sp, 504
00433f0cstr x1, [sp+520]
00433f10ldrsb x27, [x1]
00433f14adrp x2, 4096
00433f18add x2, x2, 1872
00433f1cstr x2, [x1]
00433f20ldrsb x27, [x1]
00433f24ldr x2, [sp+400]
00433f28adrp x27, 0x618000
00433f2cldr w3, [x27+3056]
00433f30cbz w3, 0x433f38
00433f34b 0x433f3c
00433f38
00433f38loc_433f38:
00433f38b 0x433f50
00433f3c
00433f3cloc_433f3c:
00433f3cbl runtime.gcWriteBarrier2
00433f40str x2, [x25]
00433f44ldr x3, [x1+8]
00433f48str x3, [x25+8]
00433f4cb 0x433f50
00433f50
00433f50loc_433f50:
00433f50str x2, [x1+8]
00433f54str x1, [sp+120]
00433f58add x0, sp, 96
00433f5cbl runtime.deferprocStack
00433f60subs xzr, x0, 0
00433f64b.ne 0x433f94
00433f68b 0x433f6c
00433f6c
00433f6cloc_433f6c:
00433f6cadrp x0, 0x208000
00433f70add x0, x0, 1888
00433f74mov x1, xzr
00433f78movz x2, 50
00433f7cbl runtime.makeslice
00433f80str x0, [sp+232]
00433f84str xzr, [sp+240]
00433f88movz x3, 50
00433f8cstr x3, [sp+248]
00433f90b 0x433fb8
00433f94
00433f94loc_433f94:
00433f94bl runtime.deferreturn
00433f98ldr x3, [sp+192]
00433f9cldr x0, [sp+208]
00433fa0ldr x1, [sp+216]
00433fa4ldr x4, [sp+200]
00433fa8ldr x2, [sp+224]
00433facldp x29, x30, [sp-8]
00433fb0add sp, sp, 816
00433fb4ret x30
00433fb8
00433fb8loc_433fb8:
00433fb8b 0x433fbc
00433fbc
00433fbcloc_433fbc:
00433fbcstr xzr, [sp+576]
00433fc0add x27, sp, 584
00433fc4stp xzr, xzr, [x27]
00433fc8add x27, sp, 600
00433fccstp xzr, xzr, [x27]
00433fd0ldr x0, [sp+368]
00433fd4movz x1, 10
00433fd8bl os.(*File).Readdir
00433fdcstr x0, [sp+576]
00433fe0str x1, [sp+584]
00433fe4str x2, [sp+592]
00433fe8str x3, [sp+600]
00433fecstr x4, [sp+608]
00433ff0ldr x2, [sp+576]
00433ff4ldr x3, [sp+584]
00433ff8ldr x4, [sp+592]
00433ffcstr x2, [sp+784]
00434000str x3, [sp+792]
00434004str x4, [sp+800]
00434008ldr x2, [sp+600]
0043400cldr x3, [sp+608]
00434010str x2, [sp+768]
00434014str x3, [sp+776]
00434018ldr x2, [sp+784]
0043401cldr x3, [sp+792]
00434020ldr x4, [sp+800]
00434024str x2, [sp+280]
00434028str x3, [sp+288]
0043402cstr x4, [sp+296]
00434030ldr x0, [sp+768]
00434034ldr x1, [sp+776]
00434038str x0, [sp+336]
0043403cstr x1, [sp+344]
00434040adrp x27, 0x5ed000
00434044ldr x2, [x27+1520]
00434048subs xzr, x2, x0
0043404cb.eq 0x434054
00434050b 0x4340c0
00434054
00434054loc_434054:
00434054adrp x27, 0x5ed000
00434058ldr x2, [x27+1528]
0043405cbl runtime.ifaceeq
00434060tbnz w0, 0, 0x434068
00434064b 0x4340bc
00434068
00434068loc_434068:
00434068b 0x43406c
0043406c
0043406cloc_43406c:
0043406cstp xzr, xzr, [sp+432]
00434070ldr x0, [sp+232]
00434074ldr x1, [sp+240]
00434078ldr x2, [sp+248]
0043407cstr x0, [sp+208]
00434080str x1, [sp+216]
00434084str x2, [sp+224]
00434088ldr x0, [sp+432]
0043408cldr x1, [sp+440]
00434090str x0, [sp+192]
00434094str x1, [sp+200]
00434098bl runtime.deferreturn
0043409cldr x3, [sp+192]
004340a0ldr x0, [sp+208]
004340a4ldr x1, [sp+216]
004340a8ldr x4, [sp+200]
004340acldr x2, [sp+224]
004340b0ldp x29, x30, [sp-8]
004340b4add sp, sp, 816
004340b8ret x30
004340bc
004340bcloc_4340bc:
004340bcb 0x4340c4
004340c0
004340c0loc_4340c0:
004340c0b 0x4340c4
004340c4
004340c4loc_4340c4:
004340c4ldr x2, [sp+336]
004340c8cbnz x2, 0x4340d0
004340ccb 0x43411c
004340d0
004340d0loc_4340d0:
004340d0ldr x0, [sp+336]
004340d4ldr x1, [sp+344]
004340d8str x0, [sp+488]
004340dcstr x1, [sp+496]
004340e0str xzr, [sp+208]
004340e4stp xzr, xzr, [sp+216]
004340e8ldr x0, [sp+488]
004340ecldr x1, [sp+496]
004340f0str x0, [sp+192]
004340f4str x1, [sp+200]
004340f8bl runtime.deferreturn
004340fcldr x3, [sp+192]
00434100ldr x0, [sp+208]
00434104ldr x1, [sp+216]
00434108ldr x4, [sp+200]
0043410cldr x2, [sp+224]
00434110ldp x29, x30, [sp-8]
00434114add sp, sp, 816
00434118ret x30
0043411c
0043411cloc_43411c:
0043411cldr x2, [sp+288]
00434120ldr x3, [sp+280]
00434124ldr x4, [sp+296]
00434128str x3, [sp+576]
0043412cstr x2, [sp+584]
00434130str x4, [sp+592]
00434134str xzr, [sp+160]
00434138str x2, [sp+152]
0043413cldr x2, [sp+576]
00434140str x2, [sp+144]
00434144b 0x434148
00434148
00434148loc_434148:
00434148ldr x2, [sp+152]
0043414cldr x3, [sp+160]
00434150subs xzr, x2, x3
00434154b.gt 0x43415c
00434158b 0x434700
0043415c
0043415cloc_43415c:
0043415cldr x1, [sp+144]
00434160str x1, [sp+480]
00434164ldr x1, [sp+480]
00434168ldr x2, [x1]
0043416cldr x0, [x1+8]
00434170str x2, [sp+304]
00434174str x0, [sp+312]
00434178ldrsb x27, [x2]
0043417cldr x1, [x2+24]
00434180blr x1
00434184strb w0, [sp+87]
00434188tbnz w0, 0, 0x434190
0043418cb 0x4346e0
00434190
00434190loc_434190:
00434190ldr x1, [sp+304]
00434194ldrsb x27, [x1]
00434198ldr x1, [x1+48]
0043419cldr x0, [sp+312]
004341a0blr x1
004341a4str x0, [sp+264]
004341a8str x1, [sp+272]
004341acsubs xzr, x1, 0
004341b0b.hi 0x4341b8
004341b4b 0x434728
004341b8
004341b8loc_4341b8:
004341b8ldrb w4, [x0]
004341bcsubs wzr, w4, 48
004341c0cset x4, lo
004341c4strb w4, [sp+87]
004341c8b.lo 0x4341d0
004341ccb 0x4341d4
004341d0
004341d0loc_4341d0:
004341d0b 0x4341fc
004341d4
004341d4loc_4341d4:
004341d4ldr x1, [sp+272]
004341d8ldr x4, [sp+264]
004341dcsubs xzr, x1, 0
004341e0b.hi 0x4341e8
004341e4b 0x434720
004341e8
004341e8loc_4341e8:
004341e8ldrb w4, [x4]
004341ecsubs wzr, w4, 57
004341f0cset x4, hi
004341f4strb w4, [sp+87]
004341f8b 0x4341fc
004341fc
004341fcloc_4341fc:
004341fcldrb w4, [sp+87]
00434200tbnz w4, 0, 0x434208
00434204b 0x43420c
00434208
00434208loc_434208:
00434208b 0x4346e4
0043420c
0043420cloc_43420c:
0043420cadd x27, sp, 600
00434210stp xzr, xzr, [x27]
00434214ldr x0, [sp+264]
00434218ldr x1, [sp+272]
0043421cmovz x2, 10
00434220mov x3, xzr
00434224bl strconv.ParseInt
00434228str x0, [sp+176]
0043422cstr x1, [sp+600]
00434230str x2, [sp+608]
00434234ldr x4, [sp+176]
00434238str x4, [sp+184]
0043423cstr x1, [sp+752]
00434240str x2, [sp+760]
00434244ldr x4, [sp+184]
00434248str x4, [sp+88]
0043424cstr x1, [sp+320]
00434250str x2, [sp+328]
00434254cbnz x1, 0x43425c
00434258b 0x434260
0043425c
0043425cloc_43425c:
0043425cb 0x4346e4
00434260
00434260loc_434260:
00434260str xzr, [sp+568]
00434264add x27, sp, 600
00434268stp xzr, xzr, [x27]
0043426cldr x0, [sp+88]
00434270bl github.com/bishopfox/sliver/implant/sliver/ps.newUnixProcess
00434274str x0, [sp+568]
00434278str x1, [sp+600]
0043427cstr x2, [sp+608]
00434280ldr x1, [sp+568]
00434284str x1, [sp+744]
00434288ldr x1, [sp+600]
0043428cldr x2, [sp+608]
00434290str x1, [sp+728]
00434294str x2, [sp+736]
00434298ldr x1, [sp+744]
0043429cstr x1, [sp+256]
004342a0ldr x1, [sp+736]
004342a4ldr x2, [sp+728]
004342a8str x2, [sp+320]
004342acstr x1, [sp+328]
004342b0cbnz x2, 0x4342b8
004342b4b 0x4342bc
004342b8
004342b8loc_4342b8:
004342b8b 0x4346e4
004342bc
004342bcloc_4342bc:
004342bcldrb w5, [sp+824]
004342c0tbnz w5, 0, 0x4342c8
004342c4b 0x434640
004342c8
004342c8loc_4342c8:
004342c8add x27, sp, 552
004342ccstp xzr, xzr, [x27]
004342d0add x27, sp, 600
004342d4stp xzr, xzr, [x27]
004342d8ldr x0, [sp+88]
004342dcbl github.com/bishopfox/sliver/implant/sliver/ps.getProcessOwner
004342e0str x0, [sp+552]
004342e4str x1, [sp+560]
004342e8str x2, [sp+600]
004342ecstr x3, [sp+608]
004342f0ldr x1, [sp+552]
004342f4ldr x2, [sp+560]
004342f8str x1, [sp+712]
004342fcstr x2, [sp+720]
00434300ldr x1, [sp+600]
00434304ldr x2, [sp+608]
00434308str x1, [sp+696]
0043430cstr x2, [sp+704]
00434310ldr x1, [sp+256]
00434314ldrsb x27, [x1]
00434318ldr x2, [sp+712]
0043431cldr x3, [sp+720]
00434320str x3, [x1+104]
00434324adrp x27, 0x617000
00434328ldr w3, [x27+3056]
0043432ccbz w3, 0x434334
00434330b 0x434338
00434334
00434334loc_434334:
00434334b 0x43434c
00434338
00434338loc_434338:
00434338bl runtime.gcWriteBarrier2
0043433cstr x2, [x25]
00434340ldr x3, [x1+96]
00434344str x3, [x25+8]
00434348b 0x43434c
0043434c
0043434cloc_43434c:
0043434cstr x2, [x1+96]
00434350ldr x2, [sp+704]
00434354ldr x3, [sp+696]
00434358str x3, [sp+320]
0043435cstr x2, [sp+328]
00434360cbnz x3, 0x434368
00434364b 0x43436c
00434368
00434368loc_434368:
00434368b 0x4346e4
0043436c
0043436cloc_43436c:
0043436cstr xzr, [sp+528]
00434370add x27, sp, 536
00434374stp xzr, xzr, [x27]
00434378add x27, sp, 600
0043437cstp xzr, xzr, [x27]
00434380ldr x0, [sp+88]
00434384bl github.com/bishopfox/sliver/implant/sliver/ps.getProcessCmdLine
00434388str x0, [sp+528]
0043438cstr x1, [sp+536]
00434390str x2, [sp+544]
00434394str x3, [sp+600]
00434398str x4, [sp+608]
0043439cldr x1, [sp+528]
004343a0ldr x2, [sp+536]
004343a4ldr x3, [sp+544]
004343a8str x1, [sp+672]
004343acstr x2, [sp+680]
004343b0str x3, [sp+688]
004343b4ldr x1, [sp+600]
004343b8ldr x2, [sp+608]
004343bcstr x1, [sp+656]
004343c0str x2, [sp+664]
004343c4ldr x1, [sp+672]
004343c8ldr x2, [sp+680]
004343ccldr x3, [sp+688]
004343d0str x1, [sp+376]
004343d4str x2, [sp+384]
004343d8str x3, [sp+392]
004343dcldr x1, [sp+664]
004343e0ldr x2, [sp+656]
004343e4str x2, [sp+320]
004343e8str x1, [sp+328]
004343eccbnz x2, 0x4343f4
004343f0b 0x4343f8
004343f4
004343f4loc_4343f4:
004343f4b 0x434508
004343f8
004343f8loc_4343f8:
004343f8ldr x2, [sp+256]
004343fcldrsb x27, [x2]
00434400ldr x3, [sp+376]
00434404ldr x4, [sp+384]
00434408ldr x5, [sp+392]
0043440cstr x4, [x2+64]
00434410str x5, [x2+72]
00434414adrp x27, 0x617000
00434418ldr w4, [x27+3056]
0043441ccbz w4, 0x434424
00434420b 0x434428
00434424
00434424loc_434424:
00434424b 0x43443c
00434428
00434428loc_434428:
00434428bl runtime.gcWriteBarrier2
0043442cstr x3, [x25]
00434430ldr x4, [x2+56]
00434434str x4, [x25+8]
00434438b 0x43443c
0043443c
0043443cloc_43443c:
0043443cstr x3, [x2+56]
00434440ldr x1, [sp+384]
00434444ldr x2, [sp+376]
00434448subs xzr, x1, 0
0043444cb.hi 0x434454
00434450b 0x434718
00434454
00434454loc_434454:
00434454ldr x2, [x2+8]
00434458subs xzr, x2, 0
0043445ccset x3, ne
00434460strb w3, [sp+87]
00434464cbnz x2, 0x43446c
00434468b 0x434498
0043446c
0043446cloc_43446c:
0043446cldr x1, [sp+384]
00434470ldr x2, [sp+376]
00434474subs xzr, x1, 0
00434478b.hi 0x434480
0043447cb 0x434710
00434480
00434480loc_434480:
00434480ldr x2, [x2+8]
00434484str x2, [sp+168]
00434488subs xzr, x2, 0
0043448ccset x2, ne
00434490strb w2, [sp+87]
00434494b 0x43449c
00434498
00434498loc_434498:
00434498b 0x43449c
0043449c
0043449cloc_43449c:
0043449cldrb w2, [sp+87]
004344a0tbnz w2, 0, 0x4344a8
004344a4b 0x434500
004344a8
004344a8loc_4344a8:
004344a8ldr x2, [sp+376]
004344acldr x1, [sp+384]
004344b0subs xzr, x1, 0
004344b4b.hi 0x4344bc
004344b8b 0x434708
004344bc
004344bcloc_4344bc:
004344bcldr x1, [sp+256]
004344c0ldrsb x27, [x1]
004344c4ldr x3, [x2]
004344c8ldr x2, [x2+8]
004344ccstr x2, [x1+88]
004344d0adrp x27, 0x617000
004344d4ldr w2, [x27+3056]
004344d8cbz w2, 0x4344e0
004344dcb 0x4344e4
004344e0
004344e0loc_4344e0:
004344e0b 0x4344f8
004344e4
004344e4loc_4344e4:
004344e4bl runtime.gcWriteBarrier2
004344e8str x3, [x25]
004344ecldr x2, [x1+80]
004344f0str x2, [x25+8]
004344f4b 0x4344f8
004344f8
004344f8loc_4344f8:
004344f8str x3, [x1+80]
004344fcb 0x434504
00434500
00434500loc_434500:
00434500b 0x434504
00434504
00434504loc_434504:
00434504b 0x434508
00434508
00434508loc_434508:
00434508add x27, sp, 552
0043450cstp xzr, xzr, [x27]
00434510add x27, sp, 600
00434514stp xzr, xzr, [x27]
00434518ldr x0, [sp+88]
0043451cbl github.com/bishopfox/sliver/implant/sliver/ps.getProcessArchitecture
00434520str x0, [sp+552]
00434524str x1, [sp+560]
00434528str x2, [sp+600]
0043452cstr x3, [sp+608]
00434530ldr x1, [sp+552]
00434534ldr x2, [sp+560]
00434538str x1, [sp+640]
0043453cstr x2, [sp+648]
00434540ldr x1, [sp+600]
00434544ldr x2, [sp+608]
00434548str x1, [sp+624]
0043454cstr x2, [sp+632]
00434550ldr x1, [sp+256]
00434554ldrsb x27, [x1]
00434558ldr x2, [sp+640]
0043455cldr x3, [sp+648]
00434560str x3, [x1+48]
00434564adrp x27, 0x617000
00434568ldr w3, [x27+3056]
0043456ccbz w3, 0x434574
00434570b 0x434578
00434574
00434574loc_434574:
00434574b 0x43458c
00434578
00434578loc_434578:
00434578bl runtime.gcWriteBarrier2
0043457cstr x2, [x25]
00434580ldr x5, [x1+40]
00434584str x5, [x25+8]
00434588b 0x43458c
0043458c
0043458cloc_43458c:
0043458cstr x2, [x1+40]
00434590ldr x5, [sp+624]
00434594ldr x6, [sp+632]
00434598str x5, [sp+320]
0043459cstr x6, [sp+328]
004345a0ldr x5, [sp+256]
004345a4str x5, [sp+568]
004345a8adrp x6, 0x2e5000
004345acadd x6, x6, 1872
004345b0str x6, [sp+448]
004345b4str x5, [sp+456]
004345b8ldr x2, [sp+248]
004345bcldr x0, [sp+232]
004345c0ldr x5, [sp+240]
004345c4add x1, x5, 1
004345c8subs xzr, x2, x1
004345ccb.hs 0x4345d4
004345d0b 0x4345d8
004345d4
004345d4loc_4345d4:
004345d4b 0x4345ec
004345d8
004345d8loc_4345d8:
004345d8orr x3, xzr, 1
004345dcadrp x4, 0x207000
004345e0add x4, x4, 1888
004345e4bl runtime.growslice
004345e8b 0x4345ec
004345ec
004345ecloc_4345ec:
004345ecsub x3, x1, 1
004345f0add x4, x0, x3, lsl #4
004345f4ubfm x3, x3, 60, 59
004345f8ldr x5, [sp+456]
004345fcldr x6, [sp+448]
00434600str x6, [x0+x3]
00434604adrp x27, 0x617000
00434608ldr w3, [x27+3056]
0043460ccbz w3, 0x434614
00434610b 0x434618
00434614
00434614loc_434614:
00434614b 0x43462c
00434618
00434618loc_434618:
00434618bl runtime.gcWriteBarrier2
0043461cstr x5, [x25]
00434620ldr x3, [x4+8]
00434624str x3, [x25+8]
00434628b 0x43462c
0043462c
0043462cloc_43462c:
0043462cstr x5, [x4+8]
00434630str x0, [sp+232]
00434634str x1, [sp+240]
00434638str x2, [sp+248]
0043463cb 0x4346e4
00434640
00434640loc_434640:
00434640ldr x5, [sp+256]
00434644str x5, [sp+568]
00434648adrp x6, 0x2e5000
0043464cadd x6, x6, 1872
00434650str x6, [sp+464]
00434654str x5, [sp+472]
00434658ldr x2, [sp+248]
0043465cldr x0, [sp+232]
00434660ldr x5, [sp+240]
00434664add x1, x5, 1
00434668subs xzr, x2, x1
0043466cb.hs 0x434674
00434670b 0x434678
00434674
00434674loc_434674:
00434674b 0x43468c
00434678
00434678loc_434678:
00434678orr x3, xzr, 1
0043467cadrp x4, 0x207000
00434680add x4, x4, 1888
00434684bl runtime.growslice
00434688b 0x43468c
0043468c
0043468cloc_43468c:
0043468csub x3, x1, 1
00434690add x4, x0, x3, lsl #4
00434694ubfm x3, x3, 60, 59
00434698ldr x5, [sp+472]
0043469cldr x6, [sp+464]
004346a0str x6, [x0+x3]
004346a4adrp x27, 0x617000
004346a8ldr w3, [x27+3056]
004346accbz w3, 0x4346b4
004346b0b 0x4346b8
004346b4
004346b4loc_4346b4:
004346b4b 0x4346cc
004346b8
004346b8loc_4346b8:
004346b8bl runtime.gcWriteBarrier2
004346bcstr x5, [x25]
004346c0ldr x3, [x4+8]
004346c4str x3, [x25+8]
004346c8b 0x4346cc
004346cc
004346ccloc_4346cc:
004346ccstr x5, [x4+8]
004346d0str x0, [sp+232]
004346d4str x1, [sp+240]
004346d8str x2, [sp+248]
004346dcb 0x4346e4
004346e0
004346e0loc_4346e0:
004346e0b 0x4346e4
004346e4
004346e4loc_4346e4:
004346e4ldr x2, [sp+160]
004346e8add x2, x2, 1
004346ecstr x2, [sp+160]
004346f0ldr x2, [sp+480]
004346f4add x2, x2, 16
004346f8str x2, [sp+144]
004346fcb 0x434148
00434700
00434700loc_434700:
00434700b 0x434704
00434704
00434704loc_434704:
00434704b 0x433fb8
00434708
00434708loc_434708:
00434708mov x0, xzr
0043470cbl runtime.panicIndex
00434710
00434710loc_434710:
00434710mov x0, xzr
00434714bl runtime.panicIndex
00434718
00434718loc_434718:
00434718mov x0, xzr
0043471cbl runtime.panicIndex
00434720
00434720loc_434720:
00434720mov x0, xzr
00434724bl runtime.panicIndex
00434728
00434728loc_434728:
00434728mov x0, xzr
0043472cbl runtime.panicIndex
00434730hint
00434734
00434734loc_434734:
00434734strb w0, [sp+8]
00434738mov x3, x30
0043473cbl runtime.morestack_noctxt.abi0
00434740ldrb w0, [sp+8]
00434744b 0x433e30
00434748udf 0
0043474cudf 0
00433e30

00434750
00434750github.com/bishopfox/sliver/implant/sliver/ps.processes.deferwrap1: ; void github.com/bishopfox/sliver/implant/sliver/ps.processes.deferwrap1(void)
00434750ldr x16, [x28+16]
00434754subs xzr, sp, x16
00434758b.ls 0x434788
0043475cstr x30, [sp-32]!
00434760stur x29, [sp-8]
00434764sub x29, sp, 8
00434768ldr x16, [x28+32]
0043476ccbnz x16, 0x434794
00434770
00434770loc_434770:
00434770ldr x0, [x26+8]
00434774str x0, [sp+16]
00434778bl os.(*File).Close
0043477cldur x29, [sp-8]
00434780ldr x30, [sp], 32
00434784ret x30
00434788
00434788loc_434788:
00434788mov x3, x30
0043478cbl runtime.morestack.abi0
00434790b 0x434750
00434794
00434794loc_434794:
00434794ldr x17, [x16]
00434798add x20, sp, 40
0043479csubs xzr, x20, x17
004347a0b.ne 0x434770
004347a4add x20, sp, 8
004347a8str x20, [x16]
004347acb 0x434770
00434750

004347b0
004347b0github.com/bishopfox/sliver/implant/sliver/ps.newUnixProcess: ; void github.com/bishopfox/sliver/implant/sliver/ps.newUnixProcess(int pid)
004347b0ldr x16, [x28+16]
004347b4subs xzr, sp, x16
004347b8b.ls 0x434878
004347bcstr x30, [sp-112]!
004347c0stur x29, [sp-8]
004347c4sub x29, sp, 8
004347c8str x0, [sp+120]
004347ccstr xzr, [sp+56]
004347d0stp xzr, xzr, [sp+40]
004347d4adrp x0, 0x25a000
004347d8add x0, x0, 3776
004347dcbl runtime.newobject
004347e0str x0, [sp+80]
004347e4adrp x27, 0x617000
004347e8ldr w1, [x27+3056]
004347eccbz w1, 0x4347f4
004347f0b 0x4347f8
004347f4
004347f4loc_4347f4:
004347f4b 0x434814
004347f8
004347f8loc_4347f8:
004347f8str x0, [sp+72]
004347fcmov x1, x0
00434800adrp x0, 0x25a000
00434804add x0, x0, 3776
00434808bl runtime.wbZero
0043480cldr x0, [sp+72]
00434810b 0x434814
00434814
00434814loc_434814:
00434814mov x20, x0
00434818adr x27, 16
0043481cstp x29, x27, [sp-24]
00434820sub x29, sp, 24
00434824bl fn_87cf4
00434828sub x29, sp, 8
0043482cldr x1, [sp+80]
00434830ldrsb x27, [x1]
00434834ldr x2, [sp+120]
00434838str x2, [x1]
0043483cldr x0, [sp+80]
00434840str x0, [sp+64]
00434844bl github.com/bishopfox/sliver/implant/sliver/ps.(*UnixProcess).Refresh
00434848str x0, [sp+88]
0043484cstr x1, [sp+96]
00434850ldr x1, [sp+64]
00434854str x1, [sp+56]
00434858ldr x1, [sp+88]
0043485cldr x2, [sp+96]
00434860str x1, [sp+40]
00434864str x2, [sp+48]
00434868ldr x0, [sp+56]
0043486cldur x29, [sp-8]
00434870ldr x30, [sp], 112
00434874ret x30
00434878
00434878loc_434878:
00434878str x0, [sp+8]
0043487cmov x3, x30
00434880bl runtime.morestack_noctxt.abi0
00434884ldr x0, [sp+8]
00434888b 0x4347b0
0043488cudf 0
004347b0

00434890
00434890gopkg.in/jcmturner/gokrb5.v7/crypto/common.ZeroPad: ; void gopkg.in/jcmturner/gokrb5.v7/crypto/common.ZeroPad(struct []uint8 b, int m)
00434890ldr x16, [x28+16]
00434894sub x17, sp, 96
00434898subs xzr, x17, x16
0043489cb.ls 0x434aec
004348a0str x30, [sp-224]!
004348a4stur x29, [sp-8]
004348a8sub x29, sp, 8
004348acstr x0, [sp+232]
004348b0str x1, [sp+240]
004348b4str x2, [sp+248]
004348b8str x3, [sp+256]
004348bcstr xzr, [sp+120]
004348c0stp xzr, xzr, [sp+128]
004348c4stp xzr, xzr, [sp+104]
004348c8ldr x5, [sp+256]
004348ccsubs xzr, x5, 0
004348d0b.le 0x4348d8
004348d4b 0x434920
004348d8
004348d8loc_4348d8:
004348d8adrp x0, 0x28f000
004348dcadd x0, x0, 3757
004348e0movz x1, 39
004348e4bl errors.New
004348e8str x0, [sp+168]
004348ecstr x1, [sp+176]
004348f0str xzr, [sp+120]
004348f4stp xzr, xzr, [sp+128]
004348f8ldr x3, [sp+168]
004348fcldr x4, [sp+176]
00434900str x3, [sp+104]
00434904str x4, [sp+112]
00434908ldr x0, [sp+120]
0043490cldr x1, [sp+128]
00434910ldr x2, [sp+136]
00434914ldur x29, [sp-8]
00434918ldr x30, [sp], 224
0043491cret x30
00434920
00434920loc_434920:
00434920ldr x5, [sp+232]
00434924subs xzr, x5, 0
00434928cset x6, ne
0043492ceor x6, x6, 1
00434930strb w6, [sp+63]
00434934cbnz x5, 0x43493c
00434938b 0x434954
0043493c
0043493cloc_43493c:
0043493cldr x5, [sp+240]
00434940str x5, [sp+80]
00434944subs xzr, x5, 0
00434948cset x5, eq
0043494cstrb w5, [sp+63]
00434950b 0x434958
00434954
00434954loc_434954:
00434954b 0x434958
00434958
00434958loc_434958:
00434958ldrb w5, [sp+63]
0043495ctbnz w5, 0, 0x434964
00434960b 0x4349ac
00434964
00434964loc_434964:
00434964adrp x0, 0x28a000
00434968add x0, x0, 4080
0043496corr x1, xzr, 32
00434970bl errors.New
00434974str x0, [sp+168]
00434978str x1, [sp+176]
0043497cstr xzr, [sp+120]
00434980stp xzr, xzr, [sp+128]
00434984ldr x3, [sp+168]
00434988ldr x4, [sp+176]
0043498cstr x3, [sp+104]
00434990str x4, [sp+112]
00434994ldr x0, [sp+120]
00434998ldr x1, [sp+128]
0043499cldr x2, [sp+136]
004349a0ldur x29, [sp-8]
004349a4ldr x30, [sp], 224
004349a8ret x30
004349ac
004349acloc_4349ac:
004349acldr x5, [sp+240]
004349b0str x5, [sp+80]
004349b4ldr x6, [sp+256]
004349b8cbnz x6, 0x4349c0
004349bcb 0x434ae4
004349c0
004349c0loc_4349c0:
004349c0sdiv x27, x5, x6
004349c4msub x5, x27, x6, x5
004349c8str x5, [sp+72]
004349cccbnz x5, 0x4349d4
004349d0b 0x434aa4
004349d4
004349d4loc_4349d4:
004349d4ldr x3, [sp+256]
004349d8sub x2, x3, x5
004349dcstr x2, [sp+64]
004349e0adrp x0, 0x1c1000
004349e4add x0, x0, 3072
004349e8mov x1, x2
004349ecbl runtime.makeslice
004349f0ldr x3, [sp+64]
004349f4ldr x4, [sp+64]
004349f8str x0, [sp+144]
004349fcstr x3, [sp+152]
00434a00str x4, [sp+160]
00434a04ldr x2, [sp+248]
00434a08ldr x0, [sp+232]
00434a0cldr x3, [sp+240]
00434a10str x0, [sp+192]
00434a14str x3, [sp+200]
00434a18str x2, [sp+208]
00434a1cldr x4, [sp+152]
00434a20add x1, x3, x4
00434a24str x1, [sp+96]
00434a28subs xzr, x2, x1
00434a2cb.hs 0x434a34
00434a30b 0x434a3c
00434a34
00434a34loc_434a34:
00434a34str x1, [sp+200]
00434a38b 0x434a5c
00434a3c
00434a3cloc_434a3c:
00434a3cldr x3, [sp+152]
00434a40adrp x4, 0x1c1000
00434a44add x4, x4, 3072
00434a48bl runtime.growslice
00434a4cstr x0, [sp+192]
00434a50str x1, [sp+200]
00434a54str x2, [sp+208]
00434a58b 0x434a5c
00434a5c
00434a5cloc_434a5c:
00434a5cldr x3, [sp+152]
00434a60str x3, [sp+88]
00434a64ldr x3, [sp+96]
00434a68ldr x4, [sp+152]
00434a6csub x3, x3, x4
00434a70ldr x4, [sp+192]
00434a74add x0, x4, x3
00434a78str x0, [sp+184]
00434a7cldr x2, [sp+88]
00434a80ldr x1, [sp+144]
00434a84bl runtime.memmove
00434a88ldr x3, [sp+192]
00434a8cldr x4, [sp+200]
00434a90ldr x5, [sp+208]
00434a94str x3, [sp+232]
00434a98str x4, [sp+240]
00434a9cstr x5, [sp+248]
00434aa0b 0x434aa8
00434aa4
00434aa4loc_434aa4:
00434aa4b 0x434aa8
00434aa8
00434aa8loc_434aa8:
00434aa8ldr x5, [sp+232]
00434aacldr x6, [sp+240]
00434ab0ldr x7, [sp+248]
00434ab4str x5, [sp+120]
00434ab8str x6, [sp+128]
00434abcstr x7, [sp+136]
00434ac0stp xzr, xzr, [sp+104]
00434ac4ldr x0, [sp+120]
00434ac8ldr x1, [sp+128]
00434accldr x2, [sp+136]
00434ad0mov x3, xzr
00434ad4mov x4, xzr
00434ad8ldur x29, [sp-8]
00434adcldr x30, [sp], 224
00434ae0ret x30
00434ae4
00434ae4loc_434ae4:
00434ae4bl runtime.panicdivide
00434ae8hint
00434aec
00434aecloc_434aec:
00434aecstp x0, x1, [sp+8]
00434af0stp x2, x3, [sp+24]
00434af4mov x3, x30
00434af8bl runtime.morestack_noctxt.abi0
00434afcldp x0, x1, [sp+8]
00434b00ldp x2, x3, [sp+24]
00434b04b 0x434890
00434b08udf 0
00434b0cudf 0
00434890