joyce8/EMBER2024-capa huggingface dataset:
Function at 0x644520
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.DLL_CreateEventA]
test rax, rax
mov qword [0x00e18cd0], rax
je 0x644555
lea rcx, [0x00e18ce0]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
lea r9, [rax + 0x60]
mov r8d, 0x3d
mov edx, 1
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x64bca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rcx
xor ecx, ecx
jmp qword [sym.imp.KERNEL32.DLL_VirtualAlloc]

Function at 0x64bd50
Capabilities:
Manipulate user privileges

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
test cl, cl
jne 0x64bd63
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
mov dword [0x00e18d20], 2
call fcn.0064bac0
test eax, eax
jne 0x64be0d
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x64bd5b
lea rbx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov edx, 1
mov dword [rsp + 0x50], 0
mov rdi, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov qword [rsp + 0x20], rbx
call rdi
mov edx, dword [rsp + 0x50]
test edx, edx
jne 0x64be20
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
call rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x64bd5b
call sub.ADVAPI32.dll_LsaClose
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_LocalFree]
call fcn.0064bac0
test eax, eax
je 0x64bd5b
or dword [0x00e18d20], 1
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
mov ecx, 0x40
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov r9d, dword [rsp + 0x50]
mov edx, 1
mov qword [rsp + 0x20], rbx
mov rsi, rax
mov r8, rax
mov rcx, qword [rsp + 0x30]
call rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rsi, rsi
je 0x64bd5b
xor eax, eax
mov ecx, 6
mov rdi, rbx
rep stosq qword [rdi], rax
lea r9, [rsp + 0x38]
mov r8d, 0xf0fff
mov rdx, rbx
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
je 0x64be90
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x64bd5b
lea rcx, str.SeLockMemoryPrivilege
call sub.msvcrt.dll_wcslen
mov rcx, qword [rsp + 0x38]
mov r9d, 1
lea edx, [rax + rax]
mov word [rsp + 0x40], dx
mov rdx, qword [rsi]
lea eax, [rax + rax + 2]
lea rbx, str.SeLockMemoryPrivilege
mov word [rsp + 0x42], ax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x64bdf2
call sub.ADVAPI32.dll_LsaClose
jmp 0x64be7f
Function at 0x68a950
Capabilities:
Hash data using sha512

Disassembly:
push rdi
sub rsp, 0x40
test rcx, rcx
mov r8, rcx
je 0x68aa9e
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x68aa80
lea r9, [r8 + 0x40]
mov rax, rsp
xor ecx, ecx
mov byte [rsp], dl
mov qword [rsp + 0x12], 0
mov rdi, r9
mov word [rax + 0x1e], cx
mov ecx, 0x16
mov dword [rax + 0x1a], 0
mov qword [rsp + 0x20], 0
mov qword [rax + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rax + 0x38], 0
xor eax, eax
rep stosq qword [rdi], rax
mov rax, qword [0x00d05740]
mov byte [rsp + 0x11], 0
mov qword [rsp + 1], 0x10100
mov qword [rsp + 9], 0
mov qword [r8], rax
mov rax, qword [0x00d05748]
mov qword [r8 + 8], rax
mov rax, qword [0x00d05750]
movdqu xmm0, xmmword [r8]
pxor xmm0, xmmword [rsp]
movups xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
mov rax, qword [0x00d05758]
mov qword [r8 + 0x18], rax
mov rax, qword [0x00d05760]
movdqu xmm0, xmmword [r8 + 0x10]
mov qword [r8 + 0x20], rax
mov rax, qword [0x00d05768]
mov qword [r8 + 0x28], rax
mov rax, qword [0x00d05770]
mov qword [r8 + 0x30], rax
mov rax, qword [0x00d05778]
mov qword [r8 + 0x38], rax
pxor xmm0, xmmword [rsp + 0x10]
xor eax, eax
movups xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
pxor xmm0, xmmword [rsp + 0x20]
mov dword [r8 + 0xe4], edx
movups xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
pxor xmm0, xmmword [rsp + 0x30]
movups xmmword [r8 + 0x30], xmm0
add rsp, 0x40
pop rdi
ret
cmp byte [rcx + 0xe8], 0
je 0x68aa91
mov qword [rcx + 0x58], 0xffffffffffffffff
mov rax, 0xffffffffffffffff
mov qword [r8 + 0x50], rax
jmp 0x68aa76
mov eax, 0xffffffff
jmp 0x68aa76
Function at 0x68aab0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0xe8
test rcx, rcx
mov r10, rdx
mov rbx, rcx
mov rdx, r8
je 0x68ac4e
lea rax, [r10 - 1]
cmp rax, 0x3f
ja 0x68ac30
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x68ac30
test r8, r8
je 0x68ac30
lea r8, [rcx + 0x40]
xor eax, eax
mov ecx, 0x16
mov byte [rsp + 0x20], r10b
mov word [rsp + 0x3e], ax
mov rdi, r8
xor eax, eax
mov r8, r9
rep stosq qword [rdi], rax
mov rcx, qword [0x00d05740]
mov byte [rsp + 0x21], r9b
mov qword [rsp + 0x22], 0x101
mov qword [rsp + 0x2a], 0
mov qword [rsp + 0x32], 0
mov qword [rbx], rcx
mov rcx, qword [0x00d05748]
mov dword [rsp + 0x3a], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rbx + 8], rcx
mov rcx, qword [0x00d05750]
mov qword [rsp + 0x50], 0
movdqu xmm0, xmmword [rbx]
pxor xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x58], 0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rcx
mov rcx, qword [0x00d05758]
mov qword [rbx + 0x18], rcx
mov rcx, qword [0x00d05760]
movdqu xmm0, xmmword [rbx + 0x10]
mov qword [rbx + 0x20], rcx
mov rcx, qword [0x00d05768]
mov qword [rbx + 0x28], rcx
mov rcx, qword [0x00d05770]
mov qword [rbx + 0x30], rcx
mov rcx, qword [0x00d05778]
mov qword [rbx + 0x38], rcx
pxor xmm0, xmmword [rsp + 0x30]
mov ecx, 0x10
mov dword [rbx + 0xe4], r10d
lea r10, [rsp + 0x60]
mov rdi, r10
movups xmmword [rbx + 0x10], xmm0
movdqu xmm0, xmmword [rbx + 0x20]
pxor xmm0, xmmword [rsp + 0x40]
rep stosq qword [rdi], rax
movups xmmword [rbx + 0x20], xmm0
mov rcx, r10
movdqu xmm0, xmmword [rbx + 0x30]
pxor xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x30], xmm0
call sub.msvcrt.dll_memcpy
cmp qword [rbx + 0x50], 0
jne 0x68ac24
mov r8d, pe_nt_image_headers64
mov rdx, rax
mov rcx, rbx
call fcn.0068a670
xor eax, eax
add rsp, 0xe8
pop rbx
pop rdi
ret
cmp byte [rbx + 0xe8], 0
je 0x68ac41
mov qword [rbx + 0x58], 0xffffffffffffffff
mov rax, 0xffffffffffffffff
mov qword [rbx + 0x50], rax
jmp 0x68ac26
mov eax, 0xffffffff
jmp 0x68ac26
Function at 0x68c2c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r14, qword [0x00d92d50]
xor r13d, r13d
movabs rax, 0x5851f42d4c957f2d
lea rbp, [rcx + 0x187a8]
mov r12, rdx
mov rsi, rcx
lea rdx, [r8 + 1]
imul rax, rdx
movabs rdx, 0x810a978a59f5a1fc
lea rdi, [rsp + 0x20]
xor rdx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa77099df38c2d846
xor rdx, rax
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8126b91cbf22495c
xor rdx, rax
mov qword [rsp + 0x38], rdx
movabs rdx, 0x494d2597179f8a62
xor rdx, rax
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9237efb9ceaaec0c
xor rdx, rax
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2f2a56746ce62d78
xor rdx, rax
mov qword [rsp + 0x50], rdx
movabs rdx, 0x84853bf7b62ce54e
xor rax, rdx
mov qword [rsp + 0x58], rax
mov eax, dword [r14 + 0x18]
test eax, eax
je 0x68c427
nop dword [rax]
mov eax, dword [r14]
mov rcx, rdi
shl eax, 0xa
shr eax, 6
lea ebx, [rax - 1]
mov eax, r13d
add r13d, 1
imul rax, rax, 0x1878
and rbx, r8
mov r8, rbp
shl rbx, 6
add rbx, qword [rsi]
lea r15, [rsi + rax + 0x28]
prefetchnta byte [rbx]
mov rdx, r15
call fcn.0068cc60
mov rax, qword [rbx]
xor qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
xor qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
xor qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x18]
xor qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x20]
xor qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x28]
xor qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x30]
xor qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x38]
xor qword [rsp + 0x58], rax
movsxd rax, dword [r15 + 0x1814]
cmp dword [r14 + 0x18], r13d
mov r8, qword [rsp + rax*8 + 0x20]
ja 0x68c390
mov rax, qword [rsp + 0x20]
mov qword [r12], rax
mov rax, qword [rsp + 0x28]
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [r12 + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [r12 + 0x18], rax
mov rax, qword [rsp + 0x40]
mov qword [r12 + 0x20], rax
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [r12 + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [r12 + 0x38], rax
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x691700
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov ecx, dword [rcx + 0x30]
mov byte [rsp + 0x60], r8b
mov rsi, rdx
mov eax, dword [rbx + 0x38]
xor edx, edx
mov byte [rsp + 0x68], r9b
mov r8d, ecx
add r8d, eax
setb dl
add edx, dword [rbx + 0x34]
cmp eax, 0x1b8
bswap edx
mov dword [rsp + 0x28], edx
mov edx, r8d
bswap edx
mov dword [rsp + 0x2c], edx
je 0x6918e0
cmp eax, 0x1b7
jg 0x691891
test eax, eax
je 0x691885
sub r8d, 0x1b8
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 0x1b8
lea rdx, [0x00d08d40]
sub r8d, eax
movsxd r8, r8d
call fcn.00691540
lea rdx, [rsp + 0x68]
mov r8d, 8
mov rcx, rbx
call fcn.00691540
mov eax, dword [rbx + 0x30]
sub eax, 8
sub eax, 0x40
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 0x30], eax
lea rdx, [rsp + 0x28]
call fcn.00691540
mov eax, dword [rbx]
shr eax, 0x18
mov byte [rsi], al
mov eax, dword [rbx]
shr eax, 0x10
mov byte [rsi + 1], al
mov eax, dword [rbx]
mov byte [rsi + 2], ah
mov eax, dword [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, word [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
mov byte [rsi + 6], ah
mov eax, dword [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, word [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
mov byte [rsi + 0xa], ah
mov eax, dword [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, word [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xe], ah
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, word [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x12], ah
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rbx + 0x17]
mov byte [rsi + 0x14], al
movzx eax, word [rbx + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x16], ah
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rbx + 0x1b]
mov byte [rsi + 0x18], al
movzx eax, word [rbx + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1a], ah
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rbx + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, word [rbx + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1e], ah
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1f], al
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rbx + 0x3c], 1
jmp 0x691757
sub r8d, 0x200
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 0x200
lea rdx, [0x00d08d40]
sub r8d, eax
movsxd r8, r8d
call fcn.00691540
mov r8d, 0x1b8
mov rcx, rbx
sub dword [rbx + 0x30], 0x1b8
lea rdx, [0x00d08d41]
call fcn.00691540
mov dword [rbx + 0x3c], 1
jmp 0x69177d
lea rdx, [rsp + 0x60]
sub ecx, 8
mov r8d, 8
mov dword [rbx + 0x30], ecx
mov rcx, rbx
call fcn.00691540
mov eax, dword [rbx + 0x30]
jmp 0x691796
Function at 0x691940
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rbx
sub rsp, 0xb8
movdqa xmm0, xmmword [0x00d08ed0]
lea rsi, [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
shl r8, 3
mov rbx, rcx
movdqa xmm0, xmmword [0x00d08ee0]
mov rcx, rsi
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
movaps xmmword [rsp + 0x40], xmm0
pxor xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
call fcn.00691540
mov ecx, dword [rsp + 0x60]
xor edx, edx
mov byte [rsp + 0x26], 0x81
mov eax, dword [rsp + 0x68]
mov byte [rsp + 0x27], 1
mov r8d, ecx
add r8d, eax
setb dl
add edx, dword [rsp + 0x64]
cmp eax, 0x1b8
bswap edx
mov dword [rsp + 0x28], edx
mov edx, r8d
bswap edx
mov dword [rsp + 0x2c], edx
je 0x691af1
cmp eax, 0x1b7
jg 0x691aa0
test eax, eax
je 0x691a90
sub r8d, 0x1b8
mov rcx, rsi
mov dword [rsp + 0x60], r8d
mov r8d, 0x1b8
lea rdx, [0x00d08d40]
sub r8d, eax
movsxd r8, r8d
call fcn.00691540
lea rdx, [rsp + 0x27]
mov r8d, 8
mov rcx, rsi
call fcn.00691540
mov eax, dword [rsp + 0x60]
sub eax, 8
sub eax, 0x40
mov r8d, 0x40
mov rcx, rsi
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x60], eax
call fcn.00691540
mov eax, dword [rsp + 0x30]
bswap eax
mov dword [rbx], eax
mov eax, dword [rsp + 0x34]
bswap eax
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x38]
bswap eax
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x3c]
bswap eax
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x40]
bswap eax
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x44]
bswap eax
mov dword [rbx + 0x14], eax
mov eax, dword [rsp + 0x48]
bswap eax
mov dword [rbx + 0x18], eax
mov eax, dword [rsp + 0x4c]
bswap eax
mov dword [rbx + 0x1c], eax
add rsp, 0xb8
pop rbx
pop rsi
ret
mov dword [rsp + 0x6c], 1
jmp 0x6919e0
sub r8d, 0x200
mov rcx, rsi
mov dword [rsp + 0x60], r8d
mov r8d, 0x200
lea rdx, [0x00d08d40]
sub r8d, eax
movsxd r8, r8d
call fcn.00691540
mov r8d, 0x1b8
mov rcx, rsi
sub dword [rsp + 0x60], 0x1b8
lea rdx, [0x00d08d41]
call fcn.00691540
mov dword [rsp + 0x6c], 1
jmp 0x691a07
lea rdx, [rsp + 0x26]
sub ecx, 8
mov r8d, 8
mov dword [rsp + 0x60], ecx
mov rcx, rsi
call fcn.00691540
mov eax, dword [rsp + 0x60]
jmp 0x691a21
Function at 0x69a49d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
movdqu xmm0, xmmword [rcx + rax]
movdqu xmm1, xmmword [rdx + rax]
pxor xmm0, xmm1
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, 0x400
jne 0x69a49f
ret
Function at 0x6a1480
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00e1ce68]
test eax, eax
je 0x6a14a0
mov eax, dword [0x00e1ce64]
add rsp, 0x28
ret
lea rcx, str.HWLOC_HIDE_ERRORS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6a14d0
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [0x00e1ce64], eax
mov dword [0x00e1ce68], 1
add rsp, 0x28
ret
mov eax, dword [0x00e1ce64]
jmp 0x6a14bf
Function at 0x6a9840
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x9c], 1
mov dword [rcx + 0x29c], 1
mov rbx, rcx
jne 0x6a9867
mov dword [rcx + 0x29c], 0
lea rcx, str.HWLOC_GROUPING
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6a98a0
mov rcx, rax
call sub.msvcrt.dll_atoi
test eax, eax
jne 0x6a98a0
mov dword [rbx + 0x29c], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x29c]
test eax, eax
je 0x6a988e
movabs rax, 0x3c23d70a00000000
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov dword [rbx + 0x2a4], 5
mov qword [rbx + 0x2a8], rax
movabs rax, 0x3d4ccccd3ca3d70a
mov qword [rbx + 0x2b0], rax
mov qword [rbx + 0x2b8], 0x3dcccccd
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6a9970
mov ecx, 4
lea rdi, [0x00d0c258]
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
seta dl
sbb dl, 0
test dl, dl
jne 0x6a9942
mov dword [rbx + 0x2a0], 0
lea rcx, str.HWLOC_GROUPING_VERBOSE
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6a988e
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rbx + 0x2a0], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rbx + 0x2a4], 1
mov rcx, rax
call sub.msvcrt.dll_atof
pxor xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss dword [rbx + 0x2a8], xmm1
jmp 0x6a990d
mov dword [rbx + 0x2a4], 1
jmp 0x6a990d
Function at 0x6ab710
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x2c0]
mov dword [rcx + 0xb4], 1
mov rsi, rcx
test rbx, rbx
je 0x6ab7c1
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
mov eax, dword [rbx + 0x10]
test eax, eax
jne 0x6ab764
mov eax, dword [rbx + 0x24]
cmp eax, 0xffffffff
je 0x6ab764
test eax, eax
jne 0x6ab7f0
mov dword [rsi + 0xb4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x6ab743
mov rbx, qword [rsi + 0x2c0]
test byte [rsi + 0x20], 2
jne 0x6ab824
test rbx, rbx
je 0x6ab7c1
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
jmp 0x6ab79c
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x6ab7c1
cmp dword [rbx + 0x10], 1
jne 0x6ab793
mov eax, dword [rbx + 0x24]
cmp eax, 0xffffffff
je 0x6ab793
test eax, eax
jne 0x6ab810
mov dword [rsi + 0xb4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x6ab79c
lea rcx, str.HWLOC_THISSYSTEM
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6ab7e0
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rsi + 0xb4], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x2d8
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6ab75a
mov r8d, 0x2e6
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6ab7ae
mov dword [rsi + 0xb4], 1
jmp 0x6ab77e
Function at 0x6b0250
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, rcx
lea rcx, str.HWLOC_PCI_LOCALITY
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
je 0x6b02de
mov dword [rdi + 0x2fc], 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open]
mov esi, eax
test eax, eax
js 0x6b02f0
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__fstat64]
cmp eax, 0xffffffff
je 0x6b02d5
mov rbp, qword [rsp + 0x38]
test eax, eax
jne 0x6b02d5
cmp ebp, 0x10000
jg 0x6b0305
lea ecx, [rbp + 1]
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
mov r8d, ebp
mov ecx, esi
mov rbx, rax
mov rdx, rax
call qword [sym.imp.msvcrt.dll__read]
cmp eax, ebp
je 0x6b0330
mov rcx, rbx
call fcn.00911ec8
mov ecx, esi
call qword [sym.imp.msvcrt.dll__close]
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rbx
mov rcx, rdi
call fcn.006afad0
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 2
call qword [fcn.00912130]
mov r9d, ebp
mov r8, rbx
lea rdx, str.Ignoring_HWLOC_PCI_LOCALITY_file___s_too_large___lu_bytes__n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6b02d5
cdqe
mov rdx, rbx
mov rcx, rdi
mov byte [rbx + rax], 0
call fcn.006afad0
jmp 0x6b02cd
Function at 0x6b2b30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x88], rdx
mov edx, 0x29
mov ebx, r8d
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x20], rcx
call sub.msvcrt.dll_strchr
mov r8, qword [rsp + 0x20]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6b2da2
movzx eax, byte [r8]
xor r15d, r15d
xor r13d, r13d
xor r14d, r14d
lea rbp, [0x00d0db7e]
lea r12, [0x00d0db70]
cmp al, 0x29
je 0x6b2c22
lea eax, [rbx - 4]
cmp eax, 7
jbe 0x6b2cb0
mov ecx, 7
lea rsi, str.memory
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x6b2d10
mov ecx, 8
mov rsi, rbp
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x6b2d31
lea r13, [r8 + 8]
lea rdx, [0x00d0db87]
mov rcx, r13
mov qword [rsp + 0x80], r13
call sub.msvcrt.dll_strcspn
lea rsi, [r13 + rax]
mov r15, rax
mov qword [rsp + 0x80], rsi
movzx eax, byte [rsi]
cmp al, 0x20
je 0x6b2cf1
cmp al, 0x29
jne 0x6b2d52
mov rax, qword [rsp + 0x98]
mov qword [rax], r14
test r13, r13
je 0x6b2c86
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
je 0x6b2c70
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x6b2c70
mov ecx, 2
call qword [fcn.00912130]
mov r8d, 0x3c
mov edx, 1
lea rcx, str.Overwriting_duplicate_indexes_attribute_with_last_occurence_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rsp + 0xa0]
mov qword [rax], r13
mov rax, qword [rsp + 0xa8]
mov dword [rax], r15d
mov r15, qword [rsp + 0x28]
mov rax, qword [rsp + 0x88]
add r15, 1
mov qword [rax], r15
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 5
mov rsi, r12
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x6b2bca
lea rcx, [r8 + 5]
lea rdx, [rsp + 0x80]
call fcn.006b1300
mov rsi, qword [rsp + 0x80]
mov r14, rax
movzx eax, byte [rsi]
cmp al, 0x20
jne 0x6b2c1a
lea r8, [rsi + 1]
mov qword [rsp + 0x80], r8
movzx eax, byte [rsi + 1]
jmp 0x6b2b98
lea rcx, [r8 + 7]
lea rdx, [rsp + 0x80]
call fcn.006b1300
mov rsi, qword [rsp + 0x80]
mov r14, rax
jmp 0x6b2c0f
mov ecx, dword [rsp + 0xb0]
test ecx, ecx
jne 0x6b2d7c
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x6b2c9c
mov edx, dword [rsp + 0xb0]
test edx, edx
je 0x6b2d3c
mov ecx, 2
call qword [fcn.00912130]
mov r8, rsi
lea rdx, str.Missing_parameter_separator_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6b2d3c
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.00912130]
mov r8, qword [rsp + 0x20]
lea rdx, str.Unknown_attribute_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6b2d3c
mov r9d, dword [rsp + 0xb0]
test r9d, r9d
je 0x6b2d3c
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.00912130]
mov r8, qword [rsp + 0x20]
lea rdx, str.Missing_attribute_closing_bracket_in_synthetic_string_doesnt_have_a_number_of_objects_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6b2d3c