joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a520
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x14005a540
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x14005a576
lea rdx, [rcx - 1]
mov r8d, 0x20003000
xor ecx, ecx
and rdx, 0xffffffffffe00000
add rdx, 0x200000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14005a58d
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
pop rbx
ret

Function at 0x14005a75c
Capabilities:
Manipulate user privileges

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x28]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14005a879
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], ebx
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rbp + 0x20]
test r9d, r9d
je 0x14005a7c7
mov edx, r9d
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rbp + 0x20]
mov rdi, rax
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov r8, rdi
mov qword [rsp + 0x20], rax
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14005a879
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x30]
mov r8d, 0xf0fff
lea rdx, [rbp - 0x30]
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x14005a86c
lea rdx, str.SeLockMemoryPrivilege
lea rcx, [rbp - 0x40]
call fcn.14005a720
mov rdx, qword [rdi]
lea r8, [rbp - 0x50]
mov rcx, qword [rbp + 0x30]
mov r9d, 1
movups xmm0, xmmword [rax]
movdqu xmmword [rbp - 0x50], xmm0
call sub.ADVAPI32.dll_LsaAddAccountRights
test eax, eax
jne 0x14005a863
lea rdx, str.Huge_pages_support_was_successfully_enabled__but_reboot_required_to_use_it
lea ecx, [rax + 5]
call fcn.1400126bc
mov ebx, 1
mov rcx, qword [rbp + 0x30]
call sub.ADVAPI32.dll_LsaClose
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
jmp 0x14005a87b
xor eax, eax
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret
Function at 0x14005ddd4
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14005df61
cmp ecx, 0x7c
je 0x14005df61
cmp ecx, 0x29
jne 0x14005de4e
cmp dword [rdi + 0x1c], 0
jne 0x14005df61
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x14005df7a
cmp ecx, 0x5d
jne 0x14005de2b
test dword [rbx], 0x10000000
je 0x14005df88
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.14005e1b4
mov rcx, rdi
call fcn.14005d184
mov rcx, rdi
call fcn.14005dcc8
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x14005dde6
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x14005de65
lea rcx, [rdi + 0x40]
call fcn.14005e1a8
jmp 0x14005de37
cmp ecx, 0x5c
jne 0x14005deb3
mov rcx, rdi
call fcn.14005d184
test byte [rbx], 0x80
je 0x14005dea9
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x14005de91
lea rcx, [rdi + 0x40]
call fcn.14005e19c
mov rcx, rdi
call fcn.14005d184
jmp 0x14005de47
cmp al, 0x42
jne 0x14005dea9
lea rcx, [rdi + 0x40]
call fcn.14005e19c
lea rcx, [rdi + 0x40]
call fcn.14005ec74
jmp 0x14005de87
mov rcx, rdi
call fcn.14005da48
jmp 0x14005de3f
cmp ecx, 0x5b
jne 0x14005dede
mov rcx, rdi
call fcn.14005d184
mov rcx, rdi
call fcn.14005d764
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.14005d1d4
jmp 0x14005de3f
cmp ecx, 0x28
jne 0x14005df13
mov rcx, rdi
call fcn.14005d184
mov rcx, rdi
call fcn.14005dc28
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.14005d1d4
test bl, bl
je 0x14005de47
jmp 0x14005de3f
cmp ecx, 0x5e
jne 0x14005df26
lea rcx, [rdi + 0x40]
call fcn.14005e184
jmp 0x14005de87
cmp ecx, 0x24
jne 0x14005df39
lea rcx, [rdi + 0x40]
call fcn.14005e190
jmp 0x14005de87
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14005df96
cmp ecx, 0x3f
je 0x14005df96
cmp ecx, 0x7b
je 0x14005df96
cmp ecx, 0x7d
jne 0x14005de1a
test dword [rbx], 0x10000000
je 0x14005df6c
jmp 0x14005de2b
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.14005cff0
int3
mov edx, 5
mov rcx, rdi
call fcn.14005cff0
int3
mov edx, 4
mov rcx, rdi
call fcn.14005cff0
int3
mov edx, 0xa
mov rcx, rdi
call fcn.14005cff0
int3
Function at 0x140061858
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14046e3c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400618b7
xor al, al
jmp 0x140061963
mov r9d, esi
mov r8, rbx
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
cmp eax, esi
je 0x1400618e4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400618b0
movzx ecx, byte [rbx + 1]
shl ecx, 0x10
movzx eax, byte [rbx + 2]
shl eax, 8
add ecx, eax
movzx eax, byte [rbx + 3]
add ecx, eax
mov dword [rdi + 0x5c], ecx
mov eax, dword [rbx + 4]
mov dword [rdi + 0x58], eax
and qword [rsp + 0x68], 0
lea rcx, [rsp + 0x20]
call fcn.140057998
test al, al
je 0x140061932
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_b1841b2b3d7edfd58a8a013d8118f4e5___void___.0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
lea rdx, [rbx + 8]
lea r8, [rsp + 0x30]
mov rcx, rdi
call fcn.140090f44
mov bl, al
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140061961
mov r8, qword [rcx]
lea rax, [rsp + 0x30]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov al, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400106c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14006469c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xc8], 0
mov rsi, r9
mov ebp, edx
mov rbx, rcx
je 0x1400646e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_recv
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, r8
call fcn.140065108
mov rdi, rax
test rax, rax
jne 0x140064705
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x28
jmp 0x1400646cd
mov rax, qword [rsp + 0x68]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [rsp + 0x60]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [rdi + reloc.WS2_32.dll_recv]
mov rsi, rax
test rax, rax
je 0x1400646cd
mov dword [rax + 0x10], ebp
cmp qword [rbx + 0x318], 0
je 0x140064745
mov rcx, rbx
call fcn.140064ba8
mov rcx, rsi
call fcn.140064554
cmp dword [rdi + 8], 1
mov esi, eax
jne 0x14006477b
lea rcx, str.HWLOC_ANNOTATE_GLOBAL_COMPONENTS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14006477b
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
je 0x14006477b
and dword [rbx + 0x32c], 0xffffffbf
mov eax, esi
jmp 0x1400646d0
Function at 0x140064acc
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x318]
mov edx, 1
mov dword [rcx + 0xc4], edx
mov rbx, rcx
mov rcx, rax
test rax, rax
je 0x140064b0b
cmp dword [rcx + 0x10], 0
jne 0x140064b02
cmp dword [rcx + 0x28], 0xffffffff
je 0x140064b02
and dword [rbx + 0xc4], 0
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x140064aef
test byte [rbx + 0x20], 2
je 0x140064b2f
mov dword [rbx + 0xc4], edx
jmp 0x140064b2f
cmp dword [rax + 0x10], edx
jne 0x140064b2b
cmp dword [rax + 0x28], 0xffffffff
je 0x140064b2b
and dword [rbx + 0xc4], 0
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x140064b19
lea rcx, str.HWLOC_THISSYSTEM
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140064b55
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbx + 0xc4], eax
add rsp, 0x20
pop rbx
ret
Function at 0x140064c44
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x20
mov ebp, 1
jmp 0x140064c66
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x1407082a8], ebp
jne 0x140064c60
mov eax, dword [0x1407082a0]
mov ecx, eax
add eax, ebp
mov dword [0x1407082a0], eax
test ecx, ecx
jne 0x140064dde
lea rcx, str.HWLOC_COMPONENTS_VERBOSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140064ca5
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
and qword [0x1407082b0], 0
lea r15, [0x14046e998]
and dword [0x1407082ac], 0
xor r8d, r8d
mov rcx, qword [0x14046e998]
xor edx, edx
mov dword [0x1407082a4], eax
test rcx, rcx
je 0x140064ce4
add r8d, ebp
inc edx
cmp qword [r15 + r8*8], 0
jne 0x140064cd2
mov dword [0x1407082ac], edx
test edx, edx
je 0x140064d0a
mov ecx, edx
mov edx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
and dword [0x1407082ac], 0
mov rcx, qword [0x14046e998]
mov qword [0x1407082b0], rax
xor edi, edi
test rcx, rcx
je 0x140064dde
mov rbx, r15
cmp dword [rcx + 0x1c], 0
je 0x140064d4f
call fcn.140024c0c
cmp eax, 2
jge 0x140064dcc
mov rbx, qword [rbx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [rbx + 0x1c]
lea rdx, str.hwloc:_Ignoring_static_component_with_invalid_flags__lx_n
mov rcx, rax
call fcn.140010930
jmp 0x140064dcc
mov rax, qword [rcx + 8]
test rax, rax
je 0x140064d85
xor ecx, ecx
call rax
test eax, eax
jns 0x140064d85
cmp dword [0x1407082a4], 0
je 0x140064dcc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.hwloc:_Ignoring_static_component__failed_to_initialize_n
call fcn.140010930
jmp 0x140064dcc
mov rax, qword [rbx]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x140064da8
mov ecx, dword [0x1407082ac]
mov rax, qword [0x1407082b0]
mov qword [rax + rcx*8], rdx
add dword [0x1407082ac], ebp
mov rcx, qword [rbx]
cmp dword [rcx + 0x18], 0
jne 0x140064dbe
mov rcx, qword [rcx + 0x20]
xor edx, edx
call fcn.140064e90
jmp 0x140064dcc
cmp dword [rcx + 0x18], ebp
jne 0x140064dcc
mov rcx, qword [rcx + 0x20]
call fcn.140029428
add edi, ebp
lea rbx, [r15 + rdi*8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140064d18
and dword [0x1407082a8], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r15
ret
Function at 0x140065534
Capabilities:
Query environment variable
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14046e3c8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
lea rcx, str.HWLOC_PCI_LOCALITY
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
je 0x140065631
xor edx, edx
mov dword [rsi + 0x358], 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open]
mov edi, eax
test eax, eax
js 0x140065626
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
test eax, eax
jne 0x14006561c
mov eax, dword [rsp + 0x34]
cmp eax, 0x10000
jg 0x1400655f1
inc eax
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400655e6
mov r8d, dword [rsp + 0x34]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cmp eax, dword [rsp + 0x34]
jne 0x1400655e6
movsxd rdx, dword [rsp + 0x34]
mov rcx, rsi
mov byte [rdx + rbx], 0
mov rdx, rbx
call fcn.140065860
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14006561c
call fcn.140024c0c
mov ecx, 2
cmp eax, ecx
jge 0x14006561c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [rsp + 0x34]
lea rdx, str.hwloc_pci:_Ignoring_HWLOC_PCI_LOCALITY_file___s_too_large___lu_bytes__n
mov rcx, rax
mov r8, rbx
call fcn.140010930
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
jmp 0x140065631
mov rdx, rbx
mov rcx, rsi
call fcn.140065860
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400106c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140065cf4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov dword [rcx + 0x2f0], 1
xor esi, esi
cmp dword [rcx + 0xa4], 1
mov rbx, rcx
mov eax, dword [rcx + 0x2f0]
cmove eax, esi
mov dword [rcx + 0x2f0], eax
lea rcx, str.HWLOC_GROUPING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140065d4d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
jne 0x140065d4d
mov dword [rbx + 0x2f0], esi
cmp dword [rbx + 0x2f0], esi
je 0x140065e0f
mov qword [rbx + 0x30c], 0x3dcccccd
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov dword [rbx + 0x2fc], esi
mov dword [rbx + 0x300], 0x3c23d70a
mov dword [rbx + 0x304], 0x3ca3d70a
mov dword [rbx + 0x308], 0x3d4ccccd
mov dword [rbx + 0x2f8], 5
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
jne 0x140065db3
mov dword [rbx + 0x2f8], 1
jmp 0x140065de8
lea rdx, [0x140411b58]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140065de8
mov rcx, rdi
mov dword [rbx + 0x2f8], 1
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss dword [rbx + 0x2fc], xmm1
lea rcx, str.HWLOC_GROUPING_VERBOSE
mov dword [rbx + 0x2f4], esi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140065e0f
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbx + 0x2f4], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400672cc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ebp, edx
lea rcx, str.HWLOC_MEMTIERS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
je 0x140067334
lea rdx, str.none
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400673a4
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140068384
mov rbx, rax
test rax, rax
je 0x140067334
mov edi, dword [rsp + 0x40]
mov ebp, 1
jmp 0x140067372
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140067b98
mov rbx, rax
test rax, rax
je 0x1400673a4
mov edi, dword [rsp + 0x40]
mov r8, rax
mov edx, edi
mov rcx, rsi
call fcn.1400681dc
mov edx, edi
lea r9, [0x140067b4c]
mov r8d, 0x30
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
mov r9d, ebp
mov r8, rbx
mov edx, edi
mov rcx, rsi
call fcn.1400685ac
test edi, edi
je 0x14006739b
mov rsi, rbx
mov rcx, qword [rsi]
call fcn.140061a8c
lea rsi, [rsi + 0x30]
sub rdi, 1
jne 0x140067389
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400681dc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rcx, str.HWLOC_MEMTIERS_GUESS
mov esi, edx
mov rbp, r8
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
je 0x140068268
lea rdx, str.none
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14006836b
lea rdx, [0x140412330]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
or ecx, 0xffffffff
lea rdx, str.spm_is_hbm
test eax, eax
cmove ebx, ecx
mov rcx, rdi
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140068251
or ebx, 2
lea rdx, str.node0_is_dram
mov rcx, rdi
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140068268
or ebx, 1
cmp esi, 1
je 0x14006836b
xor edx, edx
xor r11d, r11d
and qword [rsp + 0x28], rdx
xor r9d, r9d
and qword [rsp + 0x20], rdx
xor r8d, r8d
test esi, esi
je 0x140068309
lea r10, [rbp + 0x28]
mov ecx, dword [r10]
test ecx, ecx
je 0x1400682b4
sub ecx, 1
je 0x1400682e8
sub ecx, 1
je 0x1400682e8
cmp ecx, 6
jne 0x1400682cb
lea r9, [r8 + r8*2]
shl r9, 4
add r9, rbp
inc r11d
jmp 0x1400682cb
cmp edx, 2
jae 0x1400682c9
lea rcx, [r8 + r8*2]
shl rcx, 4
add rcx, rbp
mov qword [rsp + rdx*8 + 0x20], rcx
inc edx
inc r8d
add r10, 0x30
cmp r8d, esi
jb 0x14006828e
cmp edx, 2
jne 0x1400682ef
test r11d, r11d
jne 0x140068309
mov rdx, qword [rsp + 0x28]
jmp 0x1400682fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp edx, 1
jne 0x140068309
cmp r11d, edx
jne 0x140068309
mov rdx, r9
mov rcx, qword [rsp + 0x20]
mov r8d, ebx
call fcn.14006816c
test bl, 2
je 0x14006832e
test esi, esi
je 0x14006832e
lea rax, [rbp + 0x28]
mov rcx, rsi
cmp dword [rax], 8
jne 0x140068324
mov dword [rax], 1
add rax, 0x30
sub rcx, 1
jne 0x140068319
test bl, 1
je 0x14006836b
xor ebx, ebx
test esi, esi
je 0x14006836b
mov rdi, rbp
mov rcx, qword [rdi]
xor edx, edx
call fcn.140062084
test eax, eax
je 0x140068350
cmp dword [rdi + 0x28], 0
je 0x14006835c
inc ebx
add rdi, 0x30
cmp ebx, esi
jae 0x14006836b
jmp 0x14006833c
lea rcx, [rbx + rbx*2]
add rcx, rcx
mov dword [rbp + rcx*8 + 0x28], 2
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14006ba88
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140708368], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x14006baaf
call fcn.14006bdac
mov r8, rsi
lea rdx, [rsp + 0x58]
lea rcx, [0x140708360]
call fcn.14006bbac
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [0x140708360]
je 0x14006badf
add rdx, 0x30
mov rcx, rbx
call fcn.1400163d4
jmp 0x14006bb14
cmp qword [rdi + 8], 0
je 0x14006bb00
mov r8, rsi
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14006bbac
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rdi]
jne 0x14006bad1
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
mov rcx, rbx
call fcn.140016378
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14006bb28
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x14046e3c8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
mov edx, 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x14006bb80
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140016378
jmp 0x14006bb8f
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx], 0
and qword [rbx + 8], 0
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400106c0
add rsp, 0x140
pop rbx
ret
Function at 0x140072978
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14046e3c8]
xor rax, rsp
mov qword [rbp - 8], rax
or esi, 0xffffffff
mov r14d, edx
mov rdi, rcx
cmp edx, esi
jne 0x1400729b2
xor eax, eax
jmp 0x140072ad1
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1400729eb
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1400729eb
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], r14b
mov eax, r14d
jmp 0x140072ad1
cmp qword [rdi + 0x80], 0
je 0x140072acf
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140072a25
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140072a46
movsx ecx, r14b
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, esi
jmp 0x140072acb
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], r14b
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140072a94
sub eax, 1
je 0x140072a94
cmp eax, 2
jne 0x140072acf
movsx ecx, byte [rbp - 0x40]
jmp 0x140072a32
mov rbx, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub rbx, rax
je 0x140072abf
mov r9, qword [rdi + 0x80]
lea rcx, [rbp - 0x28]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140072acf
lea rax, [rbp - 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rbp - 0x30], rax
cmovne esi, r14d
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400106c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret