joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401670a0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
test rdx, rdx
mov qword [rsp + 0x4a8], rdx
mov r14, r8
sete dl
test r8, r8
sete al
or dl, al
jne 0x140167290
test rcx, rcx
je 0x140167290
cmp qword [r8], 0
je 0x140167290
lea r8, [rsp + 0x48]
mov edx, 0xffffffff
call fcn.140166c00
mov r13d, eax
test eax, eax
jne 0x1401671e7
lea rsi, [rsp + 0x50]
mov rbp, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, 0x200
mov rdi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r12, rsi
jmp 0x140167148
cmp r12, rsi
je 0x14016712d
mov rcx, r12
call fcn.1401419e0
lea ecx, [r15 + 1]
mov rbx, rcx
add rcx, rcx
call fcn.1401419c0
mov r12, rax
test rax, rax
je 0x140167200
xor ecx, ecx
call rbp
mov rcx, qword [rsp + 0x48]
mov r8d, ebx
mov rdx, r12
call rdi
mov r15d, eax
cmp eax, ebx
jae 0x140167120
mov rcx, qword [rsp + 0x48]
call fcn.1401419e0
mov qword [rsp + 0x48], 0
test r15d, r15d
je 0x140167220
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x140167288
mov rdx, qword [r14]
mov eax, eax
cmp rax, rdx
jbe 0x140167240
mov qword [r14], rax
mov r13d, 0xfffff024
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401671e2
call fcn.1401419e0
cmp r12, rsi
jne 0x140167210
mov eax, r13d
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov r13d, 0xfffff027
test rcx, rcx
jne 0x1401671dd
mov rcx, r12
call fcn.1401419e0
jmp 0x1401671e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14016717c
mov ecx, eax
call fcn.140146240
mov r13d, eax
jmp 0x1401671d3
mov rax, qword [rsp + 0x4a8]
mov dword [rsp + 0x28], edx
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x38], 0
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x140167288
sub eax, 1
mov qword [r14], rax
jmp 0x1401671d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14016722e
mov r13d, 0xfffff019
jmp 0x1401671e7

Function at 0x140167c20
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x140167c30
xor eax, eax
add rsp, 0x28
ret
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140167c29
mov eax, 0xfffff01a
jmp 0x140167c2b
Function at 0x140167c50
Capabilities:
Link many functions at runtime

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.ntdll.dll
call rsi
mov r12, rax
test rax, rax
je 0x140167df6
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlGetVersion
mov rcx, rax
call rbx
lea rdx, str.RtlNtStatusToDosError
mov rcx, r12
mov qword [0x1407b2d58], rax
call rbx
mov qword [0x1407b2d50], rax
test rax, rax
je 0x140167de2
lea rdx, str.NtDeviceIoControlFile
mov rcx, r12
call rbx
mov qword [0x1407b2d48], rax
test rax, rax
je 0x140167de2
lea rdx, str.NtQueryInformationFile
mov rcx, r12
call rbx
mov qword [0x1407b2d40], rax
test rax, rax
je 0x140167de2
lea rdx, str.NtSetInformationFile
mov rcx, r12
call rbx
mov qword [0x1407b2d38], rax
test rax, rax
je 0x140167de2
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, r12
call rbx
mov qword [0x1407b2d30], rax
test rax, rax
je 0x140167de2
lea rdx, str.NtQueryDirectoryFile
mov rcx, r12
call rbx
cmp qword [0x1407b2d30], 0
mov qword [0x1407b2d28], rax
je 0x140167de2
lea rdx, str.NtQuerySystemInformation
mov rcx, r12
call rbx
mov qword [0x1407b2d20], rax
test rax, rax
je 0x140167de2
lea rdx, str.NtQueryInformationProcess
mov rcx, r12
call rbx
mov qword [0x1407b2d18], rax
test rax, rax
je 0x140167de2
lea rcx, [0x140474085]
call rsi
mov rcx, rax
test rax, rax
je 0x140167df6
lea rdx, str.GetQueuedCompletionStatusEx
call rbx
lea rcx, str.powrprof.dll
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1407b2d10], rax
call rsi
mov rcx, rax
test rax, rax
je 0x140167db8
lea rdx, str.PowerRegisterSuspendResumeNotification
call rbx
mov qword [0x1407b2d08], rax
lea rcx, str.user32.dll
call rsi
mov rcx, rax
test rax, rax
je 0x140167dd9
lea rdx, str.SetWinEventHook
call rbx
mov qword [0x1407b2d00], rax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.140146180
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.140146180
nop
nop
nop
nop
nop
nop
Function at 0x140167f10
Capabilities:
Initialize winsock library

Disassembly:
push r12
push rbx
sub rsp, 0x468
xor edx, edx
lea r8, [0x1407b2d80]
lea rcx, str.0.0.0.0
call fcn.140143b00
test eax, eax
jne 0x1403f75c0
xor edx, edx
lea r8, [0x1407b2d60]
lea rcx, [0x140474118]
call fcn.140143b50
test eax, eax
jne 0x1403f75c0
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x140167fcb
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140168094
mov rbx, qword [sym.imp.WS2_32.dll_socket]
xor r8d, r8d
mov edx, 1
mov dword [0x1407b2d94], 1
mov ecx, 2
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140168040
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
mov dword [0x1407b2d90], 1
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140167fe0
add rsp, 0x468
pop rbx
pop r12
ret
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140168026
test byte [rsp + 0x1e2], 2
je 0x140168026
mov dword [0x1407b2d90], 0
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
nop
add rsp, 0x468
pop rbx
pop r12
ret
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140168086
test byte [rsp + 0x1e2], 2
je 0x140168086
mov dword [0x1407b2d94], 0
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140167fa9
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.140146180
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14016f840
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1407b2e28]
test eax, eax
je 0x14016f860
mov eax, dword [0x1407b2e24]
add rsp, 0x28
ret
lea rcx, str.HWLOC_HIDE_ERRORS
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x1407b2e24]
test rcx, rcx
je 0x14016f885
call sub.msvcrt.dll_atoi
mov dword [0x1407b2e24], eax
mov dword [0x1407b2e28], 1
add rsp, 0x28
ret
Function at 0x140177cb0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dword [rcx + 0xa4], 1
mov dword [rcx + 0x2cc], 1
mov rbx, rcx
jne 0x140177cd7
mov dword [rcx + 0x2cc], 0
lea rcx, str.HWLOC_GROUPING
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x140177d10
call sub.msvcrt.dll_atoi
test eax, eax
jne 0x140177d10
mov dword [rbx + 0x2cc], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x2cc]
test eax, eax
je 0x140177cfe
movabs rax, 0x3c23d70a00000000
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov dword [rbx + 0x2d4], 5
mov qword [rbx + 0x2d8], rax
movabs rax, 0x3d4ccccd3ca3d70a
mov qword [rbx + 0x2e0], rax
mov qword [rbx + 0x2e8], 0x3dcccccd
call sub.msvcrt.dll_getenv
test rax, rax
je 0x140177de0
mov ecx, 4
lea rdi, [0x140476ebf]
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
seta dl
sbb dl, 0
test dl, dl
jne 0x140177db8
mov dword [rbx + 0x2d0], 0
lea rcx, str.HWLOC_GROUPING_VERBOSE
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x140177cfe
call sub.msvcrt.dll_atoi
mov dword [rbx + 0x2d0], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rbx + 0x2d4], 1
mov rcx, rax
call sub.msvcrt.dll_atof
cvtsd2ss xmm0, xmm0
movss dword [rbx + 0x2d8], xmm0
jmp 0x140177d7d
mov dword [rbx + 0x2d4], 1
jmp 0x140177d7d
Function at 0x14017a650
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x2f0]
mov dword [rcx + 0xc4], 1
mov rsi, rcx
test rbx, rbx
je 0x14017a710
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
nop dword [rax + rax]
mov eax, dword [rbx + 0x10]
test eax, eax
jne 0x14017a6a9
mov eax, dword [rbx + 0x28]
cmp eax, 0xffffffff
je 0x14017a6a9
test eax, eax
jne 0x14017a740
mov dword [rsi + 0xc4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x14017a688
mov rbx, qword [rsi + 0x2f0]
test byte [rsi + 0x20], 2
jne 0x14017a778
test rbx, rbx
je 0x14017a710
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
jmp 0x14017a6e9
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x14017a710
cmp dword [rbx + 0x10], 1
jne 0x14017a6e0
mov eax, dword [rbx + 0x28]
cmp eax, 0xffffffff
je 0x14017a6e0
test eax, eax
jne 0x14017a760
mov dword [rsi + 0xc4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x14017a6e9
nop
lea rcx, str.HWLOC_THISSYSTEM
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x14017a72f
call sub.msvcrt.dll_atoi
mov dword [rsi + 0xc4], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x3fc
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x14017a69f
mov r8d, 0x40a
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x14017a6fb
mov dword [rsi + 0xc4], 1
jmp 0x14017a6c3

Function at 0x14017a880
Capabilities:
Query environment variable

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov edi, edx
mov rcx, r8
mov r12, r9
mov eax, dword [rsi + 0xc8]
test eax, eax
jne 0x14017a950
xor edx, edx
call fcn.1401793a0
mov rbx, rax
test rax, rax
je 0x14017a96c
mov r9, r12
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [rbx + 0x10]
mov r12, rax
test rax, rax
je 0x14017a964
cmp qword [rsi + 0x2f0], 0
mov dword [rax + 0x10], edi
je 0x14017a8fb
mov rcx, rsi
call fcn.14017a7d0
mov rcx, r12
call fcn.140179f80
cmp dword [rbx + 8], 1
mov r12d, eax
je 0x14017a920
mov eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rcx, str.HWLOC_ANNOTATE_GLOBAL_COMPONENTS
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x14017a90c
call sub.msvcrt.dll_atoi
test eax, eax
je 0x14017a90c
and dword [rsi + 0x304], 0xffffffbf
jmp 0x14017a90c
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x10
jmp 0x14017a90c
mov r12d, 0xffffffff
jmp 0x14017a90c
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x28
jmp 0x14017a90c
Function at 0x140181020
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebp, dword [r8]
mov qword [rsp + 0x88], rdx
mov edx, 0x29
mov r12, r8
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x20], rcx
call sub.msvcrt.dll_strchr
mov r8, qword [rsp + 0x20]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x14018129e
cmp byte [r8], 0x29
je 0x140181290
sub ebp, 4
xor r15d, r15d
xor r14d, r14d
xor ebx, ebx
lea r13, [0x1404785b6]
cmp ebp, 7
jbe 0x1401811af
nop dword [rax]
mov ecx, 7
lea rsi, str.memory
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x1401811f0
mov ecx, 8
mov rsi, r13
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x140181218
lea r14, [r8 + 8]
lea rdx, [0x1404785bf]
mov rcx, r14
mov qword [rsp + 0x80], r14
call sub.msvcrt.dll_strcspn
lea rsi, [r14 + rax]
mov r15, rax
mov qword [rsp + 0x80], rsi
movzx eax, byte [rsi]
cmp al, 0x20
je 0x140181190
cmp al, 0x29
jne 0x140181240
mov qword [r12 + 0x10], rbx
test r14, r14
je 0x140181168
mov rax, qword [rsp + 0x98]
cmp qword [rax], 0
je 0x140181155
mov eax, dword [rsp + 0xa0]
test eax, eax
je 0x140181155
mov ecx, 2
call qword [fcn.140225420]
mov r8d, 0x3c
mov edx, 1
lea rcx, str.Overwriting_duplicate_indexes_attribute_with_last_occurence_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rsp + 0x98]
mov qword [rax], r14
mov dword [rax + 8], r15d
nop dword [rax]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x88]
add rax, 1
mov qword [rbx], rax
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [rsi + 1]
mov qword [rsp + 0x80], r8
cmp byte [rsi + 1], 0x29
je 0x14018110d
cmp ebp, 7
ja 0x140181098
mov ecx, 5
lea rsi, [0x1404785a8]
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x1401810b6
lea rcx, [r8 + 5]
lea rdx, [rsp + 0x80]
call fcn.140180f20
mov rsi, qword [rsp + 0x80]
mov rbx, rax
jmp 0x1401810fa
lea rcx, [r8 + 7]
lea rdx, [rsp + 0x80]
call fcn.140180f20
mov rsi, qword [rsp + 0x80]
mov rbx, rax
jmp 0x1401810fa
mov ecx, dword [rsp + 0xa0]
test ecx, ecx
jne 0x14018126a
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x14018117e
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x140181223
mov ecx, 2
call qword [fcn.140225420]
mov r8, rsi
lea rdx, str.Missing_parameter_separator_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x140181223
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.140225420]
mov r8, qword [rsp + 0x20]
lea rdx, str.Unknown_attribute_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x140181223
mov qword [r12 + 0x10], 0
jmp 0x140181168
mov r9d, dword [rsp + 0xa0]
test r9d, r9d
je 0x140181223
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.140225420]
mov r8, qword [rsp + 0x20]
lea rdx, str.Missing_attribute_closing_bracket_in_synthetic_string_doesnt_have_a_number_of_objects_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x140181223
Function at 0x1401832f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rbx, rax
mov qword [rsp + 0x80], rcx
mov rdi, r9
mov dword [rsp + 0x88], edx
test r9, r9
je 0x1401834e0
and edx, 4
je 0x1401833a8
cmp r8d, 1
ja 0x140183515
cmp dword [r9], 0xd
jne 0x140183515
mov r10d, dword [rsp + 0xb0]
test r10d, r10d
jne 0x1401834e8
mov qword [rsp + 0x28], rax
mov edx, dword [rsp + 0x88]
mov r8, rdi
mov r9d, 1
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x80]
call fcn.140183120
test eax, eax
js 0x14018350a
add eax, dword [rsp + 0xb0]
mov r12d, eax
mov eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [sym.imp.msvcrt.dll__assert]
xor r12d, r12d
lea r13, str.topology_synthetic.c
nop dword [rax]
mov r15, rdi
lea rbp, str.numanode__arity__1
nop word [rax + rax]
cmp dword [r15], 0xd
je 0x14018340e
cmp dword [r15 + 0x68], 1
je 0x1401833ec
mov r8d, 0x559
mov rdx, r13
mov rcx, rbp
call r14
mov r15, qword [r15 + 0x90]
test r15, r15
jne 0x1401833d0
mov r8d, 0x55c
mov rdx, r13
lea rcx, str.numanode
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, dword [rsp + 0xb0]
test r8d, r8d
jne 0x1401834c0
cmp rbx, 1
jle 0x140183436
mov edx, 0x5b
add rsi, 1
sub rbx, 1
mov word [rsi - 1], dx
mov qword [rsp + 0x28], rbx
mov r8, r15
add r12d, 1
mov edx, dword [rsp + 0x88]
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x80]
mov r9d, 0xffffffff
call fcn.140183120
test eax, eax
js 0x14018350a
add r12d, eax
cdqe
cmp rax, rbx
jl 0x14018347d
test rbx, rbx
jle 0x140183483
lea eax, [rbx - 1]
cdqe
add rsi, rax
sub rbx, rax
cmp rbx, 1
jle 0x14018349a
mov eax, 0x5d
add rsi, 1
sub rbx, 1
mov word [rsi - 1], ax
mov rdi, qword [rdi + 0x58]
add r12d, 1
mov dword [rsp + 0xb0], 1
test rdi, rdi
jne 0x1401833c0
jmp 0x140183391
cmp rbx, 1
jle 0x1401834d7
mov ecx, 0x20
add rsi, 1
sub rbx, 1
mov word [rsi - 1], cx
add r12d, 1
jmp 0x14018341f
xor r12d, r12d
jmp 0x140183391
cmp rax, 1
jle 0x140183358
mov r9d, 0x20
add rsi, 1
sub rax, 1
mov word [rsi - 1], r9w
jmp 0x140183358
mov r12d, 0xffffffff
jmp 0x140183391
mov r11d, dword [rsp + 0xb8]
test r11d, r11d
jne 0x140183539
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x16
jmp 0x140183391
mov ecx, 2
call qword [fcn.140225420]
mov r8d, 0x5d
mov edx, 1
lea rcx, str.Cannot_export_to_synthetic_v1_if_multiple_memory_children_are_attached_to_the_same_location._n
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x140183522

Function at 0x140183b00
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1407b2e98]
test eax, eax
je 0x140183b20
mov eax, dword [0x1407b2e94]
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x140183b60
call sub.msvcrt.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x1407b2e94], eax
mov dword [0x1407b2e98], 1
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML_IMPORT
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x1407b2e94]
test rcx, rcx
jne 0x140183b34
jmp 0x140183b47
Function at 0x140183b80
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1407b2e90]
test eax, eax
je 0x140183ba0
mov eax, dword [0x1407b2e8c]
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x140183be0
call sub.msvcrt.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x1407b2e8c], eax
mov dword [0x1407b2e90], 1
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML_EXPORT
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x1407b2e8c]
test rcx, rcx
jne 0x140183bb4
jmp 0x140183bc7
Function at 0x140185ee0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1407b2ea0]
test eax, eax
je 0x140185f00
mov eax, dword [0x1407b2e9c]
add rsp, 0x28
ret
lea rcx, str.HWLOC_XML_VERBOSE
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x1407b2e9c]
test rcx, rcx
je 0x140185f25
call sub.msvcrt.dll_atoi
mov dword [0x1407b2e9c], eax
mov dword [0x1407b2ea0], 1
add rsp, 0x28
ret
Function at 0x14018cc00
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp byte [rcx], 0x2d
mov qword [rsp + 0xb0], r8
mov r14, rcx
mov r13, rdx
jne 0x14018cc32
cmp byte [rcx + 1], 0
lea rax, str._dev_stdin
cmove r14, rax
lea rdx, [0x14047ad0a]
mov rcx, r14
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x14018cd3a
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.14021b9f0
test eax, eax
je 0x14018cd08
mov ecx, 0x1001
mov r15d, 0x1000
call sub.msvcrt.dll_malloc
mov r14, rax
test rax, rax
je 0x14018cd49
movabs rdi, 0x7fffffffffffffff
mov rsi, r15
xor ebx, ebx
jmp 0x14018ccb5
lea rbp, [rsi + rsi]
mov rcx, r14
lea rdx, [rbp + 1]
call sub.msvcrt.dll_realloc
test rax, rax
je 0x14018cd41
and rsi, rdi
mov r14, rax
mov r15, rsi
mov rsi, rbp
lea rcx, [r14 + rbx]
mov r9, r12
mov r8, r15
mov edx, 1
call sub.msvcrt.dll_fread
add rbx, rax
mov byte [r14 + rbx], 0
cmp r15, rax
je 0x14018cc90
mov rcx, r12
add rbx, 1
call sub.msvcrt.dll_fclose
mov rax, qword [rsp + 0xb0]
mov qword [r13], r14
mov qword [rax], rbx
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, word [rsp + 0x26]
mov ecx, 0x1001
mov r15d, 0x1000
and ax, 0xf000
cmp ax, 0x8000
jne 0x14018cc6d
mov eax, dword [rsp + 0x34]
lea r15d, [rax + 1]
movsxd r15, r15d
lea rcx, [r15 + 1]
jmp 0x14018cc6d
mov eax, 0xffffffff
jmp 0x14018ccf3
mov rcx, r14
call fcn.140225b60
mov rcx, r12
call sub.msvcrt.dll_fclose
mov eax, 0xffffffff
jmp 0x14018ccf3

Function at 0x14018fad0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [0x1403ff0a8]
mov eax, dword [rsp + 0x40]
cmp ebx, 1
jbe 0x14018fb13
mov rdx, qword [0x1407b2f18]
mov eax, ebx
shl eax, 6
test rdx, rdx
je 0x14018fb13
lea ecx, [rbx - 1]
sub ebx, 1
movzx ecx, cx
shl ebx, 6
call rdx
movzx eax, ax
add eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x1401931a0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov r11, rdx
cmp rdx, 2
jbe 0x140193335
movzx ebx, byte [rcx]
movzx esi, byte [rcx + 2]
lea r10, [rcx + 3]
sub r11, 3
movzx eax, byte [rcx + 1]
mov edi, ebx
mov edx, esi
shl ebx, 4
and esi, 0x3f
shr dl, 6
mov ecx, eax
shl eax, 2
and ebx, 0x30
shr cl, 4
and eax, 0x3c
shr dil, 2
add ecx, ebx
add edx, eax
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov eax, 4
cmp r9, 3
ja 0x140193248
jmp 0x140193320
movzx ecx, byte [r10]
add r10, 3
add rax, 4
sub r11, 3
movzx edx, byte [r10 - 2]
movzx esi, byte [r10 - 1]
mov edi, ecx
shl ecx, 4
mov ebp, edx
and ecx, 0x30
shl edx, 2
shr bpl, 4
and edx, 0x3c
shr dil, 2
add ecx, ebp
mov ebp, esi
and esi, 0x3f
shr bpl, 6
add edx, ebp
cmp r9, rax
jb 0x140193320
and ecx, 0x7f
and edx, 0x7f
and edi, 0x3f
movzx ecx, byte [rbx + rcx]
movzx edi, byte [rbx + rdi]
mov byte [r8 + rax - 3], cl
movzx ecx, byte [rbx + rdx]
mov rdx, rsi
and edx, 0x3f
mov byte [r8 + rax - 4], dil
movzx edx, byte [rbx + rdx]
mov byte [r8 + rax - 2], cl
mov byte [r8 + rax - 1], dl
cmp r11, 2
ja 0x140193200
test r11, r11
jne 0x1401932a0
cmp rax, r9
jae 0x140193320
mov byte [r8 + rax], 0
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx edx, byte [r10]
cmp r11, 2
jne 0x14019332a
movzx ecx, byte [r10 + 1]
mov ebx, ecx
shl ecx, 2
shr bl, 4
and ecx, 0x3c
mov r10d, edx
shl edx, 4
lea rsi, [rax + 4]
and edx, 0x30
shr r10b, 2
add edx, ebx
cmp rsi, r9
ja 0x140193320
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
and r10d, 0x3f
and edx, 0x7f
movzx edx, byte [rbx + rdx]
movzx r10d, byte [rbx + r10]
mov byte [r8 + rax + 1], dl
lea rdx, [r8 + rax + 2]
mov byte [r8 + rax], r10b
add rax, 3
cmp r11, 1
je 0x140193330
movzx ecx, cl
movzx ecx, byte [rbx + rcx]
mov byte [rdx], cl
mov byte [r8 + rax], 0x3d
mov rax, rsi
jmp 0x14019328a
mov eax, 0xffffffff
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ecx, ecx
xor ebx, ebx
jmp 0x1401932be
mov byte [rdx], 0x3d
jmp 0x14019330e
mov r10, rcx
xor eax, eax
jmp 0x140193285

Function at 0x140196260
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rax]
movdqu xmm1, xmmword [rdx + rax]
pxor xmm0, xmm1
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, 0x400
jne 0x140196268
ret