joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140205fd0
Capabilities:
Encode data using xor

Disassembly:
endbr64
mov r9d, 0xc8
jmp sym.keccak

Function at 0x140206020
Capabilities:
Encode data using xor

Disassembly:
endbr64
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 0x150]
mov r12, rcx
mov rsi, rdx
mov rbp, r8
test edi, 0x80000000
jne 0x140206249
movabs rax, 0xf0f0f0f0f0f0f0f1
lea rcx, [rdi + r8]
mul rcx
shr rdx, 7
mov rax, rdx
shl rax, 4
add rdx, rax
shl rdx, 3
sub rcx, rdx
mov qword [r12 + 0x150], rcx
test rdi, rdi
jne 0x14020614d
cmp rbp, 0x87
jbe 0x14020613b
lea rdi, [r12 + 0xc8]
lea rbx, [r12 + 0x88]
movdqu xmm0, xmmword [rsi]
movups xmmword [rdi], xmm0
movdqu xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movdqu xmm2, xmmword [rsi + 0x20]
movups xmmword [rdi + 0x20], xmm2
movdqu xmm3, xmmword [rsi + 0x30]
movups xmmword [rdi + 0x30], xmm3
movdqu xmm4, xmmword [rsi + 0x40]
movups xmmword [rdi + 0x40], xmm4
movdqu xmm5, xmmword [rsi + 0x50]
movups xmmword [rdi + 0x50], xmm5
movdqu xmm0, xmmword [rsi + 0x60]
movups xmmword [rdi + 0x60], xmm0
movdqu xmm1, xmmword [rsi + 0x70]
movups xmmword [rdi + 0x70], xmm1
mov rax, qword [rsi + 0x80]
mov qword [rdi + 0x80], rax
mov rax, r12
nop word [rax + rax]
mov rdx, qword [rax + 0xc8]
xor qword [rax], rdx
add rax, 8
cmp rax, rbx
jne 0x140206100
mov edx, 0x18
mov rcx, r12
sub rbp, 0x88
add rsi, 0x88
call sym.keccakf
cmp rbp, 0x87
ja 0x1402060a0
test rbp, rbp
jne 0x1402061b0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r13d, 0x88
lea rcx, [r12 + rdi + 0xc8]
mov rdx, rsi
sub r13, rdi
lea rbx, [r12 + 0x88]
cmp r8, r13
mov r8, r13
cmovbe r8, rbp
call sym.memcpy
mov rax, r12
cmp rbp, r13
jb 0x140206140
mov rdx, qword [rax + 0xc8]
xor qword [rax], rdx
add rax, 8
cmp rax, rbx
jne 0x140206180
mov edx, 0x18
mov rcx, r12
add rsi, r13
call sym.keccakf
lea rbp, [rdi + rbp - 0x88]
jmp 0x140206083
lea rdx, [r12 + 0xc8]
mov eax, ebp
cmp ebp, 8
jae 0x1402061f0
and ebp, 4
jne 0x140206232
test eax, eax
je 0x140206140
movzx ecx, byte [rsi]
mov byte [r12 + 0xc8], cl
test al, 2
je 0x140206140
movzx ecx, word [rsi + rax - 2]
mov word [rdx + rax - 2], cx
jmp 0x140206140
mov rax, qword [rsi]
lea rdi, [r12 + 0xd0]
and rdi, 0xfffffffffffffff8
mov qword [r12 + 0xc8], rax
mov eax, ebp
mov rcx, qword [rsi + rax - 8]
mov qword [rdx + rax - 8], rcx
sub rdx, rdi
lea eax, [rbp + rdx]
sub rsi, rdx
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, dword [rsi]
mov dword [r12 + 0xc8], ecx
mov ecx, dword [rsi + rax - 4]
mov dword [rdx + rax - 4], ecx
jmp 0x140206140
call sym.local_abort.constprop.0
nop
nop
Function at 0x140206250
Capabilities:
Encode data using xor

Disassembly:
endbr64
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rcx + 0x150]
mov rbx, rcx
mov rax, rdx
and eax, 0x80000000
je 0x1402062a0
test rsi, rsi
je 0x14020628e
movdqu xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r9, [rcx + 0xc8]
mov ecx, 0x88
sub rcx, rdx
lea r8, [r9 + rdx]
cmp rcx, 8
jae 0x140206330
test cl, 4
jne 0x14020635a
test rcx, rcx
je 0x1402062db
mov byte [r8], 0
test cl, 2
jne 0x140206376
mov rdx, qword [rbx + 0x150]
or byte [r9 + rdx], 1
mov rax, rbx
lea rcx, [rbx + 0x88]
or byte [rbx + 0x14f], 0x80
nop dword [rax]
mov rdx, qword [rax + 0xc8]
xor qword [rax], rdx
add rax, 8
cmp rax, rcx
jne 0x1402062f8
mov edx, 0x18
mov rcx, rbx
call sym.keccakf
mov eax, 0x80000000
mov qword [rbx + 0x150], rax
jmp 0x140206272
lea rdi, [r8 + 8]
mov qword [r8], 0
mov qword [r8 + rcx - 8], 0
and rdi, 0xfffffffffffffff8
sub r8, rdi
add rcx, r8
shr rcx, 3
rep stosq qword [rdi], rax
jmp 0x1402062d4
mov dword [r8], 0
mov dword [r8 + rcx - 4], 0
mov rdx, qword [rbx + 0x150]
jmp 0x1402062db
xor eax, eax
mov word [r8 + rcx - 2], ax
mov rdx, qword [rbx + 0x150]
jmp 0x1402062db

Function at 0x140206470
Capabilities:
Encode data using xor

Disassembly:
endbr64
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, rdx
test rdx, rdx
je 0x1402064cb
lea rbx, [0x140585ae0]
nop dword [rax]
mov rcx, rbx
call sym.hash_permutation
mov r8d, 0x88
cmp rdi, r8
cmovbe r8, rdi
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [rbx + rax]
xor cl, byte [rsi + rax]
mov byte [rbx + rax], cl
add rax, 1
cmp r8, rax
jne 0x1402064b0
add rsi, r8
sub rdi, r8
jne 0x140206490
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140206e60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [rcx]
movdqu xmm2, xmmword [rcx + 0x10]
movdqa xmm5, xmm0
aeskeygenassist xmm4, xmm2, 1
pslldq xmm5, 4
pshufd xmm4, xmm4, 0xff
movdqa xmm1, xmm5
movups xmmword [rdx], xmm0
pslldq xmm1, 4
movups xmmword [rdx + 0x10], xmm2
movdqa xmm3, xmm1
pxor xmm1, xmm5
movdqa xmm5, xmm2
pslldq xmm3, 4
pslldq xmm5, 4
pxor xmm3, xmm4
pxor xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm5
pslldq xmm0, 4
aeskeygenassist xmm4, xmm1, 0
movups xmmword [rdx + 0x20], xmm1
movdqa xmm3, xmm0
pshufd xmm4, xmm4, 0xaa
pxor xmm0, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm1
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm5
pslldq xmm2, 4
aeskeygenassist xmm4, xmm0, 2
movups xmmword [rdx + 0x30], xmm0
movdqa xmm3, xmm2
pshufd xmm4, xmm4, 0xff
pxor xmm2, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm0
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm2, xmm3
pxor xmm2, xmm1
movdqa xmm1, xmm5
pslldq xmm1, 4
aeskeygenassist xmm4, xmm2, 0
movups xmmword [rdx + 0x40], xmm2
movdqa xmm3, xmm1
pshufd xmm4, xmm4, 0xaa
pxor xmm1, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm2
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm5
pslldq xmm0, 4
aeskeygenassist xmm4, xmm1, 4
movups xmmword [rdx + 0x50], xmm1
movdqa xmm3, xmm0
pshufd xmm4, xmm4, 0xff
pxor xmm0, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm1
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm5
pslldq xmm2, 4
aeskeygenassist xmm4, xmm0, 0
movups xmmword [rdx + 0x60], xmm0
movdqa xmm3, xmm2
pshufd xmm4, xmm4, 0xaa
pxor xmm2, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm0
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm2, xmm3
pxor xmm2, xmm1
movdqa xmm1, xmm5
pslldq xmm1, 4
aeskeygenassist xmm4, xmm2, 8
movups xmmword [rdx + 0x70], xmm2
movdqa xmm3, xmm1
pshufd xmm4, xmm4, 0xff
pxor xmm1, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm2
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm5
pslldq xmm0, 4
aeskeygenassist xmm4, xmm1, 0
movups xmmword [rdx + 0x80], xmm1
movdqa xmm3, xmm0
pshufd xmm4, xmm4, 0xaa
pxor xmm0, xmm5
pslldq xmm3, 4
pxor xmm3, xmm4
movdqa xmm4, xmm1
pslldq xmm4, 4
pxor xmm0, xmm3
movdqa xmm3, xmm4
pxor xmm0, xmm2
pslldq xmm3, 4
movups xmmword [rdx + 0x90], xmm0
aeskeygenassist xmm0, xmm0, 0x10
movdqa xmm2, xmm3
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm4
pslldq xmm2, 4
pxor xmm0, xmm2
pxor xmm0, xmm3
pxor xmm0, xmm1
movups xmmword [rdx + 0xa0], xmm0
ret
Function at 0x1402071c0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call sym.SetLockPagesPrivilege
lea rcx, [0x140377a60]
call sym.__emutls_get_address
mov r9d, 4
mov r8d, 0x20003000
mov edx, 0x200000
mov rcx, qword [rax]
mov rbx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rdi
lea rcx, [0x140377a80]
mov qword [rbx], rax
mov rsi, rax
call sym.__emutls_get_address
mov dword [rax], 1
test rsi, rsi
je 0x140207290
lea rcx, [0x140377ac0]
call sym.__emutls_get_address
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1fff
mov rcx, qword [rax]
mov rsi, rax
call rdi
lea rcx, [0x140377ae0]
mov qword [rsi], rax
mov rbx, rax
call sym.__emutls_get_address
mov dword [rax], 1
test rbx, rbx
je 0x1402072b0
mov rbx, qword [rsi]
lea rcx, [0x140377aa0]
add rbx, 0xfff
call sym.__emutls_get_address
and rbx, 0xfffffffffffff000
mov qword [rax], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov ecx, 0x200000
call sym.malloc
mov qword [rbx], rax
jmp 0x140207223
mov dword [rax], 0
mov ecx, 0x1fff
call sym.malloc
mov qword [rsi], rax
mov rbx, rax
jmp 0x140207268

Function at 0x1402072d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
endbr64
sub rsp, 0x28
lea rcx, [0x140377a60]
call sym.__emutls_get_address
cmp qword [rax], 0
je 0x1402072f0
add rsp, 0x28
ret
add rsp, 0x28
jmp sym.cn_slow_hash_allocate_state.part.0
Function at 0x14020d290
Capabilities:
Query environment variable

Disassembly:
endbr64
sub rsp, 0x28
mov rdx, qword [rcx]
mov r9d, dword [rcx + 0xc]
mov r8d, dword [rcx + 8]
mov rcx, qword [0x140585c48]
call sym.randomx_init_dataset
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__endthreadex]
nop
nop dword [rax + rax]

Function at 0x14020d2c0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.SEEDHASH_EPOCH_LAG
call sym.getenv
test rax, rax
je 0x14020d2e8
mov rcx, rax
call sym.atoi
mov dword [0x140377bac], eax
cmp eax, 0x40
jbe 0x14020d300
mov dword [0x140377bac], 0x40
mov eax, 0x40
add rsp, 0x28
ret
movsxd rdx, eax
test rdx, rdx
je 0x14020d2e8
lea rcx, [rdx - 1]
test rcx, rdx
je 0x14020d2f7
jmp 0x14020d2e8
Function at 0x14020d3c0
Capabilities:
Create thread
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, 3
cmp rcx, rax
cmovae rax, rcx
lea rbx, [rax - 2]
mov qword [rsp + 0x30], rax
mov rdi, rbx
shl rdi, 4
mov rcx, rdi
call sym.malloc
mov r13, rax
test rax, rax
je 0x14020d605
call sym.randomx_dataset_item_count
xor edx, edx
mov rcx, qword [rsp + 0x30]
mov eax, eax
div rbx
mov rsi, rcx
mov r8d, eax
sub rsi, 3
je 0x14020d589
shl rcx, 4
mov r9, qword [0x140585c40]
mov rdx, r13
lea r10, [r13 + rcx - 0x30]
xor ecx, ecx
nop word cs:[rax + rax]
mov dword [rdx + 8], ecx
add rdx, 0x10
add ecx, r8d
mov qword [rdx - 0x10], r9
mov dword [rdx - 4], r8d
cmp rdx, r10
jne 0x14020d440
mov ecx, dword [rsp + 0x30]
lea r14, [r13 + rdi - 0x10]
mov qword [r14], r9
lea ebp, [rcx - 3]
imul ebp, eax
mov dword [r14 + 8], ebp
call sym.randomx_dataset_item_count
lea rcx, [rbx*8]
sub eax, ebp
mov dword [r14 + 0xc], eax
call sym.malloc
mov rbx, rax
test rax, rax
je 0x14020d5b7
lea rax, [0x140585c50]
mov r12, r13
xor r15d, r15d
mov rcx, rax
mov qword [rsp + 0x38], rax
lea rdi, [sym.rx_seedthread]
call sym.AcquireSRWLockShared
mov rbp, qword [sym.imp.msvcrt.dll__beginthreadex]
nop dword [rax]
mov qword [rsp + 0x28], 0
mov r9, r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r8, rdi
call rbp
mov qword [rbx + r15*8], rax
test rax, rax
je 0x14020d5f9
add r15, 1
add r12, 0x10
cmp rsi, r15
jne 0x14020d4c0
mov rdx, qword [r14]
mov r9d, dword [r14 + 0xc]
mov rsi, rbx
mov r8d, dword [r14 + 8]
mov rcx, qword [0x140585c48]
call sym.randomx_init_dataset
mov rax, qword [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r14, [rbx + rax*8 - 0x18]
nop dword [rax]
mov rdi, qword [rsi]
add rsi, 8
mov edx, 0xffffffff
mov rcx, rdi
call r12
mov rcx, rdi
call rbp
cmp r14, rsi
jne 0x14020d530
mov rcx, qword [rsp + 0x38]
call sym.ReleaseSRWLockShared
mov rcx, rbx
call sym.free
mov rcx, r13
call sym.free
lea rdx, str.RandomX_dataset_initialized
lea rcx, str.randomx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.minfo
mov rax, qword [0x140585c40]
mov dword [r13 + 8], 0
mov qword [r13], rax
call sym.randomx_dataset_item_count
mov ecx, 8
mov dword [r13 + 0xc], eax
call sym.malloc
mov rbx, rax
test rax, rax
jne 0x14020d5c8
lea rcx, str.Couldnt_allocate_RandomX_mining_threadlist
call sym.local_abort_1
nop dword [rax + rax]
lea rax, [0x140585c50]
mov rcx, rax
mov qword [rsp + 0x38], rax
call sym.AcquireSRWLockShared
mov rdx, qword [r13]
mov r9d, dword [r13 + 0xc]
mov r8d, dword [r13 + 8]
mov rcx, qword [0x140585c48]
call sym.randomx_init_dataset
jmp 0x14020d54c
lea rcx, str.Couldnt_start_RandomX_seed_thread
call sym.local_abort_1
lea rcx, str.Couldnt_allocate_RandomX_mining_threadinfo
call sym.local_abort_1
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14020d620
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, qword [0x140485900]
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
xor eax, eax
mov ebx, ecx
mov rcx, qword [rdx]
mov rsi, rdx
mov rdi, r8
test rcx, rcx
jne 0x14020d700
test bl, 8
je 0x14020d66c
lea rcx, [0x140377b80]
call sym.__emutls_get_address
mov edx, dword [rax]
test edx, edx
jne 0x14020d66c
or ebx, 0x10
and ebx, 0xfffffffb
mov eax, dword [0x140377ba0]
mov r12d, ebx
or r12d, 1
cmp eax, 0xffffffff
je 0x14020d6c0
not eax
and r12d, eax
xor r8d, r8d
mov rdx, rdi
mov ecx, r12d
call sym.randomx_create_vm
mov qword [rsi], rax
test rax, rax
je 0x14020d740
mov rax, qword [rsp + 0x28]
sub rax, qword [rbp]
jne 0x14020d814
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.MONERO_RANDOMX_UMASK
call sym.getenv
mov r13, rax
test rax, rax
je 0x14020d728
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp r13, qword [rsp + 0x20]
je 0x14020d6f6
cmp eax, 0x7ffffffe
jbe 0x14020d7e8
xor eax, eax
mov dword [0x140377ba0], eax
jmp 0x14020d686
mov rax, qword [rsp + 0x28]
sub rax, qword [rbp]
jne 0x14020d814
mov rdx, r8
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.randomx_vm_set_cache
mov dword [0x140377ba0], 0
jmp 0x14020d686
mov eax, dword [0x140585bc0]
test eax, eax
je 0x14020d780
mov eax, dword [0x140377ba0]
cmp eax, 0xffffffff
je 0x14020d7a0
not eax
and ebx, eax
xor r8d, r8d
mov rdx, rdi
mov ecx, ebx
call sym.randomx_create_vm
mov qword [rsi], rax
test rax, rax
jne 0x14020d6a0
lea rcx, str.Couldnt_allocate_RandomX_light_VM
call sym.local_abort_1
nop
lea rdx, str.Couldnt_allocate_RandomX_light_VM_using_large_pages__will_print_only_once_
lea rcx, str.randomx
mov dword [0x140585bc0], 1
call sym.mdebug
jmp 0x14020d74a
lea rcx, str.MONERO_RANDOMX_UMASK
call sym.getenv
mov r12, rax
test rax, rax
je 0x14020d7f8
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp r12, qword [rsp + 0x20]
je 0x14020d810
cmp eax, 0x7ffffffe
ja 0x14020d810
mov edx, eax
not edx
and ebx, edx
mov dword [0x140377ba0], eax
jmp 0x14020d759
mov edx, eax
not edx
and r12d, edx
jmp 0x14020d6f8
mov dword [0x140377ba0], 0
jmp 0x14020d759
xor eax, eax
jmp 0x14020d7d8
call dbg.__stack_chk_fail
nop
nop word [rax + rax]
Function at 0x14020d820
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [0x140485900]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp qword [rdx], 0
mov edi, ecx
mov rbx, rdx
je 0x14020d860
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14020d97b
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, dword [0x140377ba0]
mov ebp, ecx
or ebp, 1
cmp eax, 0xffffffff
je 0x14020d8c0
not eax
and ebp, eax
mov ecx, ebp
call sym.randomx_alloc_cache
mov qword [rbx], rax
test rax, rax
jne 0x14020d846
lea rdx, str.Couldnt_allocate_RandomX_cache_using_large_pages
lea rcx, str.randomx
call sym.mdebug
mov eax, dword [0x140377ba0]
cmp eax, 0xffffffff
je 0x14020d920
not eax
and edi, eax
mov ecx, edi
call sym.randomx_alloc_cache
mov qword [rbx], rax
test rax, rax
jne 0x14020d846
lea rcx, str.Couldnt_allocate_RandomX_cache
call sym.local_abort_1
lea rcx, str.MONERO_RANDOMX_UMASK
call sym.getenv
mov r12, rax
test rax, rax
je 0x14020d900
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp r12, qword [rsp + 0x20]
je 0x14020d8f2
cmp eax, 0x7ffffffe
jbe 0x14020d910
xor eax, eax
mov dword [0x140377ba0], eax
jmp 0x14020d874
mov dword [0x140377ba0], 0
jmp 0x14020d874
mov edx, eax
not edx
and ebp, edx
jmp 0x14020d8f4
lea rcx, str.MONERO_RANDOMX_UMASK
call sym.getenv
mov rbp, rax
test rax, rax
je 0x14020d968
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp rbp, qword [rsp + 0x20]
je 0x14020d977
cmp eax, 0x7ffffffe
ja 0x14020d977
mov edx, eax
not edx
and edi, edx
mov dword [0x140377ba0], eax
jmp 0x14020d8a5
mov dword [0x140377ba0], 0
jmp 0x14020d8a5
xor eax, eax
jmp 0x14020d958
call dbg.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14020d990
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x140485900]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp qword [0x140585c48], 0
mov edi, ecx
mov ebx, edx
je 0x14020d9d0
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14020dc4e
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [0x140377ba0]
cmp eax, 0xffffffff
je 0x14020dad0
and eax, 4
test eax, eax
jne 0x14020da88
test ebx, ebx
je 0x14020db30
mov eax, dword [0x140377ba0]
mov ebx, edi
or ebx, 1
cmp eax, 0xffffffff
je 0x14020db80
not eax
and ebx, eax
mov ecx, ebx
call sym.randomx_alloc_dataset
mov qword [0x140585c48], rax
test rax, rax
jne 0x14020d9b7
lea rbx, str.randomx
lea rdx, str.Couldnt_allocate_RandomX_dataset_using_large_pages
mov rcx, rbx
call sym.mdebug
mov eax, dword [0x140377ba0]
cmp eax, 0xffffffff
je 0x14020dbf8
not eax
and edi, eax
mov ecx, edi
call sym.randomx_alloc_dataset
mov qword [0x140585c48], rax
test rax, rax
jne 0x14020d9b7
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14020dc4e
lea rdx, str.Couldnt_allocate_RandomX_dataset
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.merror
mov edx, dword [0x140585bcc]
test edx, edx
jne 0x14020d9b7
mov dword [0x140585bcc], 1
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14020dc4e
lea rdx, str.RandomX_dataset_is_disabled_by_MONERO_RANDOMX_UMASK_environment_variable.
lea rcx, str.randomx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.minfo
lea rcx, str.MONERO_RANDOMX_UMASK
call sym.getenv
mov rbp, rax
test rax, rax
je 0x14020db08
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rax
call sym.strtol
mov edx, eax
cmp rbp, qword [rsp + 0x20]
je 0x14020db08
cmp eax, 0x7ffffffe
jbe 0x14020dbe0
mov dword [0x140377ba0], 0
test ebx, ebx
je 0x14020db30
mov ebx, edi
mov eax, dword [0x140377ba0]
or ebx, 1
jmp 0x14020da06
lea rcx, str.MONERO_RANDOMX_FULL_MEM
call sym.getenv
test rax, rax
jne 0x14020d9f2
mov eax, dword [0x140585bc8]
test eax, eax
jne 0x14020d9b7
mov dword [0x140585bc8], 1
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14020dc4e
lea rdx, str.RandomX_dataset_is_not_enabled_by_default._Use_MONERO_RANDOMX_FULL_MEM_environment_variable_to_enable_it.
jmp 0x14020dab5
lea rcx, str.MONERO_RANDOMX_UMASK
call sym.getenv
mov rbp, rax
test rax, rax
je 0x14020dbc8
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp rbp, qword [rsp + 0x20]
je 0x14020dbf0
cmp eax, 0x7ffffffe
ja 0x14020dbf0
mov edx, eax
not edx
and ebx, edx
mov dword [0x140377ba0], eax
jmp 0x14020da0a
mov dword [0x140377ba0], 0
jmp 0x14020da0a
mov dword [0x140377ba0], edx
and eax, 4
jmp 0x14020d9e2
xor eax, eax
jmp 0x14020dbb8
lea rcx, str.MONERO_RANDOMX_UMASK
call sym.getenv
mov rbp, rax
test rax, rax
je 0x14020dc3b
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp rbp, qword [rsp + 0x20]
je 0x14020dc4a
cmp eax, 0x7ffffffe
ja 0x14020dc4a
mov edx, eax
not edx
and edi, edx
mov dword [0x140377ba0], eax
jmp 0x14020da46
mov dword [0x140377ba0], 0
jmp 0x14020da46
xor eax, eax
jmp 0x14020dc30
call dbg.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x14020de20
Capabilities:
Query environment variable

Disassembly:
endbr64
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x140377bac]
mov rsi, rcx
cmp eax, 0xffffffff
je 0x14020de68
mov edx, dword [0x140377ba8]
movsxd rbx, eax
cmp edx, 0xffffffff
je 0x14020de7b
lea rcx, [rbx + rdx]
xor eax, eax
cmp rcx, rsi
jae 0x14020de5e
lea rax, [rsi - 1]
neg rdx
sub rax, rbx
and rax, rdx
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.get_seedhash_epoch_lag.part.0
mov edx, dword [0x140377ba8]
movsxd rbx, eax
cmp edx, 0xffffffff
jne 0x14020de46
lea rcx, str.SEEDHASH_EPOCH_BLOCKS
call sym.getenv
test rax, rax
je 0x14020deb8
mov rcx, rax
call sym.atoi
lea edx, [rax - 2]
mov dword [0x140377ba8], eax
cmp edx, 0x7fe
ja 0x14020deb8
movsxd rdx, eax
lea rax, [rdx - 1]
test rax, rdx
je 0x14020de46
nop dword [rax]
mov dword [0x140377ba8], 0x800
mov edx, 0x800
jmp 0x14020de46

Function at 0x14020df20
Capabilities:
Create thread

Disassembly:
endbr64
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [0x140585c10]
mov rbx, rcx
mov rsi, rdx
test eax, eax
je 0x14020df54
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
xor rax, qword [0x140585c20]
xor rdx, qword [0x140585c28]
or rax, rdx
je 0x14020dfb8
mov ecx, 0x28
call sym.malloc
mov r9, rax
test rax, rax
je 0x14020dfe6
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbx + 0x10]
mov qword [rax + 0x20], rsi
xor ecx, ecx
lea r8, [sym.rx_set_main_seedhash_thread]
xor edx, edx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rcx, rax
test rax, rax
je 0x14020dfda
add rsp, 0x38
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x18]
xor rax, qword [0x140585c30]
xor rdx, qword [0x140585c38]
or rax, rdx
jne 0x14020df54
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.Couldnt_start_RandomX_seed_thread
call sym.local_abort_1
lea rcx, str.Couldnt_allocate_RandomX_mining_threadinfo
call sym.local_abort_1
nop
nop word cs:[rax + rax]
nop
Function at 0x14020e770
Capabilities:
Query environment variable

Disassembly:
endbr64
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, qword [0x140485900]
lea rbp, [0x140585c58]
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov ebx, ecx
lea rcx, [0x140377b80]
mov rsi, rdx
call sym.__emutls_get_address
mov rcx, rbp
mov dword [rax], ebx
call sym.AcquireSRWLockExclusive
cmp qword [0x140585c48], 0
jne 0x14020e7f3
mov ebx, dword [0x140377ba4]
cmp ebx, 0xffffffff
je 0x14020e818
mov eax, dword [0x140377ba0]
cmp eax, 0xffffffff
je 0x14020e830
not eax
and ebx, eax
mov edx, 1
mov ecx, ebx
call sym.rx_alloc_dataset.constprop.0
cmp qword [0x140585c48], 0
je 0x14020e7f3
mov rcx, rsi
call sym.rx_init_dataset.part.0
mov rax, qword [rsp + 0x28]
sub rax, qword [rdi]
jne 0x14020e888
mov rcx, rbp
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.ReleaseSRWLockExclusive
call sym.randomx_get_flags
mov dword [0x140377ba4], eax
mov ebx, eax
mov eax, dword [0x140377ba0]
cmp eax, 0xffffffff
jne 0x14020e7d1
lea rcx, str.MONERO_RANDOMX_UMASK
call sym.getenv
mov r12, rax
test rax, rax
je 0x14020e870
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp r12, qword [rsp + 0x20]
je 0x14020e862
cmp eax, 0x7ffffffe
jbe 0x14020e880
xor eax, eax
mov dword [0x140377ba0], eax
jmp 0x14020e7d5
mov dword [0x140377ba0], 0
jmp 0x14020e7d5
mov edx, eax
not edx
and ebx, edx
jmp 0x14020e864
call dbg.__stack_chk_fail
nop
nop
Function at 0x140210120
Capabilities:
Hash data using sha256

Disassembly:
endbr64
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash