joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ba9e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x198
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, 0x88
movsxd r12, r9d
mov r13, r8
mov esi, edx
mov r15, rcx
mov ebp, 0x64
sub ebp, r12d
lea rcx, [rsp + 0x20]
lea r8d, [rax + 0x40]
add ebp, ebp
cmp r12d, r8d
cmove ebp, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, ebp
xor edi, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r14, eax
cmp esi, ebp
jl 0x1400baa7e
movsxd rbx, ebp
mov rcx, rdi
test r14, r14
jle 0x1400baa66
mov rax, qword [r15 + rcx*8]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, r14
jl 0x1400baa55
mov edx, 0x18
lea rcx, [rsp + 0x20]
call fcn.1400bab24
sub esi, ebp
add r15, rbx
cmp esi, ebp
jge 0x1400baa4d
movsxd rbx, esi
lea rcx, [rsp + 0xf0]
mov r8, rbx
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebp
mov byte [rsp + rbx + 0xf0], 1
inc esi
lea rcx, [rsp + 0xf0]
sub eax, esi
xor edx, edx
movsxd r8, eax
movsxd rax, esi
add rcx, rax
call sub.VCRUNTIME140.dll_memset
movsxd rax, ebp
or byte [rsp + rax + 0xef], 0x80
test r14, r14
jle 0x1400baadf
mov rax, qword [rsp + rdi*8 + 0xf0]
xor qword [rsp + rdi*8 + 0x20], rax
inc rdi
cmp rdi, r14
jl 0x1400baaca
mov edx, 0x18
lea rcx, [rsp + 0x20]
call fcn.1400bab24
mov r8, r12
lea rdx, [rsp + 0x20]
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400f3170
add rsp, 0x198
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400bda44
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x68
movdqa xmm4, xmmword [0x140131840]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x140131850]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x140131860]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x140131870]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x140131880]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x140131890]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x1401318a0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1401318b0]
cmp r8, r9
jae 0x1400bdb4b
add r8, 0x20
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [r8 - 0x20], xmm0
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [r8 - 0x10], xmm1
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [r8], xmm2
lea r8, [r8 + 0x40]
aesenc xmm3, xmm11
movdqu xmmword [r8 - 0x30], xmm3
lea rax, [r8 - 0x20]
cmp rax, r9
jb 0x1400bdacf
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret
mov eax, dword [0x1401317b4]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x1400bda44
Function at 0x1400bea28
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x140109430]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x140109410]
movdqa xmm4, xmmword [0x140109440]
movdqa xmm5, xmmword [0x140109400]
cmp rcx, r9
jae 0x1400bea79
add rcx, 0x20
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x1400bea55
movdqa xmm0, xmmword [0x1401093c0]
movdqa xmm1, xmmword [0x140109450]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [r8], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [r8 + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret
Function at 0x1400c0b34
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x60
movdqa xmm4, xmmword [0x140109430]
lea r10, [rcx + 0x1c00]
movdqa xmm5, xmmword [0x140109410]
mov r11, r8
movaps xmmword [rax - 0x18], xmm6
lea r8, [rdx - 0x1c00]
movdqa xmm6, xmmword [0x140109440]
add r8, rcx
movaps xmmword [rax - 0x28], xmm7
mov edx, 2
movdqa xmm7, xmmword [0x140109400]
movaps xmmword [rax - 0x38], xmm8
movdqu xmm8, xmmword [r9]
movaps xmmword [rax - 0x48], xmm9
movdqu xmm9, xmmword [r9 + 0x10]
movaps xmmword [rax - 0x58], xmm10
mov rax, rcx
movdqu xmm10, xmmword [r9 + 0x20]
movaps xmmword [rsp], xmm11
movdqu xmm11, xmmword [r9 + 0x30]
cmp rax, r8
jae 0x1400c0c96
lea rbx, [rax + 0x20]
sub r10, rax
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rbx - 0x10]
movdqu xmm2, xmmword [rbx]
movdqu xmm3, xmmword [rbx + 0x10]
aesdec xmm8, xmmword [0x140109420]
aesenc xmm9, xmmword [0x1401093d0]
aesdec xmm10, xmmword [0x1401093e0]
aesenc xmm11, xmmword [0x1401093f0]
movdqu xmmword [rax], xmm8
movdqu xmmword [rbx - 0x10], xmm9
movdqu xmmword [rbx], xmm10
movdqu xmmword [rbx + 0x10], xmm11
prefetcht0 byte [r10 + rax]
aesdec xmm8, xmmword [0x140109420]
aesenc xmm9, xmmword [0x1401093d0]
aesdec xmm10, xmmword [0x1401093e0]
aesenc xmm11, xmmword [0x1401093f0]
aesenc xmm4, xmm0
aesenc xmm4, xmmword [rbx + 0x20]
aesdec xmm5, xmm1
aesdec xmm5, xmmword [rbx + 0x30]
aesenc xmm6, xmm2
aesenc xmm6, xmmword [rbx + 0x40]
aesdec xmm7, xmm3
aesdec xmm7, xmmword [rbx + 0x50]
movdqu xmmword [rbx + 0x20], xmm8
movdqu xmmword [rbx + 0x30], xmm9
movdqu xmmword [rbx + 0x40], xmm10
movdqu xmmword [rbx + 0x50], xmm11
prefetcht0 byte [r10 + rax + 0x40]
sub rax, 0xffffffffffffff80
lea rbx, [rbx + 0x80]
cmp rax, r8
jb 0x1400c0bbb
add r8, 0x1c00
mov r10, rcx
sub rdx, 1
jne 0x1400c0bab
movdqa xmm0, xmmword [0x1401093c0]
movdqa xmm1, xmmword [0x140109450]
movdqu xmmword [r9], xmm8
movaps xmm8, xmmword [rsp + 0x30]
movdqu xmmword [r9 + 0x10], xmm9
movaps xmm9, xmmword [rsp + 0x20]
movdqu xmmword [r9 + 0x20], xmm10
movaps xmm10, xmmword [rsp + 0x10]
movdqu xmmword [r9 + 0x30], xmm11
movaps xmm11, xmmword [rsp]
aesenc xmm6, xmm0
aesdec xmm7, xmm0
aesenc xmm6, xmm1
aesdec xmm7, xmm1
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm4, xmm1
movdqu xmmword [r11], xmm4
aesdec xmm5, xmm1
movdqu xmmword [r11 + 0x10], xmm5
movdqu xmmword [r11 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r11 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
ret

Function at 0x1400c1424
Capabilities:
Encode data using xor

Disassembly:
sub rdx, rcx
mov r8d, 0x80
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1400c142d
ret

Function at 0x1400c1e8c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
inc qword [rdx + 0x30]
mov rdi, r8
mov r8, rcx
mov rbx, rcx
mov rcx, rdi
xor r9d, r9d
call fcn.1400c1440
xor r9d, r9d
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400c1440
Function at 0x1400c223c
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400c22c2
test rcx, rcx
je 0x1400c22c2
xor edx, edx
mov r8d, 0xf0
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x40
lea rdx, [0x140109490]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rsi, rbx
mov rbp, rdi
mov r14d, 8
mov r8d, 8
lea rcx, [rsp + 0x48]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x48]
add rbp, 8
xor qword [rsi], rax
lea rsi, [rsi + 8]
sub r14, 1
jne 0x1400c228c
movzx eax, byte [rdi]
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1400c22c5
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c6c90
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x68
movdqa xmm4, xmmword [0x140131840]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x140131850]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x140131860]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x140131870]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x140131880]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x140131890]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x1401318a0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1401318b0]
cmp r8, r9
jae 0x1400bdb4b
add r8, 0x20
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [r8 - 0x20], xmm0
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [r8 - 0x10], xmm1
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [r8], xmm2
lea r8, [r8 + 0x40]
aesenc xmm3, xmm11
movdqu xmmword [r8 - 0x30], xmm3
lea rax, [r8 - 0x20]
cmp rax, r9
jb 0x1400bdacf
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret
mov eax, dword [0x1401317b4]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x1400bda44
Function at 0x1400c7484
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [rcx + 0x11f8]
mov rbx, r8
shr rdx, 6
mov r8d, edx
lea rdx, [rsp + 0x20]
call fcn.1400c3d8c
lea rdx, [rsp + 0x20]
mov ecx, 8
sub rdx, rbx
mov rax, qword [rdx + rbx]
xor qword [rbx], rax
lea rbx, [rbx + 8]
sub rcx, 1
jne 0x1400c74c1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f3170
add rsp, 0x70
pop rbx
ret

Function at 0x1400c7588
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rcx + 0x11e8]
mov ecx, 8
add r9, rdx
sub r9, r8
mov rax, qword [r9 + r8]
xor qword [r8], rax
lea r8, [r8 + 8]
sub rcx, 1
jne 0x1400c759a
ret

Function at 0x1400c794c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400c6c90
mov rcx, rbx
call fcn.1400c6e7c
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400c75ac
Function at 0x1400d0e64
Capabilities:
Delete service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [0x140135638]
test rcx, rcx
jne 0x1400d0e8a
lea eax, [rcx + 1]
jmp 0x1400d0ef6
cmp byte [0x140135628], 0
mov ebx, 1
jne 0x1400d0ee6
lea r8, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_ControlService]
neg eax
sbb cl, cl
and bl, cl
mov rcx, qword [0x140135638]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400d0edf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [str.e_43_1me_1_37m_msr_e_0m]
lea rdx, str.e_0m_se_0_31mfailed_to_remove_WinRing0_driver__error__u
mov r9d, eax
mov ecx, 3
call fcn.14001bfac
xor bl, bl
mov rcx, qword [0x140135638]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and qword [0x140135638], 0
mov al, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f3170
add rsp, 0x50
pop rbx
ret
Function at 0x1400d40b8
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x140135658], 0
jne 0x1400d40f0
lea rcx, str.HWLOC_HIDE_ERRORS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400d40e6
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x140135654], eax
mov dword [0x140135658], 1
mov eax, dword [0x140135654]
add rsp, 0x28
ret
Function at 0x1400d4c00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov rdi, rcx
cmp dword [rcx + 0xc8], esi
je 0x1400d4c44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], select
or eax, 0xffffffff
jmp 0x1400d4e41
call fcn.1400df830
lea rcx, str.HWLOC_XML_USERDATA_NOT_DECODED
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebp, 1
test rax, rax
je 0x1400d4c66
mov dword [rdi + 0x2b0], ebp
lea rcx, str.HWLOC_COMPONENTS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400d4d68
cmp qword [rdi + 0x2f0], rsi
jne 0x1400d4d68
lea rcx, str.HWLOC_FSROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400d4cb9
mov qword [rsp + 0x28], rsi
lea r8, str.linux
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov edx, ebp
mov rcx, rdi
call fcn.1400ddb70
cmp qword [rdi + 0x2f0], rsi
jne 0x1400d4d68
lea rcx, str.HWLOC_CPUID_PATH
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400d4cf6
mov qword [rsp + 0x28], rsi
lea r8, [0x14010d04c]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov edx, ebp
mov rcx, rdi
call fcn.1400ddb70
cmp qword [rdi + 0x2f0], rsi
jne 0x1400d4d68
lea rcx, str.HWLOC_SYNTHETIC
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400d4d2f
mov qword [rsp + 0x28], rsi
lea r8, str.synthetic
mov r9, rax
mov qword [rsp + 0x20], rsi
mov edx, ebp
mov rcx, rdi
call fcn.1400ddb70
cmp qword [rdi + 0x2f0], rsi
jne 0x1400d4d68
lea rcx, str.HWLOC_XMLFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400d4d68
mov qword [rsp + 0x28], rsi
lea r8, [0x14010cfa4]
mov r9, rax
mov qword [rsp + 0x20], rsi
mov edx, ebp
mov rcx, rdi
call fcn.1400ddb70
lea rcx, str.HWLOC_ALLOW
mov qword [rsp + 0x34], rsi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400d4d97
lea rdx, [0x14010d07c]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400d4d97
or dword [rsp + 0x38], 2
mov rcx, rdi
call fcn.1400ddfa4
mov rcx, rdi
call fcn.1400dd6a8
mov rcx, rdi
call fcn.1400dd67c
mov rcx, rdi
call fcn.1400dbb04
mov rcx, rdi
call fcn.1400de4e0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400d338c
mov rcx, rdi
mov ebx, eax
call fcn.1400de434
test ebx, ebx
jns 0x1400d4df7
mov rcx, rdi
call fcn.1400d4a30
mov rcx, rdi
call fcn.1400d4ec4
mov rcx, rdi
call fcn.1400dd5f0
jmp 0x1400d4c3c
lea rcx, str.HWLOC_DEBUG_CHECK
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rdi
call fcn.1400df818
mov rcx, rdi
call fcn.1400df95c
test byte [rdi + 0x300], 0x80
mov dword [rdi + 0xc8], ebp
je 0x1400d4e3f
lea r8, str.TWEAK
mov dword [rsp + 0x30], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400d396c
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f3170
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400da5e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x140135674], 0
jne 0x1400da618
lea rcx, str.HWLOC_XML_VERBOSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400da60e
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x140135678], eax
mov dword [0x140135674], 1
mov eax, dword [0x140135678]
add rsp, 0x28
ret

Function at 0x1400da624
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x40], rax
movss xmm7, dword [0x14010e874]
mov r13, rcx
lea rcx, str.HWLOC_XML_V1DIST_SCALE
mov r14, r9
mov rsi, r8
mov ebx, edx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400da75f
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm7, xmm7
cvtsd2ss xmm7, xmm0
imul ebx, ebx
test ebx, ebx
je 0x1400da6e5
movss xmm1, dword [0x14010e878]
mov edx, ebx
movaps xmm0, xmm7
xor ecx, ecx
mulss xmm0, dword [rsi]
comiss xmm0, xmm1
jb 0x1400da6cc
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400da6cc
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rsi, 4
add rax, rcx
mov qword [r14], rax
add r14, 8
sub rdx, 1
jne 0x1400da6a8
xorps xmm2, xmm2
lea rdx, [0x14010e4b8]
cvtss2sd xmm2, xmm7
lea rcx, [rsp + 0x28]
movq r8, xmm2
call fcn.140013300
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.1400db01c
mov rcx, rax
lea r8, [rsp + 0x28]
lea rdx, str.xmlv1DistancesScale
call fcn.1400d448c
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f3170
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edi, ebx
xor r15d, r15d
imul edi, ebx
test edi, edi
je 0x1400da723
movss xmm9, dword [0x14010e870]
mov r12, r14
mov rbp, rsi
xorps xmm8, xmm8
movss xmm6, dword [rbp]
comiss xmm8, xmm6
ja 0x1400da697
lea rdx, [rsp + 0x20]
movaps xmm0, xmm6
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_modff]
comiss xmm0, dword [0x14010e868]
jbe 0x1400da7ae
comiss xmm9, xmm0
ja 0x1400da697
addss xmm6, dword [0x14010e86c]
inc r15d
add rbp, 4
cvttss2si eax, xmm6
movsxd rcx, eax
mov qword [r12], rcx
add r12, 8
cmp r15d, edi
jb 0x1400da77e
jmp 0x1400da723
Function at 0x1400dacb0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x140135684], ebx
jne 0x1400dad02
lea rcx, str.HWLOC_LIBXML
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400dace4
lea rcx, str.HWLOC_LIBXML_EXPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400dacf8
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
sete bl
mov dword [0x140135688], ebx
mov dword [0x140135684], 1
mov eax, dword [0x140135688]
add rsp, 0x20
pop rbx
ret

Function at 0x1400dad10
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x14013567c], ebx
jne 0x1400dad62
lea rcx, str.HWLOC_LIBXML
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400dad44
lea rcx, str.HWLOC_LIBXML_IMPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400dad58
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
sete bl
mov dword [0x140135680], ebx
mov dword [0x14013567c], 1
mov eax, dword [0x140135680]
add rsp, 0x20
pop rbx
ret

Function at 0x1400dd6a8
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x2f0]
mov edx, 1
mov dword [rcx + 0xc4], edx
mov rbx, rcx
mov rcx, rax
test rax, rax
je 0x1400dd6e7
cmp dword [rcx + 0x10], 0
jne 0x1400dd6de
cmp dword [rcx + 0x28], 0xffffffff
je 0x1400dd6de
and dword [rbx + 0xc4], 0
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x1400dd6cb
test byte [rbx + 0x20], 2
je 0x1400dd70b
mov dword [rbx + 0xc4], edx
jmp 0x1400dd70b
cmp dword [rax + 0x10], edx
jne 0x1400dd707
cmp dword [rax + 0x28], 0xffffffff
je 0x1400dd707
and dword [rbx + 0xc4], 0
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1400dd6f5
lea rcx, str.HWLOC_THISSYSTEM
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400dd731
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbx + 0xc4], eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400dd7cc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov r14d, 1
jmp 0x1400dd7f3
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x1401356a0], r14d
jne 0x1400dd7ed
mov eax, dword [0x140135698]
mov ecx, eax
add eax, r14d
mov dword [0x140135698], eax
test ecx, ecx
jne 0x1400dd963
lea rcx, str.HWLOC_COMPONENTS_VERBOSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400dd834
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
and qword [0x1401356a8], 0
lea r15, [0x14012a498]
and dword [0x1401356a4], 0
xor r8d, r8d
mov rcx, qword [0x14012a498]
mov dword [0x14013569c], eax
test rcx, rcx
je 0x1400dd89d
mov edx, dword [0x1401356a4]
add r8d, r14d
inc edx
mov dword [0x1401356a4], edx
cmp qword [r15 + r8*8], 0
jne 0x1400dd85f
test edx, edx
je 0x1400dd89d
mov ecx, edx
mov edx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
and dword [0x1401356a4], 0
mov rcx, qword [0x14012a498]
mov qword [0x1401356a8], rax
xor esi, esi
test rcx, rcx
je 0x1400dd963
mov rbx, r15
mov edi, dword [rcx + 0x1c]
test edi, edi
je 0x1400dd8d1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str.Ignoring_static_component_with_invalid_flags__lx_n
mov rcx, rax
call fcn.140001c80
jmp 0x1400dd950
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400dd907
xor ecx, ecx
call rax
test eax, eax
jns 0x1400dd907
cmp dword [0x14013569c], 0
je 0x1400dd950
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Ignoring_static_component__failed_to_initialize_n
call fcn.140001c80
jmp 0x1400dd950
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x1400dd92e
mov ecx, dword [0x1401356a4]
mov rax, qword [0x1401356a8]
mov qword [rax + rcx*8], rdx
add dword [0x1401356a4], r14d
mov rcx, qword [rbx]
cmp dword [rcx + 0x18], 0
jne 0x1400dd941
mov rcx, qword [rcx + 0x20]
xor edx, edx
call fcn.1400ddc58
jmp 0x1400dd950
cmp dword [rcx + 0x18], r14d
jne 0x1400dd950
mov rcx, qword [rcx + 0x20]
call fcn.1400dae94
add esi, r14d
lea rbx, [r15 + rsi*8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400dd8ab
and dword [0x1401356a0], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x1400ddb70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xc8], 0
mov rsi, r9
mov ebp, edx
mov rbx, rcx
je 0x1400ddbb9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], select
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, r8
call fcn.1400ddae8
mov rdi, rax
test rax, rax
jne 0x1400ddbd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x28
jmp 0x1400ddba1
mov rax, qword [rsp + 0x68]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [rsp + 0x60]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [rdi + select]
mov rsi, rax
test rax, rax
je 0x1400ddba1
mov dword [rax + 0x10], ebp
cmp qword [rbx + 0x2f0], 0
je 0x1400ddc19
mov rcx, rbx
call fcn.1400dd5f0
mov rcx, rsi
call fcn.1400dd4b4
cmp dword [rdi + 8], 1
mov esi, eax
jne 0x1400ddc4f
lea rcx, str.HWLOC_ANNOTATE_GLOBAL_COMPONENTS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400ddc4f
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
je 0x1400ddc4f
and dword [rbx + 0x304], 0xffffffbf
mov eax, esi
jmp 0x1400ddba4