joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ee900
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rbx, rdx
test rcx, rcx
je 0x6eea70
test rdx, rdx
je 0x6eea70
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call rdi
mov r13d, eax
test eax, eax
je 0x6eea38
mov ecx, eax
add rcx, rcx
call fcn.006cb300
mov r12, rax
test rax, rax
je 0x6eea77
mov rdx, rax
mov ecx, r13d
call rdi
test eax, eax
je 0x6eea30
mov edx, eax
xor ecx, ecx
mov word [r12 + rdx*2], cx
lea edx, [rax - 1]
lea rdx, [r12 + rdx*2]
cmp word [rdx], 0x5c
je 0x6eea50
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rdi, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x6eea30
mov rdx, qword [rbx]
mov ecx, edx
cmp edx, eax
jl 0x6eea7e
cmp rdx, 0x7fffffff
mov eax, 0x7fffffff
mov r8, r12
mov qword [rsp + 0x20], rsi
cmova ecx, eax
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
call rdi
mov rcx, r12
mov esi, eax
call fcn.006cb320
test esi, esi
je 0x6eea38
sub esi, 1
xor eax, eax
movsxd rsi, esi
mov qword [rbx], rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, r12
call fcn.006cb320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.006cf860
cmp eax, 3
je 0x6eea60
xor eax, eax
mov word [rdx], ax
jmp 0x6ee97b
cmp word [r12 + 2], 0x3a
jne 0x6eea55
jmp 0x6ee97b
mov eax, 0xfffff019
jmp 0x6eea1d
mov eax, 0xfffff027
jmp 0x6eea1d
mov rcx, r12
mov dword [rsp + 0x4c], eax
call fcn.006cb320
movsxd rax, dword [rsp + 0x4c]
mov qword [rbx], rax
mov eax, 0xfffff024
jmp 0x6eea1d
Function at 0x6eeaa0
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
test rcx, rcx
je 0x6eec48
mov r8, rcx
mov rsi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x20], 0
call rsi
movsxd rdi, eax
test rdi, rdi
je 0x6eeb88
lea rbp, [rdi + rdi]
mov rcx, rbp
call fcn.006cb300
mov r12, rax
test rax, rax
je 0x6eec52
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
call rsi
mov rcx, r12
test eax, eax
je 0x6eeb83
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x6eeb80
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdx, r12
mov ecx, edi
call rsi
mov ebx, eax
cmp rdi, rbx
jb 0x6eeba8
cmp word [r12 + rbp - 2], 0x5c
je 0x6eebd0
cmp rdi, 1
jbe 0x6eeb67
cmp word [r12 + 2], 0x3a
je 0x6eec00
mov rcx, r12
call fcn.006cb320
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, r12
call fcn.006cb320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.006cf860
mov rcx, r12
call fcn.006cb320
lea rcx, [rbx + rbx]
call fcn.006cb300
mov r12, rax
xor eax, eax
test r12, r12
je 0x6eeb71
mov rdx, r12
mov ecx, ebx
call rsi
jmp 0x6eeb47
cmp rdi, 3
je 0x6eebf0
sub rdi, 1
xor ecx, ecx
mov word [r12 + rdi*2], cx
jmp 0x6eeb54
cmp word [r12 + 2], 0x3a
jne 0x6eebd6
nop dword [rax]
movzx eax, word [r12]
lea edx, [rax - 0x41]
cmp dx, 0x19
jbe 0x6eec1e
lea edx, [rax - 0x61]
sub eax, 0x20
cmp dx, 0x19
ja 0x6eeb67
mov edx, 0x3d
mov word [rsp + 0x3a], ax
lea rcx, [rsp + 0x38]
mov word [rsp + 0x38], dx
mov rdx, r12
mov dword [rsp + 0x3c], 0x3a
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x6eeb67
mov eax, 0xfffff019
jmp 0x6eeb71
mov eax, 0xfffff027
jmp 0x6eeb71

Function at 0x6eec80
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
mov rax, 0xffffffffffffffff
cmovne rax, qword [rsp + 0x30]
add rsp, 0x68
ret

Function at 0x6eecb0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
mov rax, 0xffffffffffffffff
cmovne rax, qword [rsp + 0x28]
add rsp, 0x68
ret
Function at 0x6eed00
Capabilities:
Enumerate processes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x158
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 2
mov ebx, eax
mov dword [rsp + 0x20], 0x130
lea rsi, [rsp + 0x20]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov r12, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x6eed57
jmp 0x6eed80
mov rdx, rsi
mov rcx, r12
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x6eed80
cmp dword [rsp + 0x28], ebx
jne 0x6eed48
mov r13d, dword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
add rsp, 0x158
pop rbx
pop rsi
pop r12
pop r13
ret
mov r13d, 0xffffffff
jmp 0x6eed62
Function at 0x6efa80
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rdi, rcx
mov rsi, rdx
test rcx, rcx
je 0x6efbf0
test rdx, rdx
je 0x6efbf0
cmp qword [rdx], 0
je 0x6efbf0
mov rbp, qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edx, edx
xor ecx, ecx
call rbp
mov ebx, eax
mov eax, eax
test rax, rax
je 0x6efba8
lea rcx, [rax + rax + 2]
call fcn.006cb300
mov r12, rax
test rax, rax
je 0x6efbf7
lea ecx, [rbx + 1]
mov rdx, rax
call rbp
mov eax, eax
test rax, rax
je 0x6efba0
cmp word [r12 + rax*2 - 2], 0x5c
je 0x6efbc0
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x6efba0
mov rdx, qword [rsi]
mov eax, eax
cmp rax, rdx
ja 0x6efbfe
mov dword [rsp + 0x28], edx
mov ecx, 0xfde9
xor edx, edx
mov r8, r12
mov qword [rsp + 0x38], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdi
call rbx
mov rcx, r12
mov ebx, eax
call fcn.006cb320
test ebx, ebx
je 0x6efba8
lea eax, [rbx - 1]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, r12
call fcn.006cb320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.006cf860
cmp rax, 3
je 0x6efbd8
xor edx, edx
mov word [r12 + rax*2 - 2], dx
jmp 0x6efafc
cmp word [r12 + 2], 0x3a
jne 0x6efbc6
jmp 0x6efafc
mov eax, 0xfffff019
jmp 0x6efb8d
mov eax, 0xfffff027
jmp 0x6efb8d
mov rcx, r12
mov qword [rsp + 0x48], rax
call fcn.006cb320
mov rax, qword [rsp + 0x48]
mov qword [rsi], rax
mov eax, 0xfffff024
jmp 0x6efb8d
Function at 0x6f0300
Capabilities:
Get common file path
Get session user name

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rbx, rcx
test rcx, rcx
je 0x6f04ce
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6f0418
lea r13, [rsp + 0x34]
xor edx, edx
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x38]
mov rdi, qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov r8, r13
call rdi
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x7a
jne 0x6f03e8
mov ecx, dword [rsp + 0x34]
add rcx, rcx
call fcn.006cb300
mov r12, rax
test rax, rax
je 0x6f04e2
mov rcx, qword [rsp + 0x38]
mov r8, r13
mov rdx, rax
call rdi
test eax, eax
je 0x6f0490
lea r14, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, r13
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x6f0430
call rsi
mov rcx, r12
mov r13d, eax
call fcn.006cb320
cmp r13d, 0x7a
je 0x6f04d8
mov ecx, r13d
call fcn.006cf860
jmp 0x6f0400
call rsi
mov rcx, qword [rsp + 0x38]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r12d
call fcn.006cf860
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.006cf860
jmp 0x6f0400
mov qword [rbx + 0x18], 0
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, r12
call fcn.006efc60
mov rcx, r12
mov dword [rsp + 0x2c], eax
call fcn.006cb320
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x6f0400
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, r14
call fcn.006efc60
test eax, eax
jne 0x6f04b8
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0
jmp 0x6f0400
call rsi
mov rcx, qword [rsp + 0x38]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.006cb320
mov ecx, r13d
call fcn.006cf860
jmp 0x6f0400
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.006cb320
mov eax, dword [rsp + 0x2c]
jmp 0x6f0400
mov eax, 0xfffff019
jmp 0x6f0400
mov eax, 0xfffff027
jmp 0x6f0400
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff027
jmp 0x6f0400
Function at 0x6f06c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
test rdx, rdx
mov qword [rsp + 0x4a8], rdx
mov r14, r8
sete dl
test r8, r8
sete al
or dl, al
jne 0x6f08b0
test rcx, rcx
je 0x6f08b0
cmp qword [r8], 0
je 0x6f08b0
lea r8, [rsp + 0x48]
mov edx, 0xffffffff
call fcn.006f0220
mov r13d, eax
test eax, eax
jne 0x6f0807
lea rsi, [rsp + 0x50]
mov rbp, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, 0x200
mov rdi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r12, rsi
jmp 0x6f0768
cmp r12, rsi
je 0x6f074d
mov rcx, r12
call fcn.006cb320
lea ecx, [r15 + 1]
mov rbx, rcx
add rcx, rcx
call fcn.006cb300
mov r12, rax
test rax, rax
je 0x6f0820
xor ecx, ecx
call rbp
mov rcx, qword [rsp + 0x48]
mov r8d, ebx
mov rdx, r12
call rdi
mov r15d, eax
cmp eax, ebx
jae 0x6f0740
mov rcx, qword [rsp + 0x48]
call fcn.006cb320
mov qword [rsp + 0x48], 0
test r15d, r15d
je 0x6f0840
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x6f08a8
mov rdx, qword [r14]
mov eax, eax
cmp rax, rdx
jbe 0x6f0860
mov qword [r14], rax
mov r13d, 0xfffff024
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x6f0802
call fcn.006cb320
cmp r12, rsi
jne 0x6f0830
mov eax, r13d
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov r13d, 0xfffff027
test rcx, rcx
jne 0x6f07fd
mov rcx, r12
call fcn.006cb320
jmp 0x6f0807
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x6f079c
mov ecx, eax
call fcn.006cf860
mov r13d, eax
jmp 0x6f07f3
mov rax, qword [rsp + 0x4a8]
mov dword [rsp + 0x28], edx
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x38], 0
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x6f08a8
sub eax, 1
mov qword [r14], rax
jmp 0x6f07f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6f084e
mov r13d, 0xfffff019
jmp 0x6f0807

Function at 0x6f1240
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x6f1250
xor eax, eax
add rsp, 0x28
ret
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x6f1249
mov eax, 0xfffff01a
jmp 0x6f124b
Function at 0x6f1270
Capabilities:
Link many functions at runtime

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.ntdll.dll
call rsi
mov r12, rax
test rax, rax
je 0x6f1416
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlGetVersion
mov rcx, rax
call rbx
lea rdx, str.RtlNtStatusToDosError
mov rcx, r12
mov qword [0x00c80a58], rax
call rbx
mov qword [0x00c80a50], rax
test rax, rax
je 0x6f1402
lea rdx, str.NtDeviceIoControlFile
mov rcx, r12
call rbx
mov qword [0x00c80a48], rax
test rax, rax
je 0x6f1402
lea rdx, str.NtQueryInformationFile
mov rcx, r12
call rbx
mov qword [0x00c80a40], rax
test rax, rax
je 0x6f1402
lea rdx, str.NtSetInformationFile
mov rcx, r12
call rbx
mov qword [0x00c80a38], rax
test rax, rax
je 0x6f1402
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, r12
call rbx
mov qword [0x00c80a30], rax
test rax, rax
je 0x6f1402
lea rdx, str.NtQueryDirectoryFile
mov rcx, r12
call rbx
cmp qword [0x00c80a30], 0
mov qword [0x00c80a28], rax
je 0x6f1402
lea rdx, str.NtQuerySystemInformation
mov rcx, r12
call rbx
mov qword [0x00c80a20], rax
test rax, rax
je 0x6f1402
lea rdx, str.NtQueryInformationProcess
mov rcx, r12
call rbx
mov qword [0x00c80a18], rax
test rax, rax
je 0x6f1402
lea rcx, [0x0095acc5]
call rsi
mov rcx, rax
test rax, rax
je 0x6f1416
lea rdx, str.GetQueuedCompletionStatusEx
call rbx
lea rcx, str.powrprof.dll
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x00c80a10], rax
call rsi
mov rcx, rax
test rax, rax
je 0x6f13d8
lea rdx, str.PowerRegisterSuspendResumeNotification
call rbx
mov qword [0x00c80a08], rax
lea rcx, str.user32.dll
call rsi
mov rcx, rax
test rax, rax
je 0x6f13f9
lea rdx, str.SetWinEventHook
call rbx
mov qword [0x00c80a00], rax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.006cf7a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.006cf7a0
nop
nop
nop
nop
nop
nop
Function at 0x6f1530
Capabilities:
Initialize winsock library

Disassembly:
push r12
push rbx
sub rsp, 0x468
xor edx, edx
lea r8, [0x00c80a80]
lea rcx, str.0.0.0.0
call fcn.006cd440
test eax, eax
jne 0x8b1840
xor edx, edx
lea r8, [0x00c80a60]
lea rcx, [0x0095ad58]
call fcn.006cd490
test eax, eax
jne 0x8b1840
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x6f15eb
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x6f16b4
mov rbx, qword [sym.imp.WS2_32.dll_socket]
xor r8d, r8d
mov edx, 1
mov dword [0x00c80a94], 1
mov ecx, 2
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x6f1660
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
mov dword [0x00c80a90], 1
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x6f1600
add rsp, 0x468
pop rbx
pop r12
ret
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x6f1646
test byte [rsp + 0x1e2], 2
je 0x6f1646
mov dword [0x00c80a90], 0
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
nop
add rsp, 0x468
pop rbx
pop r12
ret
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x6f16a6
test byte [rsp + 0x1e2], 2
je 0x6f16a6
mov dword [0x00c80a94], 0
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x6f15c9
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.006cf7a0
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x6f9860
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00c81468]
test eax, eax
je 0x6f9880
mov eax, dword [0x00c81464]
add rsp, 0x28
ret
lea rcx, str.HWLOC_HIDE_ERRORS
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x00c81464]
test rcx, rcx
je 0x6f98a5
call sub.msvcrt.dll_atoi
mov dword [0x00c81464], eax
mov dword [0x00c81468], 1
add rsp, 0x28
ret
Function at 0x701cd0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dword [rcx + 0xa4], 1
mov dword [rcx + 0x2cc], 1
mov rbx, rcx
jne 0x701cf7
mov dword [rcx + 0x2cc], 0
lea rcx, str.HWLOC_GROUPING
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x701d30
call sub.msvcrt.dll_atoi
test eax, eax
jne 0x701d30
mov dword [rbx + 0x2cc], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x2cc]
test eax, eax
je 0x701d1e
movabs rax, 0x3c23d70a00000000
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov dword [rbx + 0x2d4], 5
mov qword [rbx + 0x2d8], rax
movabs rax, 0x3d4ccccd3ca3d70a
mov qword [rbx + 0x2e0], rax
mov qword [rbx + 0x2e8], 0x3dcccccd
call sub.msvcrt.dll_getenv
test rax, rax
je 0x701e00
mov ecx, 4
lea rdi, [0x0095db5f]
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
seta dl
sbb dl, 0
test dl, dl
jne 0x701dd8
mov dword [rbx + 0x2d0], 0
lea rcx, str.HWLOC_GROUPING_VERBOSE
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x701d1e
call sub.msvcrt.dll_atoi
mov dword [rbx + 0x2d0], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rbx + 0x2d4], 1
mov rcx, rax
call sub.msvcrt.dll_atof
cvtsd2ss xmm0, xmm0
movss dword [rbx + 0x2d8], xmm0
jmp 0x701d9d
mov dword [rbx + 0x2d4], 1
jmp 0x701d9d
Function at 0x704670
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x2f0]
mov dword [rcx + 0xc4], 1
mov rsi, rcx
test rbx, rbx
je 0x704730
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
nop dword [rax + rax]
mov eax, dword [rbx + 0x10]
test eax, eax
jne 0x7046c9
mov eax, dword [rbx + 0x28]
cmp eax, 0xffffffff
je 0x7046c9
test eax, eax
jne 0x704760
mov dword [rsi + 0xc4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x7046a8
mov rbx, qword [rsi + 0x2f0]
test byte [rsi + 0x20], 2
jne 0x704798
test rbx, rbx
je 0x704730
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
jmp 0x704709
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x704730
cmp dword [rbx + 0x10], 1
jne 0x704700
mov eax, dword [rbx + 0x28]
cmp eax, 0xffffffff
je 0x704700
test eax, eax
jne 0x704780
mov dword [rsi + 0xc4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x704709
nop
lea rcx, str.HWLOC_THISSYSTEM
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x70474f
call sub.msvcrt.dll_atoi
mov dword [rsi + 0xc4], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x3fc
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x7046bf
mov r8d, 0x40a
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x70471b
mov dword [rsi + 0xc4], 1
jmp 0x7046e3

Function at 0x7048a0
Capabilities:
Query environment variable

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov edi, edx
mov rcx, r8
mov r12, r9
mov eax, dword [rsi + 0xc8]
test eax, eax
jne 0x704970
xor edx, edx
call fcn.007033c0
mov rbx, rax
test rax, rax
je 0x70498c
mov r9, r12
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [rbx + 0x10]
mov r12, rax
test rax, rax
je 0x704984
cmp qword [rsi + 0x2f0], 0
mov dword [rax + 0x10], edi
je 0x70491b
mov rcx, rsi
call fcn.007047f0
mov rcx, r12
call fcn.00703fa0
cmp dword [rbx + 8], 1
mov r12d, eax
je 0x704940
mov eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rcx, str.HWLOC_ANNOTATE_GLOBAL_COMPONENTS
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x70492c
call sub.msvcrt.dll_atoi
test eax, eax
je 0x70492c
and dword [rsi + 0x304], 0xffffffbf
jmp 0x70492c
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x10
jmp 0x70492c
mov r12d, 0xffffffff
jmp 0x70492c
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x28
jmp 0x70492c
Function at 0x70b040
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebp, dword [r8]
mov qword [rsp + 0x88], rdx
mov edx, 0x29
mov r12, r8
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x20], rcx
call sub.msvcrt.dll_strchr
mov r8, qword [rsp + 0x20]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x70b2be
cmp byte [r8], 0x29
je 0x70b2b0
sub ebp, 4
xor r15d, r15d
xor r14d, r14d
xor ebx, ebx
lea r13, [0x0095f256]
cmp ebp, 7
jbe 0x70b1cf
nop dword [rax]
mov ecx, 7
lea rsi, str.memory
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x70b210
mov ecx, 8
mov rsi, r13
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x70b238
lea r14, [r8 + 8]
lea rdx, [0x0095f25f]
mov rcx, r14
mov qword [rsp + 0x80], r14
call sub.msvcrt.dll_strcspn
lea rsi, [r14 + rax]
mov r15, rax
mov qword [rsp + 0x80], rsi
movzx eax, byte [rsi]
cmp al, 0x20
je 0x70b1b0
cmp al, 0x29
jne 0x70b260
mov qword [r12 + 0x10], rbx
test r14, r14
je 0x70b188
mov rax, qword [rsp + 0x98]
cmp qword [rax], 0
je 0x70b175
mov eax, dword [rsp + 0xa0]
test eax, eax
je 0x70b175
mov ecx, 2
call qword [fcn.00745b20]
mov r8d, 0x3c
mov edx, 1
lea rcx, str.Overwriting_duplicate_indexes_attribute_with_last_occurence_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rsp + 0x98]
mov qword [rax], r14
mov dword [rax + 8], r15d
nop dword [rax]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x88]
add rax, 1
mov qword [rbx], rax
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [rsi + 1]
mov qword [rsp + 0x80], r8
cmp byte [rsi + 1], 0x29
je 0x70b12d
cmp ebp, 7
ja 0x70b0b8
mov ecx, 5
lea rsi, [0x0095f248]
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x70b0d6
lea rcx, [r8 + 5]
lea rdx, [rsp + 0x80]
call fcn.0070af40
mov rsi, qword [rsp + 0x80]
mov rbx, rax
jmp 0x70b11a
lea rcx, [r8 + 7]
lea rdx, [rsp + 0x80]
call fcn.0070af40
mov rsi, qword [rsp + 0x80]
mov rbx, rax
jmp 0x70b11a
mov ecx, dword [rsp + 0xa0]
test ecx, ecx
jne 0x70b28a
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x70b19e
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x70b243
mov ecx, 2
call qword [fcn.00745b20]
mov r8, rsi
lea rdx, str.Missing_parameter_separator_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x70b243
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.00745b20]
mov r8, qword [rsp + 0x20]
lea rdx, str.Unknown_attribute_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x70b243
mov qword [r12 + 0x10], 0
jmp 0x70b188
mov r9d, dword [rsp + 0xa0]
test r9d, r9d
je 0x70b243
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.00745b20]
mov r8, qword [rsp + 0x20]
lea rdx, str.Missing_attribute_closing_bracket_in_synthetic_string_doesnt_have_a_number_of_objects_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x70b243