joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c58a0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
test rdx, rdx
mov qword [rsp + 0x4a8], rdx
sete al
test r8, r8
mov qword [rsp + 0x4b0], r8
sete dl
or al, dl
jne 0x1400c5aa0
test rcx, rcx
je 0x1400c5aa0
cmp qword [r8], 0
je 0x1400c5aa0
lea r8, [rsp + 0x48]
mov edx, 0xffffffff
call fcn.1400c5400
mov r13d, eax
test eax, eax
jne 0x1400c59ec
lea rsi, [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rbp, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, 0x200
mov rdi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r15, rsi
jmp 0x1400c5958
cmp r15, rsi
je 0x1400c593d
mov rcx, r15
call fcn.14009f990
lea ecx, [r14 + 1]
mov rbx, rcx
add rcx, rcx
call fcn.14009f970
mov r15, rax
test rax, rax
je 0x1400c5a08
xor ecx, ecx
call rbp
mov r8d, ebx
mov rdx, r15
mov rcx, r12
call rdi
mov r14d, eax
cmp eax, ebx
jae 0x1400c5930
mov rcx, r12
call fcn.14009f990
mov qword [rsp + 0x48], 0
test r14d, r14d
je 0x1400c5a28
xor edx, edx
mov r9d, 0xffffffff
mov r8, r15
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x1400c5a98
mov rdi, qword [rsp + 0x4b0]
mov eax, eax
mov rdx, qword [rdi]
cmp rax, rdx
jbe 0x1400c5a48
mov qword [rdi], rax
mov r13d, 0xfffff024
cmp r15, rsi
jne 0x1400c5a1b
mov eax, r13d
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r12, r12
je 0x1400c5a15
mov rcx, r12
call fcn.14009f990
mov r13d, 0xfffff027
mov rcx, r15
call fcn.14009f990
jmp 0x1400c59ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400c5988
mov ecx, eax
call fcn.1400a4200
mov r13d, eax
jmp 0x1400c59e7
mov rax, qword [rsp + 0x4a8]
mov dword [rsp + 0x28], edx
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x38], 0
mov r8, r15
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x1400c5a98
mov rdi, qword [rsp + 0x4b0]
sub eax, 1
mov qword [rdi], rax
jmp 0x1400c59e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400c5a36
mov r13d, 0xfffff019
jmp 0x1400c59ec

Function at 0x1400c6400
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x1400c6410
xor eax, eax
add rsp, 0x28
ret
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400c6409
mov eax, 0xfffff01a
jmp 0x1400c640b
Function at 0x1400c6430
Capabilities:
Link many functions at runtime

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [0x1402a02d0]
call rsi
mov r12, rax
test rax, rax
je 0x1400c6604
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1402a02eb]
mov rcx, rax
call rbx
lea rdx, str.RtlNtStatusToDosError
mov rcx, r12
mov qword [0x1405881c0], rax
call rbx
mov qword [0x1405881b8], rax
test rax, rax
je 0x1400c65f0
lea rdx, str.NtDeviceIoControlFile
mov rcx, r12
call rbx
mov qword [0x1405881b0], rax
test rax, rax
je 0x1400c65f0
lea rdx, str.NtQueryInformationFile
mov rcx, r12
call rbx
mov qword [0x1405881a8], rax
test rax, rax
je 0x1400c65f0
lea rdx, str.NtSetInformationFile
mov rcx, r12
call rbx
mov qword [0x1405881a0], rax
test rax, rax
je 0x1400c65f0
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, r12
call rbx
mov qword [0x140588198], rax
test rax, rax
je 0x1400c65f0
lea rdx, str.NtQueryDirectoryFile
mov rcx, r12
call rbx
cmp qword [0x140588198], 0
mov qword [0x140588190], rax
je 0x1400c65f0
lea rdx, str.NtQuerySystemInformation
mov rcx, r12
call rbx
mov qword [0x140588188], rax
test rax, rax
je 0x1400c65f0
lea rdx, str.NtQueryInformationProcess
mov rcx, r12
call rbx
mov qword [0x140588180], rax
test rax, rax
je 0x1400c65f0
lea rcx, [0x1402a03c5]
call rsi
mov rcx, rax
test rax, rax
je 0x1400c6604
lea rdx, str.GetQueuedCompletionStatusEx
call rbx
lea rcx, str.powrprof.dll
mov r8d, 0x800
xor edx, edx
mov qword [0x140588178], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rcx, rax
test rax, rax
je 0x1400c65a5
lea rdx, str.PowerRegisterSuspendResumeNotification
call rbx
mov qword [0x140588170], rax
lea rcx, str.user32.dll
call rsi
mov rcx, rax
test rax, rax
je 0x1400c65c6
lea rdx, str.SetWinEventHook
call rbx
mov qword [0x140588168], rax
lea rcx, str.ws2_32.dll
call rsi
mov rcx, rax
test rax, rax
je 0x1400c65e7
lea rdx, str.GetHostNameW
call rbx
mov qword [0x140588160], rax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.1400a4140
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.1400a4140
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400c6720
Capabilities:
Initialize winsock library

Disassembly:
push r12
push rbx
sub rsp, 0x468
xor edx, edx
lea r8, [0x1405881f0]
lea rcx, str.0.0.0.0
call fcn.1400a1940
test eax, eax
jne 0x14027ccc0
xor edx, edx
lea r8, [0x1405881d0]
lea rcx, [0x1402a0468]
call fcn.1400a1990
test eax, eax
jne 0x14027ccc0
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x1400c67db
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400c68a4
mov rbx, qword [sym.imp.WS2_32.dll_socket]
xor r8d, r8d
mov edx, 1
mov dword [0x140588204], 1
mov ecx, 2
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c6850
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
mov dword [0x140588200], 1
call rbx
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c67f0
add rsp, 0x468
pop rbx
pop r12
ret
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400c6836
test byte [rsp + 0x1e2], 2
je 0x1400c6836
mov dword [0x140588200], 0
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
nop
add rsp, 0x468
pop rbx
pop r12
ret
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400c6896
test byte [rsp + 0x1e2], 2
je 0x1400c6896
mov dword [0x140588204], 0
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1400c67b9
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.1400a4140
nop
nop word cs:[rax + rax]
nop
Function at 0x1400ce690
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1405883c4]
test eax, eax
je 0x1400ce6b0
mov eax, dword [0x14027e610]
add rsp, 0x28
ret
lea rcx, str.HWLOC_HIDE_ERRORS
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x14027e610]
test rcx, rcx
je 0x1400ce6d5
call sub.msvcrt.dll_atoi
mov dword [0x14027e610], eax
mov dword [0x1405883c4], 1
add rsp, 0x28
ret
Function at 0x1400d6e00
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
xor eax, eax
cmp dword [rcx + 0xa4], 1
setne al
mov dword [rcx + 0x2f0], eax
mov rbx, rcx
lea rcx, str.HWLOC_GROUPING
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400d6e50
call sub.msvcrt.dll_atoi
test eax, eax
jne 0x1400d6e50
mov dword [rbx + 0x2f0], 0
add rsp, 0x28
pop rbx
pop r12
ret
mov eax, dword [rbx + 0x2f0]
test eax, eax
je 0x1400d6e43
movabs rax, 0x3ca3d70a3c23d70a
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov qword [rbx + 0x2f8], 5
mov qword [rbx + 0x300], rax
movabs rax, 0x3dcccccd3d4ccccd
mov qword [rbx + 0x308], rax
mov dword [rbx + 0x310], 0
call sub.msvcrt.dll_getenv
mov r12, rax
test rax, rax
je 0x1400d6f10
lea rdx, [0x1402a31f0]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400d6ef0
mov dword [rbx + 0x2f4], 0
lea rcx, str.HWLOC_GROUPING_VERBOSE
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400d6e43
call sub.msvcrt.dll_atoi
mov dword [rbx + 0x2f4], eax
add rsp, 0x28
pop rbx
pop r12
ret
mov dword [rbx + 0x2f8], 1
mov rcx, r12
call sub.msvcrt.dll_atof
cvtsd2ss xmm0, xmm0
movss dword [rbx + 0x2fc], xmm0
jmp 0x1400d6eb8
mov dword [rbx + 0x2f8], 1
jmp 0x1400d6eb8
Function at 0x1400db7b0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
lea rcx, str.HWLOC_CPUKINDS_RANKING
call sub.msvcrt.dll_getenv
mov rsi, rax
test rax, rax
je 0x1400db7e6
lea rdx, [0x1402a358b]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400db880
mov rcx, rbx
call fcn.1400db700
test eax, eax
je 0x1400db990
mov ecx, dword [rbx + 0x2e0]
mov edx, 0xc
call sub.msvcrt.dll_calloc
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400db844
lea rsi, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.1400db500
mov r8, rsi
mov edx, 3
mov rcx, rbx
call fcn.1400db1d0
mov rcx, qword [rsp + 0x30]
mov esi, eax
call fcn.140124a98
test esi, esi
je 0x1400db990
mov edx, dword [rbx + 0x2e0]
test edx, edx
je 0x1400db877
mov rcx, qword [rbx + 0x2e8]
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rax, [rcx + 8]
lea rdx, [rcx + rdx*8 + 0x30]
nop dword [rax]
mov dword [rax], 0xffffffff
add rax, 0x28
cmp rax, rdx
jne 0x1400db868
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
lea rdx, [0x1402a3593]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400db844
lea rdx, str.coretypefrequency
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400db9f0
lea rdx, str.coretypefrequency_strict
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400dba2f
lea rdx, str.coretype
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400dba37
lea rdx, str.frequency
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400dba3f
lea rdx, str.frequency_max
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400dba47
lea rdx, str.frequency_base
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400dba4f
lea rdx, [0x1402a35f5]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400db980
lea rdx, str.no_forced_efficiency
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400db7f6
call fcn.1400ce690
sub eax, 1
jg 0x1400db7e6
mov ecx, 2
call qword [fcn.140124330]
mov r8, rsi
lea rdx, str.hwloc:_Failed_to_recognize_HWLOC_CPUKINDS_RANKING_value__s_n
mov rcx, rax
call fcn.1400db6d0
jmp 0x1400db7e6
mov rcx, rbx
call fcn.1400db700
test eax, eax
jne 0x1400db844
mov rcx, qword [rbx + 0x2e8]
mov edx, dword [rbx + 0x2e0]
lea r9, [0x1400db1b0]
mov r8d, 0x28
call sub.msvcrt.dll_qsort
mov ecx, dword [rbx + 0x2e0]
test ecx, ecx
je 0x1400db877
mov rdx, qword [rbx + 0x2e8]
xor eax, eax
add rdx, 8
nop word [rax + rax]
mov dword [rdx], eax
add eax, 1
add rdx, 0x28
cmp eax, ecx
jne 0x1400db9d0
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
mov r12d, 3
mov ecx, dword [rbx + 0x2e0]
mov edx, 0xc
call sub.msvcrt.dll_calloc
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400db844
lea rsi, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.1400db500
mov r8, rsi
mov edx, r12d
jmp 0x1400db828
mov r12d, 4
jmp 0x1400db9f6
mov r12d, 5
jmp 0x1400db9f6
mov r12d, 6
jmp 0x1400db9f6
mov r12d, 7
jmp 0x1400db9f6
mov r12d, 8
jmp 0x1400db9f6
Function at 0x1400dbca0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
xor esi, esi
xor ebx, ebx
mov eax, dword [rcx + 0x2e0]
mov r13, rcx
test eax, eax
jne 0x1400dbcda
jmp 0x1400dbd78
mov eax, dword [r13 + 0x2e0]
add ebx, 1
cmp eax, ebx
jbe 0x1400dbd70
mov eax, ebx
xor r8d, r8d
mov rcx, r13
lea rdx, [rax + rax*4]
mov rax, qword [r13 + 0x2e8]
lea r12, [rax + rdx*8]
xor edx, edx
call fcn.1400d4790
mov rcx, qword [r12]
mov r8, qword [rax + 0xb8]
mov rdx, rcx
call fcn.1400e1200
mov r14, qword [r12]
mov rcx, r14
call fcn.1400e0cf0
test eax, eax
je 0x1400dbcc8
mov rcx, r14
mov esi, 1
call fcn.1400df940
mov edx, dword [r12 + 0x18]
mov rcx, qword [r12 + 0x20]
call fcn.1400ce6f0
mov eax, ebx
lea rdx, [r12 + 0x28]
mov rcx, r12
not eax
add eax, dword [r13 + 0x2e0]
lea r8, [rax + rax*4]
shl r8, 3
call sub.msvcrt.dll_memmove
mov eax, dword [r13 + 0x2e0]
sub eax, 1
mov dword [r13 + 0x2e0], eax
cmp eax, ebx
ja 0x1400dbcda
test esi, esi
je 0x1400dbd78
test eax, eax
jne 0x1400dbd88
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
cmp eax, 1
je 0x1400dbda1
mov rcx, r13
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp fcn.1400db7b0
mov rax, qword [r13 + 0x2e8]
mov dword [rax + 8], 0
jmp 0x1400dbd78
Function at 0x1400dd9f0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x318]
mov dword [rcx + 0xc4], 1
mov rsi, rcx
test rbx, rbx
je 0x1400ddab0
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
nop dword [rax + rax]
mov eax, dword [rbx + 0x10]
test eax, eax
jne 0x1400dda49
mov eax, dword [rbx + 0x28]
cmp eax, 0xffffffff
je 0x1400dda49
test eax, eax
jne 0x1400ddae0
mov dword [rsi + 0xc4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x1400dda28
mov rbx, qword [rsi + 0x318]
test byte [rsi + 0x20], 2
jne 0x1400ddb18
test rbx, rbx
je 0x1400ddab0
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
jmp 0x1400dda89
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x1400ddab0
cmp dword [rbx + 0x10], 1
jne 0x1400dda80
mov eax, dword [rbx + 0x28]
cmp eax, 0xffffffff
je 0x1400dda80
test eax, eax
jne 0x1400ddb00
mov dword [rsi + 0xc4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x1400dda89
nop
lea rcx, str.HWLOC_THISSYSTEM
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400ddacf
call sub.msvcrt.dll_atoi
mov dword [rsi + 0xc4], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x401
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400dda3f
mov r8d, 0x40f
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400dda9b
mov dword [rsi + 0xc4], 1
jmp 0x1400dda63

Function at 0x1400ddc20
Capabilities:
Query environment variable

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov edi, edx
mov rcx, r8
mov r12, r9
mov eax, dword [rsi + 0xc8]
test eax, eax
jne 0x1400ddcf0
xor edx, edx
call fcn.1400dc720
mov rbx, rax
test rax, rax
je 0x1400ddd0c
mov r9, r12
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [rbx + 0x10]
mov r12, rax
test rax, rax
je 0x1400ddd04
cmp qword [rsi + 0x318], 0
mov dword [rax + 0x10], edi
je 0x1400ddc9b
mov rcx, rsi
call fcn.1400ddb70
mov rcx, r12
call fcn.1400dd2f0
cmp dword [rbx + 8], 1
mov r12d, eax
je 0x1400ddcc0
mov eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rcx, str.HWLOC_ANNOTATE_GLOBAL_COMPONENTS
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400ddcac
call sub.msvcrt.dll_atoi
test eax, eax
je 0x1400ddcac
and dword [rsi + 0x32c], 0xffffffbf
jmp 0x1400ddcac
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x10
jmp 0x1400ddcac
mov r12d, 0xffffffff
jmp 0x1400ddcac
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x28
jmp 0x1400ddcac
Function at 0x1400e70f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140588428]
test eax, eax
je 0x1400e7110
mov eax, dword [0x140588424]
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400e7150
call sub.msvcrt.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x140588424], eax
mov dword [0x140588428], 1
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML_IMPORT
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x140588424]
test rcx, rcx
jne 0x1400e7124
jmp 0x1400e7137

Function at 0x1400e7170
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140588420]
test eax, eax
je 0x1400e7190
mov eax, dword [0x14058841c]
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400e71d0
call sub.msvcrt.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x14058841c], eax
mov dword [0x140588420], 1
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML_EXPORT
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x14058841c]
test rcx, rcx
jne 0x1400e71a4
jmp 0x1400e71b7

Function at 0x1400e92c0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140588430]
test eax, eax
je 0x1400e92e0
mov eax, dword [0x14058842c]
add rsp, 0x28
ret
lea rcx, str.HWLOC_XML_VERBOSE
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x14058842c]
test rcx, rcx
je 0x1400e9305
call sub.msvcrt.dll_atoi
mov dword [0x14058842c], eax
mov dword [0x140588430], 1
add rsp, 0x28
ret
Function at 0x1400f2c20
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp byte [rcx], 0x2d
mov qword [rsp + 0xb0], r8
mov r14, rcx
mov r13, rdx
jne 0x1400f2c52
cmp byte [rcx + 1], 0
lea rax, str._dev_stdin
cmove r14, rax
lea rdx, [0x1402a7aea]
mov rcx, r14
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x1400f2d5a
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140117410
test eax, eax
je 0x1400f2d28
mov ecx, 0x1001
mov r15d, 0x1000
call sub.msvcrt.dll_malloc
mov r14, rax
test rax, rax
je 0x1400f2d69
movabs rdi, 0x7fffffffffffffff
mov rsi, r15
xor ebx, ebx
jmp 0x1400f2cd5
lea rbp, [rsi + rsi]
mov rcx, r14
lea rdx, [rbp + 1]
call sub.msvcrt.dll_realloc
test rax, rax
je 0x1400f2d61
and rsi, rdi
mov r14, rax
mov r15, rsi
mov rsi, rbp
lea rcx, [r14 + rbx]
mov r9, r12
mov r8, r15
mov edx, 1
call sub.msvcrt.dll_fread
add rbx, rax
mov byte [r14 + rbx], 0
cmp r15, rax
je 0x1400f2cb0
mov rcx, r12
add rbx, 1
call fcn.140124a48
mov rax, qword [rsp + 0xb0]
mov qword [r13], r14
mov qword [rax], rbx
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, word [rsp + 0x26]
mov ecx, 0x1001
mov r15d, 0x1000
and ax, 0xf000
cmp ax, 0x8000
jne 0x1400f2c8d
mov eax, dword [rsp + 0x34]
lea r15d, [rax + 1]
movsxd r15, r15d
lea rcx, [r15 + 1]
jmp 0x1400f2c8d
mov eax, 0xffffffff
jmp 0x1400f2d13
mov rcx, r14
call fcn.140124a98
mov rcx, r12
call fcn.140124a48
mov eax, 0xffffffff
jmp 0x1400f2d13

Function at 0x1400f6040
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [0x14027e768]
mov eax, dword [rsp + 0x40]
cmp ebx, 1
jbe 0x1400f6083
mov rdx, qword [0x1405884b8]
mov eax, ebx
shl eax, 6
test rdx, rdx
je 0x1400f6083
lea ecx, [rbx - 1]
sub ebx, 1
movzx ecx, cx
shl ebx, 6
call rdx
movzx eax, ax
add eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x1400f96a0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov r11, rdx
cmp rdx, 2
jbe 0x1400f9838
movzx ebx, byte [rcx]
movzx eax, byte [rcx + 1]
lea r10, [rcx + 3]
sub r11, 3
movzx esi, byte [rcx + 2]
mov edi, ebx
shl ebx, 4
mov edx, eax
shr dl, 4
mov ecx, ebx
shl eax, 2
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
and ecx, 0x30
and eax, 0x3c
shr dil, 2
add ecx, edx
mov edx, esi
and esi, 0x3f
shr dl, 6
add edx, eax
mov eax, 4
cmp r9, 3
ja 0x1400f9748
jmp 0x1400f9828
movzx ecx, byte [r10]
add r10, 3
add rax, 4
sub r11, 3
movzx edx, byte [r10 - 2]
movzx esi, byte [r10 - 1]
mov edi, ecx
shl ecx, 4
mov ebp, edx
and ecx, 0x30
shl edx, 2
shr bpl, 4
and edx, 0x3c
shr dil, 2
add ecx, ebp
mov ebp, esi
and esi, 0x3f
shr bpl, 6
add edx, ebp
cmp r9, rax
jb 0x1400f9828
and ecx, 0x7f
and edx, 0x7f
and edi, 0x3f
movzx ecx, byte [rbx + rcx]
movzx edi, byte [rbx + rdi]
mov byte [r8 + rax - 3], cl
movzx ecx, byte [rbx + rdx]
mov rdx, rsi
and edx, 0x3f
mov byte [r8 + rax - 4], dil
movzx edx, byte [rbx + rdx]
mov byte [r8 + rax - 2], cl
mov byte [r8 + rax - 1], dl
cmp r11, 2
ja 0x1400f9700
test r11, r11
jne 0x1400f97a0
cmp rax, r9
jae 0x1400f9828
mov byte [r8 + rax], 0
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx edx, byte [r10]
cmp r11, 2
jne 0x1400f9832
movzx ecx, byte [r10 + 1]
mov ebx, ecx
shl ecx, 2
shr bl, 4
and ecx, 0x3c
mov r10d, edx
shl edx, 4
lea rsi, [rax + 4]
and edx, 0x30
shr r10b, 2
add edx, ebx
cmp rsi, r9
ja 0x1400f9828
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
and r10d, 0x3f
and edx, 0x7f
movzx r10d, byte [rbx + r10]
movzx edx, byte [rbx + rdx]
mov byte [r8 + rax], r10b
lea r10, [r8 + rax + 2]
mov byte [r8 + rax + 1], dl
add rax, 3
mov edx, 0x3d
cmp r11, 1
je 0x1400f9811
movzx ecx, cl
movzx edx, byte [rbx + rcx]
mov byte [r10], dl
mov byte [r8 + rax], 0x3d
mov rax, rsi
jmp 0x1400f978a
mov eax, 0xffffffff
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ecx, ecx
xor ebx, ebx
jmp 0x1400f97be
mov r10, rcx
xor eax, eax
jmp 0x1400f9785

Function at 0x1400fc730
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rax]
movdqu xmm1, xmmword [rdx + rax]
pxor xmm0, xmm1
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, 0x400
jne 0x1400fc738
ret
Function at 0x1400fca30
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x820
mov rbp, rcx
mov rbx, rdx
test rcx, rcx
je 0x1400fcbe1
test rdx, rdx
je 0x1400fcbe1
mov r10, qword [rcx]
test r10, r10
je 0x1400fcbe1
mov eax, dword [rdx + 0x18]
mov r11, qword [rdx]
lea r12, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov rdi, r12
mov r9, rax
shl rax, 0xa
lea rsi, [r11 + rax - 0x400]
rep movsq qword [rdi], qword [rsi]
mov esi, dword [rdx + 0x1c]
cmp esi, 1
jbe 0x1400fcb39
cmp esi, 3
jbe 0x1400fcbf3
lea eax, [rsi - 4]
lea r13d, [r9 + r9 - 1]
mov edi, 3
and eax, 0xfffffffe
lea r14d, [rax + 5]
mov r8d, r13d
lea ecx, [r13 + r9]
mov rax, r12
xor edx, edx
shl r8, 0xa
mov r13, rcx
shl rcx, 0xa
add r8, r11
add rcx, r11
nop dword [rax]
movdqu xmm0, xmmword [r8 + rdx]
movdqu xmm1, xmmword [r8 + rdx + 0x10]
add rax, 0x20
pxor xmm0, xmmword [rax - 0x20]
pxor xmm1, xmmword [rax - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
movdqu xmm2, xmmword [rcx + rdx + 0x10]
movdqu xmm3, xmmword [rcx + rdx]
add rdx, 0x20
pxor xmm1, xmm2
pxor xmm0, xmm3
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
cmp rdx, 0x400
jne 0x1400fcad8
lea eax, [rdi + 2]
add r13d, r9d
cmp r14d, eax
je 0x1400fcbf8
mov edi, eax
jmp 0x1400fcab3
lea r8, [rsp + 0x420]
mov rdi, r8
mov edx, dword [rbp + 8]
mov ecx, pe_nt_image_headers64
mov rsi, r12
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x420]
mov r9d, 0x400
mov rcx, r10
mov r8, rsi
call fcn.1401001c0
mov r9d, dword [0x1405884d0]
test r9d, r9d
je 0x1400fcb9d
mov edx, 0x400
mov rcx, r12
call fcn.1400fc670
mov r8d, dword [0x1405884d0]
test r8d, r8d
je 0x1400fcb9d
mov edx, 0x400
mov rcx, rsi
call fcn.1400fc670
mov ecx, dword [rbx + 0x28]
test ecx, ecx
jne 0x1400fcc49
mov esi, dword [rbx + 0x10]
mov edx, dword [0x1405884d0]
mov rcx, qword [rbx]
shl esi, 0xa
test edx, edx
je 0x1400fcbc8
test rcx, rcx
je 0x1400fcbc8
mov rdx, rsi
call fcn.1400fc670
mov eax, dword [rbx + 0x2c]
test eax, eax
jne 0x1400fcbe1
mov rax, qword [rbp + 0x68]
mov rcx, qword [rbx]
test rax, rax
je 0x1400fcc5a
mov rdx, rsi
call rax
nop
add rsp, 0x820
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, 1
add edi, 1
lea r8, [rsp + 0x420]
mov ecx, edi
imul ecx, r9d
sub ecx, 1
mov edx, ecx
mov rax, r12
shl rdx, 0xa
add rdx, r11
nop dword [rax + rax]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmmword [rax]
add rax, 0x10
add rdx, 0x10
movups xmmword [rax - 0x10], xmm0
cmp rax, r8
jne 0x1400fcc20
add ecx, r9d
cmp edi, esi
jae 0x1400fcb41
add edi, 1
jmp 0x1400fcc0c
mov edx, dword [rbp + 8]
mov rcx, qword [rbp]
call fcn.1400fe190
jmp 0x1400fcba8
call fcn.140124a98
jmp 0x1400fcbe1
Function at 0x1400fff10
Capabilities:
Hash data using sha512

Disassembly:
pxor xmm0, xmm0
movabs r8, 0xbb67ae8584caa73b
movabs r9, 0x3c6ef372fe94f82b
movabs r10, 0xa54ff53a5f1d36f1
movabs rax, 0x6a09e667f3bcc908
movabs r11, 0x510e527fade682d1
or rdx, 0x1010000
mov qword [rcx + 8], r8
movabs r8, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x10], r9
xor rdx, rax
movabs r9, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x18], r10
movabs r10, 0x5be0cd19137e2179
mov qword [rcx + 0x20], r11
mov qword [rcx + 0x28], r8
mov qword [rcx + 0x30], r9
mov qword [rcx + 0x38], r10
mov qword [rcx + 0xd0], 0
mov qword [rcx], rdx
movups xmmword [rcx + 0x40], xmm0
ret