joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e9d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rbp, r8
mov r10, rdx
mov r11, rcx
xor r14d, r14d
nop word [rax + rax]
mov r9, qword [r10]
test r9, r9
je 0x14001e9ab
mov rax, qword [r9 + 0x28]
mov rcx, qword [rbp + 0x28]
movzx r8d, word [rax]
movzx edx, word [rcx]
cmp dx, r8w
jae 0x14001e826
mov eax, r14d
jmp 0x14001e8a4
ja 0x14001e89f
cmp dword [rbp], 0xe
jne 0x14001e843
movzx edx, byte [rax + 2]
cmp dl, byte [rcx + 0x1e]
jb 0x14001e843
cmp dl, byte [rcx + 0x1f]
ja 0x14001e843
mov eax, 3
jmp 0x14001e8a4
cmp dword [r9], 0xe
jne 0x14001e85e
movzx edx, byte [rcx + 2]
cmp dl, byte [rax + 0x1e]
jb 0x14001e85e
cmp dl, byte [rax + 0x1f]
ja 0x14001e85e
mov eax, 2
jmp 0x14001e8a4
movzx edx, byte [rcx + 2]
movzx r8d, byte [rax + 2]
cmp dl, r8b
jae 0x14001e871
mov eax, r14d
jmp 0x14001e8a4
ja 0x14001e89f
movzx edx, byte [rcx + 3]
movzx r8d, byte [rax + 3]
cmp dl, r8b
jae 0x14001e886
mov eax, r14d
jmp 0x14001e8a4
ja 0x14001e89f
movzx edx, byte [rcx + 4]
movzx ecx, byte [rax + 4]
cmp dl, cl
jae 0x14001e899
mov eax, r14d
jmp 0x14001e8a4
jbe 0x14001e978
mov eax, 1
test eax, eax
je 0x14001e8bb
sub eax, 1
je 0x14001e921
sub eax, 1
je 0x14001e92a
cmp eax, 1
jne 0x14001e800
mov qword [rsp + 0x40], rdi
lea rdi, [rbp + 0x58]
mov qword [rdi], r9
mov qword [r10], rbp
cmp dword [rbp], 0xe
mov qword [rbp + 0x48], r11
jne 0x14001e967
mov qword [rsp + 0x38], rsi
lea rsi, [rbp + 0xa0]
cmp qword [rdi], r14
je 0x14001e962
mov qword [rsp + 0x30], rbx
nop
mov rbx, qword [rdi]
mov rcx, rbp
mov rdx, rbx
call fcn.14001e710
test eax, eax
jne 0x14001e939
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbx + 0x28]
movzx eax, word [rdx]
cmp word [rcx], ax
ja 0x14001e95d
movzx eax, byte [rdx + 0x1f]
cmp byte [rcx + 2], al
ja 0x14001e95d
lea rdi, [rbx + 0x58]
jmp 0x14001e958
lea r10, [r9 + 0x58]
jmp 0x14001e800
mov r11, r9
lea r10, [r9 + 0xa0]
jmp 0x14001e800
mov qword [rsi], rbx
mov rax, qword [rbx + 0x58]
mov qword [rdi], rax
mov rax, qword [rsi]
mov qword [rax + 0x48], rbp
mov rax, qword [rsi]
mov qword [rax + 0x58], r14
mov rsi, qword [rsi]
add rsi, 0x58
cmp qword [rdi], r14
jne 0x14001e8f0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, 0x104
lea r8, str.....hwlocpci_common.c
mov rcx, rax
lea rdx, str.Bad_assertion_in_hwloc__s:_d__aborting__n
call fcn.140001e00
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp + 0x48], r11
mov qword [rbp + 0x58], r14
mov qword [r10], rbp
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp 0x14001e7e0
Function at 0x14001fd50
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 1
xor eax, eax
lock cmpxchg dword [0x1400c1578], ebx
je 0x14001fd79
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x1400c1578], ebx
jne 0x14001fd67
mov eax, dword [0x1400c1580]
mov ecx, eax
inc eax
mov qword [rsp + 0x30], rbp
mov dword [0x1400c1580], eax
test ecx, ecx
je 0x14001fda5
xor ebp, ebp
mov dword [0x1400c1578], ebp
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rcx, str.HWLOC_COMPONENTS_VERBOSE
mov qword [rsp + 0x48], r14
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebp, ebp
test rax, rax
je 0x14001fdcf
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x1400c157c], eax
jmp 0x14001fdd5
mov dword [0x1400c157c], ebp
mov rdx, qword [0x14009b980]
lea r14, [0x14009b980]
mov qword [0x1400c15d8], rbp
mov dword [0x1400c15d4], ebp
test rdx, rdx
je 0x14001fe37
nop word [rax + rax]
mov ecx, dword [0x1400c15d4]
inc ecx
mov dword [0x1400c15d4], ecx
cmp qword [r14 + rcx*8], rbp
jne 0x14001fe00
test ecx, ecx
je 0x14001fe37
mov edx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdx, qword [0x14009b980]
mov qword [0x1400c15d8], rax
mov dword [0x1400c15d4], ebp
mov ebx, ebp
test rdx, rdx
je 0x14001ff3d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
nop dword [rax]
mov eax, ebx
lea rdi, [r14 + rax*8]
mov rax, qword [r14 + rax*8]
mov esi, dword [rax + 0x1c]
test esi, esi
je 0x14001fe83
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, esi
lea rdx, str.Ignoring_static_component_with_invalid_flags__lx_n
mov rcx, rax
call fcn.140001e00
jmp 0x14001ff27
mov rax, qword [rax + 8]
test rax, rax
je 0x14001febc
xor ecx, ecx
call rax
test eax, eax
jns 0x14001febc
cmp dword [0x1400c157c], ebp
je 0x14001ff27
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Ignoring_static_component__failed_to_initialize_n
call fcn.140001e00
jmp 0x14001ff27
mov rax, qword [rdi]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x14001fedf
mov ecx, dword [0x1400c15d4]
mov rax, qword [0x1400c15d8]
mov qword [rax + rcx*8], rdx
inc dword [0x1400c15d4]
mov eax, ebx
mov rcx, qword [r14 + rax*8]
mov eax, dword [rcx + 0x18]
test eax, eax
jne 0x14001fef7
mov rcx, qword [rcx + 0x20]
call fcn.14001faa0
jmp 0x14001ff27
cmp eax, 1
jne 0x14001ff27
cmp qword [0x1400c1598], rbp
mov rdx, qword [rcx + 0x20]
jne 0x14001ff13
mov rax, qword [rdx]
mov qword [0x1400c1598], rax
cmp qword [0x1400c15a8], rbp
jne 0x14001ff27
mov rax, qword [rdx + 8]
mov qword [0x1400c15a8], rax
inc ebx
cmp qword [r14 + rbx*8], rbp
jne 0x14001fe50
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
mov dword [0x1400c1578], ebp
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1400242d0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1400c15a4], 0
jne 0x140024322
lea rcx, str.HWLOC_XML_VERBOSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002430d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x1400c15a0], eax
mov dword [0x1400c15a4], 1
add rsp, 0x28
ret
mov eax, dword [0x1400c15a0]
mov dword [0x1400c15a4], 1
add rsp, 0x28
ret
mov eax, dword [0x1400c15a0]
add rsp, 0x28
ret

Function at 0x140024330
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1400c15bc], 0
jne 0x14002439f
lea rcx, str.HWLOC_LIBXML
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140024376
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
xor ecx, ecx
mov dword [0x1400c15bc], 1
test eax, eax
sete cl
mov dword [0x1400c15b0], ecx
mov eax, ecx
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML_IMPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14002434f
mov ecx, dword [0x1400c15b0]
mov eax, ecx
mov dword [0x1400c15bc], 1
add rsp, 0x28
ret
mov eax, dword [0x1400c15b0]
add rsp, 0x28
ret

Function at 0x1400243b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1400c1594], 0
jne 0x14002441f
lea rcx, str.HWLOC_LIBXML
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400243f6
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
xor ecx, ecx
mov dword [0x1400c1594], 1
test eax, eax
sete cl
mov dword [0x1400c15b4], ecx
mov eax, ecx
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML_EXPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400243cf
mov ecx, dword [0x1400c15b4]
mov eax, ecx
mov dword [0x1400c1594], 1
add rsp, 0x28
ret
mov eax, dword [0x1400c15b4]
add rsp, 0x28
ret
Function at 0x14002b180
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x78
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx r9d, byte [rcx]
mov r13, r8
movzx eax, byte [0x14009ecd8]
mov r12, rdx
sub r9d, eax
jne 0x14002b1bf
movzx r9d, byte [rcx + 1]
movzx eax, byte [0x14009ecd9]
sub r9d, eax
mov qword [rsp + 0xb8], rsi
lea rbx, str._dev_stdin
test r9d, r9d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
lea rdx, [0x14009ecec]
cmovne rbx, rcx
mov qword [rsp + 0x60], r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
je 0x14002b2de
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov edi, 0x1000
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x14002b22c
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x14002b22c
mov eax, dword [rsp + 0x34]
inc eax
movsxd rdi, eax
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14002b2d5
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r15, rax
mov byte [rax + rsi], 0
cmp rax, rdi
jne 0x14002b2b3
nop dword [rax]
nop word [rax + rax]
add rdi, rdi
mov rcx, rsi
lea rdx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r14, rax
test rax, rax
je 0x14002b2cc
mov rbx, rdi
lea rcx, [rax + r15]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r15, rax
mov byte [rsi + r15], 0
cmp rax, rbx
je 0x14002b270
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [r15 + 1]
mov qword [r12], rsi
mov qword [r13], rax
xor eax, eax
jmp 0x14002b2e1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
or eax, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140087840
add rsp, 0x78
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x140032da0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
xor r11d, r11d
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov r14, r9
mov rbx, rdx
mov r10, rcx
mov eax, r11d
cmp rdx, 2
jbe 0x140032e73
lea esi, [r11 + 4]
nop dword [rax + rax]
movzx edx, byte [r10]
sub rbx, 3
movzx r9d, byte [r10 + 1]
movzx ebp, dl
movzx edi, byte [r10 + 2]
movzx ecx, r9b
shr cl, 4
and dl, 3
and r9b, 0xf
shl dl, 4
add dl, cl
shl r9b, 2
movzx ecx, dil
shr bpl, 2
shr cl, 6
add r10, 3
add r9b, cl
and dil, 0x3f
cmp rsi, r14
ja 0x140032f1e
movzx ecx, bpl
add rsi, 4
movzx ecx, byte [rcx + r15]
mov byte [rax + r8], cl
movzx ecx, dl
movzx ecx, byte [rcx + r15]
mov byte [rax + r8 + 1], cl
movzx ecx, r9b
movzx ecx, byte [rcx + r15]
mov byte [rax + r8 + 2], cl
movzx ecx, dil
movzx ecx, byte [rcx + r15]
mov byte [rax + r8 + 3], cl
add rax, 4
cmp rbx, 2
ja 0x140032de0
test rbx, rbx
je 0x140032f3c
xor r9b, r9b
mov word [rsp + 0x29], r11w
xor dil, dil
mov byte [rsp + 0x28], r9b
xor dl, dl
test rbx, rbx
je 0x140032ec6
mov rdx, r11
nop word [rax + rax]
movzx ecx, byte [r10]
inc r11d
mov byte [rsp + rdx + 0x28], cl
inc r10
mov edx, r11d
cmp rdx, rbx
jb 0x140032ea0
movzx edi, byte [rsp + 0x2a]
movzx edx, byte [rsp + 0x29]
movzx r9d, byte [rsp + 0x28]
movzx ecx, dl
shr dil, 6
movzx r10d, r9b
shr cl, 4
and r9b, 3
shr r10b, 2
and dl, 0xf
shl r9b, 4
shl dl, 2
add r9b, cl
lea rcx, [rax + 4]
add dl, dil
cmp rcx, r14
ja 0x140032f1e
movzx ecx, r10b
movzx ecx, byte [rcx + r15]
mov byte [rax + r8], cl
movzx ecx, r9b
movzx ecx, byte [rcx + r15]
mov byte [rax + r8 + 1], cl
cmp rbx, 1
jne 0x140032f23
mov byte [rax + r8 + 2], 0x3d
jmp 0x140032f30
or eax, 0xffffffff
jmp 0x140032f46
movzx ecx, dl
movzx ecx, byte [rcx + r15]
mov byte [rax + r8 + 2], cl
add rax, 3
mov byte [rax + r8], 0x3d
inc rax
cmp rax, r14
jae 0x140032f1e
mov byte [rax + r8], 0
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
pop r15
pop r14
pop rdi
ret
Function at 0x14003abd0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14003ad5a
cmp byte [rcx + 0x71], 0
je 0x14003ad5a
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x14003ac24
xor al, al
jmp 0x14003ad5c
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x40]
call fcn.140035c90
nop
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
lea rdx, [rsp + 0x40]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rsp + 0x40]
cmovae r8, rcx
mov r9, qword [rsp + 0x50]
add r9, rdx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x74]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003ac85
sub eax, 1
jne 0x14003ad02
jmp 0x14003ac89
mov byte [rbx + 0x71], 0
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
cmp r9, 0x10
cmovae rax, rcx
mov rdi, qword [rsp + 0x30]
sub rdi, rax
je 0x14003acde
lea rax, [rsp + 0x40]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rbx + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
cmp rdi, rax
jne 0x14003ad11
cmp byte [rbx + 0x71], 0
je 0x14003ad15
test rdi, rdi
jne 0x14003ac40
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rsp + 0x40]
call fcn.14003c750
jmp 0x14003ac36
sub eax, 2
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
je 0x14003ad15
xor bl, bl
jmp 0x14003ad17
mov bl, 1
cmp r9, 0x10
jb 0x14003ad55
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x14003ad50
test cl, 0x1f
jne 0x14003ad49
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003ad49
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14003ad49
mov rcx, rax
jmp 0x14003ad50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140087110
movzx eax, bl
jmp 0x14003ad5c
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140087840
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14003ebe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14003ec14
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14003ec00
ret

Function at 0x140045fe0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
xor r8d, r8d
lea r9, str.XMRSTAK_NOWAIT
xor edx, edx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv_s]
cmp qword [rsp + 0x38], 0
jne 0x140046029
call fcn.140040c50
mov rcx, rax
lea rdx, str.Press_any_key_to_exit.
call fcn.140045d60
call fcn.140045a00
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140051d60
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0x180
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rsi, rdx
mov qword [r11 + 0x20], rdi
mov rdi, rcx
mov qword [r11 - 0x20], r12
mov qword [rsp + 0x20], rdx
call fcn.140040a50
mov rcx, rax
call fcn.140049a80
mov r12, rax
call fcn.140040a50
mov rcx, rax
call fcn.140049bd0
mov rdi, qword [rdi + 0x138]
or rbp, 0xffffffffffffffff
test r12, r12
mov qword [rsp + 0x28], rax
cmove r12, rbp
xor r13d, r13d
mov rbx, qword [rdi]
xor r14d, r14d
cmp rbx, rdi
je 0x140051eb0
mov qword [rsp + 0x170], r15
nop word [rax + rax]
lea rsi, [rbx + 0x10]
mov r15, qword [rsi + 0x130]
mov rax, qword [rsi + 0x138]
test rax, rax
je 0x140051e69
call sub.MSVCP140.dll__Query_perf_frequency
mov rbp, rax
call sub.MSVCP140.dll__Query_perf_counter
cqo
idiv rbp
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbp
imul rdx, rcx, 0x3b9aca00
add rdx, rax
movabs rax, 0x112e0be826d694b3
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsi + 0x138]
sub rdx, rax
add rdx, 1
je 0x140051e69
cmp rdx, qword [rsp + 0x28]
jb 0x140051e82
cmp r15, r12
ja 0x140051e82
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x20]
mov rcx, rsi
call fcn.14004dce0
jmp 0x140051e87
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rbx]
lea rax, [r14 + 1]
inc r13
cmp r15, r12
cmovbe rax, r14
mov r14, rax
cmp rbx, rdi
jne 0x140051df0
mov r15, qword [rsp + 0x170]
or rbp, 0xffffffffffffffff
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
mov r12, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1b0]
mov rbx, qword [rsp + 0x1a0]
test rax, 0xfffffffffffffff8
jne 0x140051fa7
call fcn.140040890
cmp qword [rax + 0x130], 0xffffffffffffffff
je 0x140051f7f
call fcn.140040c50
mov rcx, rax
lea r8, str.All_pools_are_dead._Idling...
xor edx, edx
call fcn.140045c00
lea rax, [rsp + 0x130]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x138], rax
xor eax, eax
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x110], 0
mov word [rsp + 0x120], 0x100
mov qword [rsp + 0x128], rbp
call fcn.140040890
mov rcx, rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call fcn.140046280
cmp r14, r13
jne 0x140051fa3
call fcn.140040c50
mov rcx, rax
lea r8, str.All_pools_are_over_give_up_limit._Exiting.
xor edx, edx
call fcn.140045c00
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor al, al
jmp 0x140051fa9
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140087840
add rsp, 0x180
pop r14
pop r13
pop rbp
ret
Function at 0x1400578d0
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
call fcn.1400577d0
test eax, eax
jne 0x140057adb
call fcn.140040b50
cmp byte [rax + 0x24c], 0
jne 0x140057a14
call fcn.140040c50
mov rcx, rax
lea r8, str.The_miner_needs_to_run_as_administrator__but_you_passed___noUAC_option._Please_remove_it_or_set_use_slow_memory_to_always.
xor edx, edx
call fcn.140045c00
xor edi, edi
mov rbx, qword [0x1400bd140]
test rbx, rbx
jne 0x14005798b
mov ecx, 0x88
call fcn.1400870d4
mov rbx, rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x140057972
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
lea rcx, [rax + 0x38]
lea edx, [rdi + 2]
call sub.MSVCP140.dll__Mtx_init_in_situ
jmp 0x140057975
mov rbx, rdi
mov qword [0x1400bd140], rbx
mov rcx, rbx
call fcn.140045250
mov rbx, qword [0x1400bd140]
cmp qword [rbx + 0x10], rdi
jne 0x1400579f3
lea rsi, [rbx + 0x38]
mov qword [rsp + 0x28], rsi
mov rcx, rsi
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
je 0x1400579ad
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
mov byte [rsp + 0x30], 1
cmp qword [rbx + 0x10], 0
jne 0x1400579df
mov ecx, 0x78
call fcn.1400870d4
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x1400579db
mov rcx, rax
call fcn.1400494e0
mov rdi, rax
mov qword [rbx + 0x10], rdi
mov rcx, rsi
call sub.MSVCP140.dll__Mtx_unlock
test eax, eax
je 0x1400579f3
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov rcx, qword [rbx + 0x10]
call fcn.14004a000
cmp eax, 2
je 0x140057adb
mov ecx, 1
call fcn.140045fe0
jmp 0x140057adb
call fcn.140040b50
lea rbx, [rax + 0x270]
call fcn.140040b50
lea rsi, [rax + 0x250]
call fcn.1400577d0
test eax, eax
jne 0x140057adb
xor edx, edx
lea r8d, [rax + 0x6c]
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x44], 0x40
xor edi, edi
mov qword [rsp + 0x48], rdi
lea rax, str.runas
mov qword [rsp + 0x50], rax
cmp qword [rsi + 0x18], 0x10
jb 0x140057a76
mov rsi, qword [rsi]
mov qword [rsp + 0x58], rsi
cmp qword [rbx + 0x18], 0x10
jb 0x140057a85
mov rbx, qword [rbx]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], 5
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140057adb
call fcn.140040c50
mov rcx, rax
lea r8, str.This_window_has_been_opened_because_xmr_stak_needed_to_run_as_administrator.__It_can_be_safely_closed_now.
xor edx, edx
call fcn.140045c00
or edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140057db0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, r9
mov r11, r8
mov r10, rdx
mov rsi, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
mov r8, qword [rsi + 0x30]
and r8, r9
mov rbx, qword [rsi + 8]
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x140057e92
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140057e92
mov ecx, dword [r11]
nop dword [rax]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140057e60
cmp rbx, rax
jne 0x140057e50
jmp 0x140057e92
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rdi
call fcn.140087110
mov rax, qword [rsp + 0x78]
mov qword [rax], rbx
mov byte [rax + 8], 0
jmp 0x140057fc4
mov qword [rsp + 0x28], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140057ecc
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140057ee9
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140057f18
cmp rax, rbx
jne 0x140057ef4
mov qword [rdx + r8*8], rdi
jmp 0x140057f18
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140057f18
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14009fbc0]
test rax, rax
jns 0x140057f39
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140057f4a
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140057fb9
cmp rdx, 0x200
jae 0x140057f66
lea rdx, [rdx*8]
jmp 0x140057f78
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140057f78
add rdx, rdx
mov rcx, rsi
call fcn.14006adb0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140057fb4
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140057db0
cmp rbx, qword [rsp + 0x20]
jne 0x140057f92
mov r10, qword [rsp + 0x78]
mov qword [r10], rdi
mov byte [r10 + 8], 1
mov rax, r10
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret