joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4508b0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x450990
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00457d80]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00458380
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.004584d0
jmp fcn.004508b0
Function at 0x63d030
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.DLL_CreateEventA]
test rax, rax
mov qword [0x00b54bd0], rax
je 0x63d065
lea rcx, [0x00b54be0]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
lea r9, [rax + 0x60]
mov r8d, 0x3d
mov edx, 1
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x63d410
Capabilities:
Check mutex on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
lea r8, str.sfdkjjhgkdsfhgjkjjsd
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x63d4c0
lea rbx, [rsp + 0x30]
mov ecx, 2
call sub.msvcrt.dll_malloc
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, rbx
mov word [rax], dx
mov edx, 1
mov qword [rsp + 0x28], rax
call fcn.0063d670
mov rcx, rbx
call fcn.0063d520
test eax, eax
jne 0x63d4b0
lea rdi, [rsp + 0x60]
mov rdx, rbx
mov rcx, rdi
call fcn.0063e950
mov rcx, rdi
call fcn.0063e870
mov rcx, rdi
mov esi, eax
call fcn.0063e500
mov rcx, rbx
call fcn.0063d6b0
mov eax, esi
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
mov edx, eax
mov rcx, rbx
call fcn.0063d5b0
mov esi, eax
jmp 0x63d498
call sub.msvcrt.dll_rand
mov edx, 0x68db8bad
xor esi, esi
mov ecx, eax
imul edx
mov eax, ecx
sar eax, 0x1f
sar edx, 0xc
sub edx, eax
imul edx, edx, 0x2710
sub ecx, edx
imul ecx, ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, esi
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret

Function at 0x6443c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rcx
xor ecx, ecx
jmp qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
Function at 0x644470
Capabilities:
Manipulate user privileges

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
test cl, cl
jne 0x644483
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
mov dword [0x00b54c20], 2
call fcn.006441e0
test eax, eax
jne 0x64452d
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x64447b
lea rbx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov edx, 1
mov dword [rsp + 0x50], 0
mov rdi, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov qword [rsp + 0x20], rbx
call rdi
mov edx, dword [rsp + 0x50]
test edx, edx
jne 0x644540
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
call rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x64447b
call sub.ADVAPI32.dll_LsaClose
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_LocalFree]
call fcn.006441e0
test eax, eax
je 0x64447b
or dword [0x00b54c20], 1
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
mov ecx, 0x40
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov r9d, dword [rsp + 0x50]
mov edx, 1
mov qword [rsp + 0x20], rbx
mov rsi, rax
mov r8, rax
mov rcx, qword [rsp + 0x30]
call rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rsi, rsi
je 0x64447b
xor eax, eax
mov ecx, 6
mov rdi, rbx
rep stosq qword [rdi], rax
lea r9, [rsp + 0x38]
mov r8d, 0xf0fff
mov rdx, rbx
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
je 0x6445b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x64447b
lea rcx, str.SeLockMemoryPrivilege
call sub.msvcrt.dll_wcslen
mov rcx, qword [rsp + 0x38]
mov r9d, 1
lea edx, [rax + rax]
mov word [rsp + 0x40], dx
mov rdx, qword [rsi]
lea eax, [rax + rax + 2]
lea rbx, str.SeLockMemoryPrivilege
mov word [rsp + 0x42], ax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x644512
call sub.ADVAPI32.dll_LsaClose
jmp 0x64459f
Function at 0x682840
Capabilities:
Hash data using sha512

Disassembly:
push rdi
sub rsp, 0x40
test rcx, rcx
mov r8, rcx
je 0x68298e
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x682970
lea r9, [r8 + 0x40]
mov rax, rsp
xor ecx, ecx
mov byte [rsp], dl
mov qword [rsp + 0x12], 0
mov rdi, r9
mov word [rax + 0x1e], cx
mov ecx, 0x16
mov dword [rax + 0x1a], 0
mov qword [rsp + 0x20], 0
mov qword [rax + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rax + 0x38], 0
xor eax, eax
rep stosq qword [rdi], rax
mov rax, qword [0x00ae6620]
mov byte [rsp + 0x11], 0
mov qword [rsp + 1], 0x10100
mov qword [rsp + 9], 0
mov qword [r8], rax
mov rax, qword [0x00ae6628]
mov qword [r8 + 8], rax
mov rax, qword [0x00ae6630]
movdqu xmm0, xmmword [r8]
pxor xmm0, xmmword [rsp]
movups xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
mov rax, qword [0x00ae6638]
mov qword [r8 + 0x18], rax
mov rax, qword [0x00ae6640]
movdqu xmm0, xmmword [r8 + 0x10]
mov qword [r8 + 0x20], rax
mov rax, qword [0x00ae6648]
mov qword [r8 + 0x28], rax
mov rax, qword [0x00ae6650]
mov qword [r8 + 0x30], rax
mov rax, qword [0x00ae6658]
mov qword [r8 + 0x38], rax
pxor xmm0, xmmword [rsp + 0x10]
xor eax, eax
movups xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
pxor xmm0, xmmword [rsp + 0x20]
mov dword [r8 + 0xe4], edx
movups xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
pxor xmm0, xmmword [rsp + 0x30]
movups xmmword [r8 + 0x30], xmm0
add rsp, 0x40
pop rdi
ret
cmp byte [rcx + 0xe8], 0
je 0x682981
mov qword [rcx + 0x58], 0xffffffffffffffff
mov rax, 0xffffffffffffffff
mov qword [r8 + 0x50], rax
jmp 0x682966
mov eax, 0xffffffff
jmp 0x682966
Function at 0x6829a0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0xe8
test rcx, rcx
mov r10, rdx
mov rbx, rcx
mov rdx, r8
je 0x682b3e
lea rax, [r10 - 1]
cmp rax, 0x3f
ja 0x682b20
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x682b20
test r8, r8
je 0x682b20
lea r8, [rcx + 0x40]
xor eax, eax
mov ecx, 0x16
mov byte [rsp + 0x20], r10b
mov word [rsp + 0x3e], ax
mov rdi, r8
xor eax, eax
mov r8, r9
rep stosq qword [rdi], rax
mov rcx, qword [0x00ae6620]
mov byte [rsp + 0x21], r9b
mov qword [rsp + 0x22], 0x101
mov qword [rsp + 0x2a], 0
mov qword [rsp + 0x32], 0
mov qword [rbx], rcx
mov rcx, qword [0x00ae6628]
mov dword [rsp + 0x3a], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rbx + 8], rcx
mov rcx, qword [0x00ae6630]
mov qword [rsp + 0x50], 0
movdqu xmm0, xmmword [rbx]
pxor xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x58], 0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rcx
mov rcx, qword [0x00ae6638]
mov qword [rbx + 0x18], rcx
mov rcx, qword [0x00ae6640]
movdqu xmm0, xmmword [rbx + 0x10]
mov qword [rbx + 0x20], rcx
mov rcx, qword [0x00ae6648]
mov qword [rbx + 0x28], rcx
mov rcx, qword [0x00ae6650]
mov qword [rbx + 0x30], rcx
mov rcx, qword [0x00ae6658]
mov qword [rbx + 0x38], rcx
pxor xmm0, xmmword [rsp + 0x30]
mov ecx, 0x10
mov dword [rbx + 0xe4], r10d
lea r10, [rsp + 0x60]
mov rdi, r10
movups xmmword [rbx + 0x10], xmm0
movdqu xmm0, xmmword [rbx + 0x20]
pxor xmm0, xmmword [rsp + 0x40]
rep stosq qword [rdi], rax
movups xmmword [rbx + 0x20], xmm0
mov rcx, r10
movdqu xmm0, xmmword [rbx + 0x30]
pxor xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x30], xmm0
call sub.msvcrt.dll_memcpy
cmp qword [rbx + 0x50], 0
jne 0x682b14
mov r8d, pe_nt_image_headers64
mov rdx, rax
mov rcx, rbx
call fcn.00682560
xor eax, eax
add rsp, 0xe8
pop rbx
pop rdi
ret
cmp byte [rbx + 0xe8], 0
je 0x682b31
mov qword [rbx + 0x58], 0xffffffffffffffff
mov rax, 0xffffffffffffffff
mov qword [rbx + 0x50], rax
jmp 0x682b16
mov eax, 0xffffffff
jmp 0x682b16
Function at 0x6841b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r14, qword [0x00afa0f0]
xor r13d, r13d
movabs rax, 0x5851f42d4c957f2d
lea rbp, [rcx + 0x187a8]
mov r12, rdx
mov rsi, rcx
lea rdx, [r8 + 1]
imul rax, rdx
movabs rdx, 0x810a978a59f5a1fc
lea rdi, [rsp + 0x20]
xor rdx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa77099df38c2d846
xor rdx, rax
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8126b91cbf22495c
xor rdx, rax
mov qword [rsp + 0x38], rdx
movabs rdx, 0x494d2597179f8a62
xor rdx, rax
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9237efb9ceaaec0c
xor rdx, rax
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2f2a56746ce62d78
xor rdx, rax
mov qword [rsp + 0x50], rdx
movabs rdx, 0x84853bf7b62ce54e
xor rax, rdx
mov qword [rsp + 0x58], rax
mov eax, dword [r14 + 0x18]
test eax, eax
je 0x684317
nop dword [rax]
mov eax, dword [r14]
mov rcx, rdi
shl eax, 0xa
shr eax, 6
lea ebx, [rax - 1]
mov eax, r13d
add r13d, 1
imul rax, rax, 0x1878
and rbx, r8
mov r8, rbp
shl rbx, 6
add rbx, qword [rsi]
lea r15, [rsi + rax + 0x28]
prefetchnta byte [rbx]
mov rdx, r15
call fcn.00684b50
mov rax, qword [rbx]
xor qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
xor qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
xor qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x18]
xor qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x20]
xor qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x28]
xor qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x30]
xor qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x38]
xor qword [rsp + 0x58], rax
movsxd rax, dword [r15 + 0x1814]
cmp dword [r14 + 0x18], r13d
mov r8, qword [rsp + rax*8 + 0x20]
ja 0x684280
mov rax, qword [rsp + 0x20]
mov qword [r12], rax
mov rax, qword [rsp + 0x28]
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [r12 + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [r12 + 0x18], rax
mov rax, qword [rsp + 0x40]
mov qword [r12 + 0x20], rax
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [r12 + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [r12 + 0x38], rax
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6895f0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov ecx, dword [rcx + 0x30]
mov byte [rsp + 0x60], r8b
mov rsi, rdx
mov eax, dword [rbx + 0x38]
xor edx, edx
mov byte [rsp + 0x68], r9b
mov r8d, ecx
add r8d, eax
setb dl
add edx, dword [rbx + 0x34]
cmp eax, 0x1b8
bswap edx
mov dword [rsp + 0x28], edx
mov edx, r8d
bswap edx
mov dword [rsp + 0x2c], edx
je 0x6897d0
cmp eax, 0x1b7
jg 0x689781
test eax, eax
je 0x689775
sub r8d, 0x1b8
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 0x1b8
lea rdx, [0x00ae9c20]
sub r8d, eax
movsxd r8, r8d
call fcn.00689430
lea rdx, [rsp + 0x68]
mov r8d, 8
mov rcx, rbx
call fcn.00689430
mov eax, dword [rbx + 0x30]
sub eax, 8
sub eax, 0x40
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 0x30], eax
lea rdx, [rsp + 0x28]
call fcn.00689430
mov eax, dword [rbx]
shr eax, 0x18
mov byte [rsi], al
mov eax, dword [rbx]
shr eax, 0x10
mov byte [rsi + 1], al
mov eax, dword [rbx]
mov byte [rsi + 2], ah
mov eax, dword [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, word [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
mov byte [rsi + 6], ah
mov eax, dword [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, word [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
mov byte [rsi + 0xa], ah
mov eax, dword [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, word [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xe], ah
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, word [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x12], ah
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rbx + 0x17]
mov byte [rsi + 0x14], al
movzx eax, word [rbx + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x16], ah
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rbx + 0x1b]
mov byte [rsi + 0x18], al
movzx eax, word [rbx + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1a], ah
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rbx + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, word [rbx + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1e], ah
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1f], al
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rbx + 0x3c], 1
jmp 0x689647
sub r8d, 0x200
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 0x200
lea rdx, [0x00ae9c20]
sub r8d, eax
movsxd r8, r8d
call fcn.00689430
mov r8d, 0x1b8
mov rcx, rbx
sub dword [rbx + 0x30], 0x1b8
lea rdx, [0x00ae9c21]
call fcn.00689430
mov dword [rbx + 0x3c], 1
jmp 0x68966d
lea rdx, [rsp + 0x60]
sub ecx, 8
mov r8d, 8
mov dword [rbx + 0x30], ecx
mov rcx, rbx
call fcn.00689430
mov eax, dword [rbx + 0x30]
jmp 0x689686
Function at 0x689830
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rbx
sub rsp, 0xb8
movdqa xmm0, xmmword [0x00ae9db0]
lea rsi, [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
shl r8, 3
mov rbx, rcx
movdqa xmm0, xmmword [0x00ae9dc0]
mov rcx, rsi
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
movaps xmmword [rsp + 0x40], xmm0
pxor xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
call fcn.00689430
mov ecx, dword [rsp + 0x60]
xor edx, edx
mov byte [rsp + 0x26], 0x81
mov eax, dword [rsp + 0x68]
mov byte [rsp + 0x27], 1
mov r8d, ecx
add r8d, eax
setb dl
add edx, dword [rsp + 0x64]
cmp eax, 0x1b8
bswap edx
mov dword [rsp + 0x28], edx
mov edx, r8d
bswap edx
mov dword [rsp + 0x2c], edx
je 0x6899e1
cmp eax, 0x1b7
jg 0x689990
test eax, eax
je 0x689980
sub r8d, 0x1b8
mov rcx, rsi
mov dword [rsp + 0x60], r8d
mov r8d, 0x1b8
lea rdx, [0x00ae9c20]
sub r8d, eax
movsxd r8, r8d
call fcn.00689430
lea rdx, [rsp + 0x27]
mov r8d, 8
mov rcx, rsi
call fcn.00689430
mov eax, dword [rsp + 0x60]
sub eax, 8
sub eax, 0x40
mov r8d, 0x40
mov rcx, rsi
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x60], eax
call fcn.00689430
mov eax, dword [rsp + 0x30]
bswap eax
mov dword [rbx], eax
mov eax, dword [rsp + 0x34]
bswap eax
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x38]
bswap eax
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x3c]
bswap eax
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x40]
bswap eax
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x44]
bswap eax
mov dword [rbx + 0x14], eax
mov eax, dword [rsp + 0x48]
bswap eax
mov dword [rbx + 0x18], eax
mov eax, dword [rsp + 0x4c]
bswap eax
mov dword [rbx + 0x1c], eax
add rsp, 0xb8
pop rbx
pop rsi
ret
mov dword [rsp + 0x6c], 1
jmp 0x6898d0
sub r8d, 0x200
mov rcx, rsi
mov dword [rsp + 0x60], r8d
mov r8d, 0x200
lea rdx, [0x00ae9c20]
sub r8d, eax
movsxd r8, r8d
call fcn.00689430
mov r8d, 0x1b8
mov rcx, rsi
sub dword [rsp + 0x60], 0x1b8
lea rdx, [0x00ae9c21]
call fcn.00689430
mov dword [rsp + 0x6c], 1
jmp 0x6898f7
lea rdx, [rsp + 0x26]
sub ecx, 8
mov r8d, 8
mov dword [rsp + 0x60], ecx
mov rcx, rsi
call fcn.00689430
mov eax, dword [rsp + 0x60]
jmp 0x689911
Function at 0x69238d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
movdqu xmm0, xmmword [rcx + rax]
movdqu xmm1, xmmword [rdx + rax]
pxor xmm0, xmm1
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, 0x400
jne 0x69238f
ret
Function at 0x699380
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00b58d68]
test eax, eax
je 0x6993a0
mov eax, dword [0x00b58d64]
add rsp, 0x28
ret
lea rcx, str.HWLOC_HIDE_ERRORS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6993d0
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [0x00b58d64], eax
mov dword [0x00b58d68], 1
add rsp, 0x28
ret
mov eax, dword [0x00b58d64]
jmp 0x6993bf
Function at 0x6a1740
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x9c], 1
mov dword [rcx + 0x29c], 1
mov rbx, rcx
jne 0x6a1767
mov dword [rcx + 0x29c], 0
lea rcx, str.HWLOC_GROUPING
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6a17a0
mov rcx, rax
call sub.msvcrt.dll_atoi
test eax, eax
jne 0x6a17a0
mov dword [rbx + 0x29c], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x29c]
test eax, eax
je 0x6a178e
movabs rax, 0x3c23d70a00000000
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov dword [rbx + 0x2a4], 5
mov qword [rbx + 0x2a8], rax
movabs rax, 0x3d4ccccd3ca3d70a
mov qword [rbx + 0x2b0], rax
mov qword [rbx + 0x2b8], 0x3dcccccd
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6a1870
mov ecx, 4
lea rdi, [0x00aed138]
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
seta dl
sbb dl, 0
test dl, dl
jne 0x6a1842
mov dword [rbx + 0x2a0], 0
lea rcx, str.HWLOC_GROUPING_VERBOSE
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6a178e
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rbx + 0x2a0], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rbx + 0x2a4], 1
mov rcx, rax
call sub.msvcrt.dll_atof
pxor xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss dword [rbx + 0x2a8], xmm1
jmp 0x6a180d
mov dword [rbx + 0x2a4], 1
jmp 0x6a180d
Function at 0x6a3610
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x2c0]
mov dword [rcx + 0xb4], 1
mov rsi, rcx
test rbx, rbx
je 0x6a36c1
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
mov eax, dword [rbx + 0x10]
test eax, eax
jne 0x6a3664
mov eax, dword [rbx + 0x24]
cmp eax, 0xffffffff
je 0x6a3664
test eax, eax
jne 0x6a36f0
mov dword [rsi + 0xb4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x6a3643
mov rbx, qword [rsi + 0x2c0]
test byte [rsi + 0x20], 2
jne 0x6a3724
test rbx, rbx
je 0x6a36c1
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
jmp 0x6a369c
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x6a36c1
cmp dword [rbx + 0x10], 1
jne 0x6a3693
mov eax, dword [rbx + 0x24]
cmp eax, 0xffffffff
je 0x6a3693
test eax, eax
jne 0x6a3710
mov dword [rsi + 0xb4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x6a369c
lea rcx, str.HWLOC_THISSYSTEM
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6a36e0
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rsi + 0xb4], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x2d8
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6a365a
mov r8d, 0x2e6
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6a36ae
mov dword [rsi + 0xb4], 1
jmp 0x6a367e
Function at 0x6a8150
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, rcx
lea rcx, str.HWLOC_PCI_LOCALITY
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
je 0x6a81de
mov dword [rdi + 0x2fc], 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open]
mov esi, eax
test eax, eax
js 0x6a81f0
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__fstat64]
cmp eax, 0xffffffff
je 0x6a81d5
mov rbp, qword [rsp + 0x38]
test eax, eax
jne 0x6a81d5
cmp ebp, 0x10000
jg 0x6a8205
lea ecx, [rbp + 1]
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
mov r8d, ebp
mov ecx, esi
mov rbx, rax
mov rdx, rax
call qword [sym.imp.msvcrt.dll__read]
cmp eax, ebp
je 0x6a8230
mov rcx, rbx
call fcn.00701710
mov ecx, esi
call qword [sym.imp.msvcrt.dll__close]
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rbx
mov rcx, rdi
call fcn.006a79d0
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 2
call qword [fcn.00701940]
mov r9d, ebp
mov r8, rbx
lea rdx, str.Ignoring_HWLOC_PCI_LOCALITY_file___s_too_large___lu_bytes__n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6a81d5
cdqe
mov rdx, rbx
mov rcx, rdi
mov byte [rbx + rax], 0
call fcn.006a79d0
jmp 0x6a81cd
Function at 0x6aaa30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x88], rdx
mov edx, 0x29
mov ebx, r8d
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x20], rcx
call sub.msvcrt.dll_strchr
mov r8, qword [rsp + 0x20]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6aaca2
movzx eax, byte [r8]
xor r15d, r15d
xor r13d, r13d
xor r14d, r14d
lea rbp, [0x00aeea5e]
lea r12, [0x00aeea50]
cmp al, 0x29
je 0x6aab22
lea eax, [rbx - 4]
cmp eax, 7
jbe 0x6aabb0
mov ecx, 7
lea rsi, str.memory
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x6aac10
mov ecx, 8
mov rsi, rbp
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x6aac31
lea r13, [r8 + 8]
lea rdx, [0x00aeea67]
mov rcx, r13
mov qword [rsp + 0x80], r13
call sub.msvcrt.dll_strcspn
lea rsi, [r13 + rax]
mov r15, rax
mov qword [rsp + 0x80], rsi
movzx eax, byte [rsi]
cmp al, 0x20
je 0x6aabf1
cmp al, 0x29
jne 0x6aac52
mov rax, qword [rsp + 0x98]
mov qword [rax], r14
test r13, r13
je 0x6aab86
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
je 0x6aab70
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x6aab70
mov ecx, 2
call qword [fcn.00701940]
mov r8d, 0x3c
mov edx, 1
lea rcx, str.Overwriting_duplicate_indexes_attribute_with_last_occurence_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rsp + 0xa0]
mov qword [rax], r13
mov rax, qword [rsp + 0xa8]
mov dword [rax], r15d
mov r15, qword [rsp + 0x28]
mov rax, qword [rsp + 0x88]
add r15, 1
mov qword [rax], r15
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 5
mov rsi, r12
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x6aaaca
lea rcx, [r8 + 5]
lea rdx, [rsp + 0x80]
call fcn.006a9200
mov rsi, qword [rsp + 0x80]
mov r14, rax
movzx eax, byte [rsi]
cmp al, 0x20
jne 0x6aab1a
lea r8, [rsi + 1]
mov qword [rsp + 0x80], r8
movzx eax, byte [rsi + 1]
jmp 0x6aaa98
lea rcx, [r8 + 7]
lea rdx, [rsp + 0x80]
call fcn.006a9200
mov rsi, qword [rsp + 0x80]
mov r14, rax
jmp 0x6aab0f
mov ecx, dword [rsp + 0xb0]
test ecx, ecx
jne 0x6aac7c
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x6aab9c
mov edx, dword [rsp + 0xb0]
test edx, edx
je 0x6aac3c
mov ecx, 2
call qword [fcn.00701940]
mov r8, rsi
lea rdx, str.Missing_parameter_separator_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6aac3c
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.00701940]
mov r8, qword [rsp + 0x20]
lea rdx, str.Unknown_attribute_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6aac3c
mov r9d, dword [rsp + 0xb0]
test r9d, r9d
je 0x6aac3c
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.00701940]
mov r8, qword [rsp + 0x20]
lea rdx, str.Missing_attribute_closing_bracket_in_synthetic_string_doesnt_have_a_number_of_objects_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6aac3c