joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076b50
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14021bba8]
mov ecx, dword [0x14020daa8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140076b8b
movzx eax, word [0x14021bb78]
cmp eax, 9
jne 0x140076bd3
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x14021bba8]
call fcn.1401099f0
cmp dword [0x14021bba8], 0xffffffff
jne 0x140076b75
xorps xmm0, xmm0
movups xmmword [0x14021bb98], xmm0
movups xmmword [0x14021bb88], xmm0
movups xmmword [0x14021bb78], xmm0
lea rcx, [0x14021bb78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14021bba8]
call fcn.140109a88
jmp 0x140076b75
test eax, eax
je 0x140076b86
cmp eax, 6
jne 0x140076be3
mov eax, 2
jmp 0x140076b86
cmp eax, 0xc
jne 0x140076bef
mov eax, 3
jmp 0x140076b86
mov eax, 4
jmp 0x140076b86

Function at 0x140077470
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x50]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x1401cd260]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x1b
call fcn.1400ea6a0
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1400dfba0
mov rcx, rsi
call fcn.1400dcc10
test al, al
je 0x1400775ed
mov rcx, rsi
call fcn.14005d870
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
cmp qword [rsi + 0x40], rax
je 0x14007756b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x140077616
mov rax, rdi
inc rax
cmp rax, 2
jb 0x14007755f
mov qword [rsi + 0x40], rdi
call fcn.1400ea6c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x40]
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140077631
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, qword [rsi + 0x30]
movabs rbx, 0xfffffffc00000000
mov rax, rcx
and rax, rbx
cmp rax, qword [0x1401fde88]
je 0x140077635
and rbx, rdi
cmp rbx, qword [0x1401fde88]
je 0x14007763f
mov qword [rsi + 0x30], rdi
test rdi, rdi
je 0x140077631
lea rax, fcn.140154530
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], rdi
call fcn.140086d50
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.1400dfe10
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14010aeb0
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400ea6c0
mov rcx, qword [rsi + 0x40]
call fcn.1400dc150
mov qword [rsi + 0x40], 0
jmp 0x14007754a
xor edi, edi
jmp 0x1400775ed
call fcn.1400bee40
jmp 0x1400775b6
mov rcx, rdi
call fcn.1400be940
jmp 0x1400775c2
Function at 0x1400867f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x1400867c0]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14021be08]
lea rdx, [0x140086660]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140086900
cmp dword [0x14021be10], 0
jne 0x1400868f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x14021be14]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x14008689c
mov ecx, 1
mov edx, 0x28
call fcn.1400bb2a0
test rax, rax
je 0x1400868f0
mov r14, rax
mov ecx, dword [0x14021be14]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400868e8
lea r15, [0x14021be18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x14021be20]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010aeb0
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, r14
call fcn.1400bb200
mov rcx, rsi
mov rax, rdi
call qword [0x14022e008]
xor esi, esi
jmp 0x1400868cc
call fcn.14011f540
int3

Function at 0x140087330
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x140087340
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x140087361
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x140087381
cmp byte [r14 + 0x68], 0
jne 0x140087403
or edi, 0x20000000
test dil, 8
jne 0x140087437
xor r15d, r15d
cmp byte [r14 + 0x70], 0
mov r12d, 0
je 0x14008739f
mov r12, qword [r14 + 0x78]
cmp byte [r14 + 0x50], 0
mov r13d, 0
je 0x1400873b0
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x28], 0
jne 0x140087418
cmp byte [r14], 0
jne 0x140087426
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x140087457
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x14008740e
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x140087381
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400873ee
lea rcx, [r14 + 0x30]
call fcn.14005d870
mov r15, rax
jmp 0x1400873b7
add r14, 8
mov rcx, r14
call fcn.14005d870
mov r9, rax
jmp 0x1400873c0
cmp byte [r14 + 0x88], 0
je 0x14008744c
or edi, 0x40000000
jmp 0x14008738b
or edi, 0x10000000
jmp 0x14008738b
cmp ebx, 4
jne 0x140087466
mov edx, 6
jmp 0x1400873cd
lea eax, [rbx - 2]
cmp eax, 2
jae 0x140087478
mov edx, 7
jmp 0x1400873cd
cmp ebx, 1
jne 0x140087487
mov edx, 4
jmp 0x1400873cd
xor edx, edx
jmp 0x1400873cd
Function at 0x140087340
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x140087340
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x140087361
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x140087381
cmp byte [r14 + 0x68], 0
jne 0x140087403
or edi, 0x20000000
test dil, 8
jne 0x140087437
xor r15d, r15d
cmp byte [r14 + 0x70], 0
mov r12d, 0
je 0x14008739f
mov r12, qword [r14 + 0x78]
cmp byte [r14 + 0x50], 0
mov r13d, 0
je 0x1400873b0
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x28], 0
jne 0x140087418
cmp byte [r14], 0
jne 0x140087426
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x140087457
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x14008740e
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x140087381
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400873ee
lea rcx, [r14 + 0x30]
call fcn.14005d870
mov r15, rax
jmp 0x1400873b7
add r14, 8
mov rcx, r14
call fcn.14005d870
mov r9, rax
jmp 0x1400873c0
cmp byte [r14 + 0x88], 0
je 0x14008744c
or edi, 0x40000000
jmp 0x14008738b
or edi, 0x10000000
jmp 0x14008738b
cmp ebx, 4
jne 0x140087466
mov edx, 6
jmp 0x1400873cd
lea eax, [rbx - 2]
cmp eax, 2
jae 0x140087478
mov edx, 7
jmp 0x1400873cd
cmp ebx, 1
jne 0x140087487
mov edx, 4
jmp 0x1400873cd
xor edx, edx
jmp 0x1400873cd

Function at 0x140087490
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400874c8
cmp byte [r15 + 0x68], 0
jne 0x140087556
or edi, 0x20000000
test dil, 8
jne 0x14008758d
xor r14d, r14d
cmp byte [r15 + 0x70], 0
mov r12d, 0
je 0x1400874e6
mov r12, qword [r15 + 0x78]
cmp byte [r15 + 0x50], 0
mov r13d, 0
je 0x1400874f7
mov r13, qword [r15 + 0x58]
cmp byte [r15 + 0x28], 0
jne 0x14008756b
cmp byte [r15], 0
jne 0x140087579
xor r9d, r9d
cmp ebx, 4
jne 0x140087547
mov edx, 6
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x140087561
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400875ad
mov edx, 7
jmp 0x140087511
or edi, 0x80000000
jmp 0x1400874c8
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140087532
lea rcx, [r15 + 0x30]
call fcn.14005d870
mov r14, rax
jmp 0x1400874fe
add r15, 8
mov rcx, r15
call fcn.14005d870
mov r9, rax
jmp 0x140087507
cmp byte [r15 + 0x88], 0
je 0x1400875a2
or edi, 0x40000000
jmp 0x1400874d2
or edi, 0x10000000
jmp 0x1400874d2
mov edx, 1
test ebx, ebx
je 0x140087511
cmp ebx, 1
jne 0x1400875c9
mov edx, 4
jmp 0x140087511
xor edx, edx
jmp 0x140087511
Function at 0x14008c170
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x14008c198
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14008c1d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14008c1f3
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14010aeb0
mov rcx, rsi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.14008c2d0
mov sil, 1
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14010aeb0
mov eax, esi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ea5c0
test al, al
jne 0x14008c205
xor esi, esi
jmp 0x14008c1d6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x266
mov r9d, 2
call fcn.14017cef0
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140147010
mov rdi, rax
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14008c255
and r8d, 0x7f
jmp 0x14008c25c
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.1400b6570
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
call fcn.1400e1890
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14008c28c
and r8d, 0x7f
jmp 0x14008c296
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140147010
cmp byte [rsp + 0x57], 0
jns 0x14008c2b2
mov rcx, qword [rsp + 0x40]
call fcn.1401098c8
lea rcx, [rsp + 0x58]
call fcn.14017cf70
jmp 0x14008c201
Function at 0x14008c2d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rsi, rcx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
cmp byte [rcx + 0x17], 0
jns 0x14008c2f8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008c327
mov dil, 1
test al, 0x10
je 0x14008c33d
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14010aeb0
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ea5c0
test al, al
jne 0x14008c413
xor edi, edi
jmp 0x14008c30a
mov ecx, 2
call fcn.1400ea5c0
test al, al
je 0x14008c339
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x255
mov r9d, 2
call fcn.140066750
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140147010
mov rdi, rax
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14008c392
and r8d, 0x7f
jmp 0x14008c399
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.1400b6570
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov rdx, rbx
call fcn.1400e1890
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14008c3c9
and r8d, 0x7f
jmp 0x14008c3d3
mov r8, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rcx, rdi
mov rdx, rsi
call fcn.140147010
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.140147010
cmp byte [rsp + 0x67], 0
jns 0x14008c404
mov rcx, qword [rsp + 0x50]
call fcn.1401098c8
lea rcx, [rsp + 0x68]
call fcn.140066c80
jmp 0x14008c339
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x251
mov r9d, 2
call fcn.14017cef0
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140147010
mov rdi, rax
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14008c463
and r8d, 0x7f
jmp 0x14008c46a
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov rdx, rsi
call fcn.1400b6570
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov rdx, rbx
call fcn.1400e1890
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14008c49a
and r8d, 0x7f
jmp 0x14008c4a4
mov r8, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rcx, rdi
mov rdx, rsi
call fcn.140147010
cmp byte [rsp + 0x67], 0
jns 0x14008c4c0
mov rcx, qword [rsp + 0x50]
call fcn.1401098c8
lea rcx, [rsp + 0x68]
call fcn.14017cf70
jmp 0x14008c339
Function at 0x14008da90
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14008c560
mov rax, qword [rsi]
test rax, rax
je 0x14008db07
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14008db0e
lea rcx, [rsp + 0x28]
call fcn.14008d110
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010aeb0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14008dae0
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x14008db26
add rbx, 0x70
cmp rbx, r15
je 0x14008dae0
jmp 0x14008db15
cmp byte [rbx + 0x27], 0
js 0x14008db32
lea rcx, [rbx + 0x10]
jmp 0x14008db36
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
jne 0x14008db1b
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
je 0x14008db5c
mov rcx, r14
mov rdx, rbx
call fcn.14008ea60
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14008db1b
mov rcx, rdi
mov rdx, rbx
call fcn.14008e890
jmp 0x14008db1b

Function at 0x14008db70
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14008c560
mov rax, qword [rsi]
test rax, rax
je 0x14008dbe7
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14008dbee
lea rcx, [rsp + 0x28]
call fcn.14008d110
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010aeb0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14008dbc0
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x14008dc2f
cmp byte [rbx + 0x27], 0
js 0x14008dc07
lea rcx, [rbx + 0x10]
jmp 0x14008dc0b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
jne 0x14008dc2f
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
je 0x14008dc3a
mov rcx, r14
mov rdx, rbx
call fcn.14008ea60
add r14, 0x68
mov qword [rdi + 8], r14
add rbx, 0x70
cmp rbx, r15
je 0x14008dbc0
jmp 0x14008dbf5
mov rcx, rdi
mov rdx, rbx
call fcn.14008e890
jmp 0x14008dc2f
Function at 0x14009bda0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14020d880]
cmp ecx, 0xffffffff
je 0x14009be7a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14009be7a
mov eax, dword [0x14021d7b0]
mov ecx, dword [0x14020daa8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009be84
mov rbx, qword [0x14021d7a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14009beca
mov rax, qword [0x14021bf98]
inc rax
xor ecx, ecx
lea rdx, [0x14021bfa0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14009bed7
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x14021d7a0]
inc ecx
mov dword [0x14021d7a0], ecx
mov dword [rax + 0x14], ecx
mov qword [0x14021bf98], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14009beec
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14009bef0
jmp 0x14009bdca
lea rcx, [0x14021d7b0]
call fcn.1401099f0
cmp dword [0x14021d7b0], 0xffffffff
jne 0x14009bdef
mov ecx, 8
call fcn.140109878
mov rbx, rax
mov rcx, rax
call fcn.1400d5bc0
mov qword [0x14021d7a8], rbx
lea rcx, [0x14021d7b0]
call fcn.140109a88
jmp 0x14009bdef
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x14009be07
inc rcx
cmp rcx, 0x100
jne 0x14009be1a
jmp 0x14009be60
int3

Function at 0x14009bef0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14010ae50
sub rsp, rax
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x14020d880]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x14009bfa4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14009c007
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14010cff0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14010990c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14010c940
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14010aeb0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1400a7e30
test al, al
je 0x14009c00a
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x14009bfe2
mov eax, 0xffffffff
lock cmpxchg dword [0x14020d880], ecx
je 0x14009bf28
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x14020d880]
mov dword [rsp + 0x2c], ecx
jmp 0x14009bf28
lea rcx, [rsp + 0x2c]
call fcn.1400a7e30
test al, al
je 0x14009c00d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14009c00d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x14009bfbb
int3
int3
int3
Function at 0x14009c020
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x14020d880]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x14009c069
and rax, 0xfffffffffffffffc
je 0x14009c09c
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x14009c09c
mov rsi, qword [rax + rcx]
jmp 0x14009c09e
lea rdx, [0x1401e7dfd]
lea r8, str....._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r9d, 0x1f6
call fcn.1400ea6a0
movabs rdx, 0x141dd76000
mov rcx, rsi
call fcn.14017def0
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010aeb0
mov rax, rsi
add rsp, 0x50
pop rsi
ret

Function at 0x14009c0c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14020d880]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14009c0fe
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14009c0f7
call fcn.14009bef0
jmp 0x14009c0de

Function at 0x1400a0190
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400a01f0
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x1400a01f9
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010aeb0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x1400a01d9
int3
mov rcx, qword [rcx + 8]
jmp 0x1400a0190

Function at 0x1400a0200
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x1400a02a3
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1400a0292
cmp eax, 0xffffffff
je 0x1400a02b7
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010aeb0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x1400a0241
mov eax, dword [rsp + 0x2c]
jmp 0x1400a0272
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400a0274
int3
Function at 0x1400a0790
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400a0690
test rax, rax
jne 0x1400a07cf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x1400a07eb
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14010aeb0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ea5c0
test al, al
jne 0x1400a07fd
xor esi, esi
jmp 0x1400a07cf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.14017cef0
lea rcx, [rsp + 0x40]
lea rdx, [0x1401e87eb]
mov r8d, 0xc
call fcn.140147010
mov rcx, rsi
call fcn.14017cf70
jmp 0x1400a07f9

Function at 0x1400a0ce0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400a01f0
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x1400a01f9
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010aeb0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x1400a01d9
int3
mov rcx, qword [rcx + 8]
jmp 0x1400a0190