joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21007dac0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x90
mov r12, rcx
mov rbx, rdx
mov esi, r8d
test rdx, rdx
js 0x21007dcdc
mov rax, qword [rcx]
lea rdi, [method.fhandler_base.get_handle__]
mov rax, qword [rax + 0x280]
cmp rax, rdi
jne 0x21007dcd0
cmp qword [rcx + 0x18], 0
je 0x21007dcdc
mov edx, dword [r12 + 0x80]
cmp edx, 0xffffffff
je 0x21007db20
and edx, 0x10
mov eax, 0x15
jne 0x21007dcbb
mov eax, 9
test byte [r12 + 0x13], 0x40
je 0x21007dcbb
mov rax, qword [r12]
mov rax, qword [rax + 0x280]
cmp rax, rdi
jne 0x21007dcf0
mov rcx, qword [r12 + 0x18]
lea r13, [rsp + 0x60]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea r8, [rsp + 0x70]
mov rdx, r13
call sym.NtQueryInformationFile
test eax, eax
js 0x21007dd20
test sil, sil
je 0x21007dd30
mov qword [rsp + 0x58], rbx
test byte [r12 + 0x118], 0x80
je 0x21007dc78
test byte [r12 + 0x88], 0x40
je 0x21007dc78
mov eax, dword [r12 + 0x80]
cmp eax, 0xffffffff
je 0x21007dbb4
test ah, 2
jne 0x21007dc78
mov rsi, qword [rsp + 0x78]
mov rax, qword [r12]
lea rdx, [rsi + 0x1ffff]
mov r8, qword [rax + 0x280]
cmp rdx, rbx
jge 0x21007dc7c
cmp r8, rdi
jne 0x21007dd6d
lea rax, [r12 + 0x18]
mov dword [rsp + 0x48], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x900c4
mov qword [rsp + 0x20], r13
mov rcx, qword [rax]
call sym.NtFsControlFile
mov ebx, eax
test eax, eax
js 0x21007dc33
or dword [r12 + 0x80], 0x200
test byte [0x210273880], 1
je 0x21007dc78
lea rcx, [r12 + 0x80]
xor edx, edx
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x20], ebx
mov edx, 0x10
lea r9, str._y__NtFsControlFile__S__FSCTL_SET_SPARSE_
mov qword [rsp + 0x28], rax
lea r8, str.virtual_int_fhandler_disk_file::ftruncate_off_t__bool_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
nop dword [rax + rax]
mov rax, qword [r12]
mov rax, qword [rax + 0x280]
cmp rax, rdi
jne 0x21007dd60
add r12, 0x18
mov dword [rsp + 0x20], 0x14
mov rcx, qword [r12]
mov r9d, 8
mov rdx, r13
lea r8, [rsp + 0x58]
call sym.NtSetInformationFile
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x21007dd50
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call rax
cmp qword [rax], 0
jne 0x21007db05
mov eax, 0x16
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, r12
lea r13, [rsp + 0x60]
call rax
mov r9d, 0x18
lea r8, [rsp + 0x70]
mov rdx, r13
mov dword [rsp + 0x20], 5
mov rcx, qword [rax]
call sym.NtQueryInformationFile
test eax, eax
jns 0x21007db72
mov edx, 0xd
mov ecx, eax
call sym.geterrno_from_nt_status_int__int_
jmp 0x21007dcbb
xor eax, eax
cmp qword [rsp + 0x78], rbx
jg 0x21007dcbb
mov qword [rsp + 0x58], rbx
mov rax, qword [r12]
jmp 0x21007dc7c
mov edx, 0xd
call sym.geterrno_from_nt_status_int__int_
jmp 0x21007dcbb
mov rcx, r12
call rax
mov r12, rax
jmp 0x21007dc90
mov rcx, r12
call r8
jmp 0x21007dbe2
Function at 0x21007dd80
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
mov eax, 0x16
mov r12, rcx
mov ebx, r9d
cmp r9d, 5
ja 0x21007de43
xor eax, eax
test rdx, rdx
jne 0x21007de43
mov rax, qword [rcx]
lea rdi, [method.fhandler_base.get_handle__]
mov rax, qword [rax + 0x280]
cmp rax, rdi
jne 0x21007de80
mov rcx, qword [rcx + 0x18]
lea rsi, [rsp + 0x3c]
mov dword [rsp + 0x20], 0x10
lea r13, [rsp + 0x40]
mov r9d, 4
mov r8, rsi
mov rdx, r13
call sym.NtQueryInformationFile
test eax, eax
js 0x21007deb0
mov eax, dword [rsp + 0x3c]
and eax, 0xfffffffb
cmp ebx, 1
jne 0x21007de03
or eax, 4
mov dword [rsp + 0x3c], eax
mov rax, qword [r12]
mov rax, qword [rax + 0x280]
cmp rax, rdi
jne 0x21007ded0
mov rcx, qword [r12 + 0x18]
mov r9d, 4
mov r8, rsi
mov rdx, r13
mov dword [rsp + 0x20], 0x10
call sym.NtSetInformationFile
mov r12d, eax
xor eax, eax
test r12d, r12d
js 0x21007de50
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, r12d
mov edx, 0x45f
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_disk_file.cc
call sym.seterrno_from_nt_status_char_const__int__int_
mov edx, 0xd
mov ecx, r12d
call sym.geterrno_from_nt_status_int__int_
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call rax
mov dword [rsp + 0x20], 0x10
lea rsi, [rsp + 0x3c]
lea r13, [rsp + 0x40]
mov rcx, qword [rax]
mov r9d, 4
mov r8, rsi
mov rdx, r13
call sym.NtQueryInformationFile
test eax, eax
jns 0x21007ddf4
mov edx, 0xd
mov ecx, eax
call sym.geterrno_from_nt_status_int__int_
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, r12
call rax
mov dword [rsp + 0x20], 0x10
mov r8, rsi
mov rdx, r13
mov rcx, qword [rax]
mov r9d, 4
jmp 0x21007de34
Function at 0x210080400
Capabilities:
Get file attributes
Read file on windows

Disassembly:
push r14
push r13
push r12
sub rsp, 0x30
mov rax, qword [rcx]
mov r14, rdx
mov rdx, qword [rax + 0x2a0]
mov r12, rcx
lea rcx, [method.fhandler_base.get_stat_handle__]
cmp rdx, rcx
jne 0x210080528
mov r13, qword [r12 + 0x130]
test r13, r13
je 0x210080500
mov rax, qword [rax + 0x280]
lea rdx, [method.fhandler_base.get_handle__]
cmp rax, rdx
jne 0x210080510
cmp qword [r12 + 0x18], 0
je 0x21008047c
cmp dword [r12 + 0x94], 6
lea rdx, [r12 + 0x138]
mov rcx, r13
jne 0x2100804d8
call sym.nfs_fetch_fattr3_void__fattr3_
mov r13d, eax
test eax, eax
js 0x2100804e4
test byte [r12 + 0x11a], 8
jne 0x2100804be
mov rax, qword [r12 + 0x178]
mov rcx, rax
shr rcx, 0x20
jne 0x2100804b9
test byte [r12 + 0x98], 1
je 0x2100804b9
mov edx, dword [r12 + 0x94]
cmp edx, 3
je 0x2100804be
cmp edx, 5
je 0x210080540
mov qword [r12 + 0x20], rax
mov rdx, r14
mov rcx, r12
add rsp, 0x30
pop r12
pop r13
pop r14
jmp method.fhandler_base.fstat_helper_stat_
call sym.file_get_fai_void___FILE_ALL_INFORMATION_
mov r13d, eax
test eax, eax
jns 0x21008047c
test byte [0x210273880], 1
jne 0x210080557
mov eax, 0xffffffff
add rsp, 0x30
pop r12
pop r13
pop r14
ret
mov r13, qword [r12 + 0x18]
jmp 0x21008043b
mov rcx, r12
call rax
cmp qword [rax], 0
jne 0x21008045a
jmp 0x21008047c
mov rcx, r12
call rdx
mov r13, rax
mov rax, qword [r12]
jmp 0x21008043b
cmp dword [r12 + 0x8c], 0x30503ff
ja 0x2100804b9
jmp 0x2100804be
lea rcx, [r12 + 0x80]
xor edx, edx
call method.path_conv.get_nt_native_path__UNICODE_STRING_
mov dword [rsp + 0x20], r13d
mov edx, 0x40
lea r9, str._y__NtQueryInformationFile__S__FileAllInformation_
mov qword [rsp + 0x28], rax
lea r8, str.int_fhandler_base::fstat_by_handle_stat_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100804ed
Function at 0x210082cd0
Capabilities:
Get file attributes

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x88
lea rbx, [method.fhandler_base.get_handle__]
mov rax, qword [rcx]
mov rax, qword [rax + 0x280]
mov r12, rcx
cmp rax, rbx
jne 0x210082d80
mov rcx, qword [rcx + 0x18]
lea r13, [rsp + 0x40]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
lea r8, [rsp + 0x50]
mov rdx, r13
call sym.NtQueryInformationFile
test eax, eax
js 0x210082dad
mov eax, dword [rsp + 0x70]
mov r14d, eax
mov dword [r12 + 0x80], eax
and r14d, 0x7f27
cmp eax, 0xffffffff
je 0x210082d69
test al, 0x10
je 0x210082d69
mov rax, qword [0x21034b1a0]
test byte [rax + 0x12], 2
je 0x210082d69
test byte [r12 + 0x98], 1
jne 0x210082d69
cmp dword [r12 + 0x94], 3
je 0x210082dd0
mov rax, r14
add rsp, 0x88
pop rbx
pop r12
pop r13
pop r14
ret
call rax
mov dword [rsp + 0x20], 4
lea r13, [rsp + 0x40]
mov r9d, 0x28
mov rcx, qword [rax]
lea r8, [rsp + 0x50]
mov rdx, r13
call sym.NtQueryInformationFile
test eax, eax
jns 0x210082d27
mov eax, dword [r12 + 0x80]
mov r14d, eax
and r14d, 0x7f27
cmp eax, 0xffffffff
je 0x210082d69
test al, 0x10
je 0x210082d69
jmp 0x210082d46
mov rax, qword [r12]
mov dword [rsp + 0x3c], 0
mov rax, qword [rax + 0x280]
cmp rax, rbx
jne 0x210082e28
add r12, 0x18
mov dword [rsp + 0x20], 0x47
mov rcx, qword [r12]
mov r9d, 4
mov rdx, r13
lea r8, [rsp + 0x3c]
call sym.NtQueryInformationFile
test eax, eax
js 0x210082d69
test byte [rsp + 0x3c], 1
je 0x210082d69
bts r14, 0x20
jmp 0x210082d69
mov rcx, r12
call rax
mov r12, rax
jmp 0x210082dec
Function at 0x210084230
Capabilities:
Set file attributes

Disassembly:
cmp byte [rcx + 0x1cd], 0
je 0x210084250
cmp dword [rcx + 0x1b0], 0xc3
je 0x210084250
sub rcx, 0xffffffffffffff80
jmp sym.chmod_device_path_conv__unsigned_int_
jmp method.fhandler_disk_file.fchmod_unsigned_int___clone_.part.0_
Function at 0x2100893c0
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x58
mov r9d, 8
mov dword [rsp + 0x20], 0x17
movzx edx, dl
lea r8, [rsp + 0x38]
mov dword [rsp + 0x3c], edx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x38], 1
call sym.NtSetInformationFile
test eax, eax
js 0x210089400
add rsp, 0x58
ret
test byte [0x210273880], 1
je 0x2100893f4
mov dword [rsp + 0x20], eax
lea r9, [0x21028d668]
lea r8, str.void_set_pipe_non_blocking_HANDLE__bool_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
nop
add rsp, 0x58
ret

Function at 0x210089440
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x208
cmp byte [rcx + 0x244], 0
mov r12, rcx
mov r13, rdx
jne 0x210089474
cmp byte [rcx + 0x245], 0
jne 0x210089474
cmp byte [rcx + 0x246], 0
je 0x2100894f0
lea r15, [rsp + 0x20]
lea rdx, [r12 + 0x80]
mov rcx, r15
call method.fhandler_disk_file.fhandler_disk_file_path_conv_
mov rdx, r13
mov rcx, r15
mov dword [rsp + 0x1d0], 0xc3
call method.fhandler_disk_file.fstat_stat_
mov rcx, r15
mov r14d, eax
mov eax, dword [r12 + 0x1b0]
mov dword [r13 + 0x20], eax
mov dword [r13], eax
mov eax, dword [r12 + 0x1c8]
mov qword [r13 + 0x28], 0
mov dword [r13 + 0x10], eax
lea rax, method.fhandler_base.use_archetype___const
mov qword [rsp + 0x20], rax
call fcn.210067f00
mov eax, r14d
add rsp, 0x208
pop r12
pop r13
pop r14
pop r15
ret
add rsp, 0x208
pop r12
pop r13
pop r14
pop r15
jmp method.fhandler_base.fstat_stat_

Function at 0x210089510
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
mov r13, rcx
mov rcx, rdx
mov rbx, r8
mov rsi, r9
mov r12, rdx
call sym.ResetEvent
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rax, qword [rsp + 0xa0]
mov rcx, r13
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], eax
call sym.NtReadFile
cmp eax, 0x103
je 0x210089580
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
ret
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sym.NtWaitForSingleObject
test eax, eax
js 0x210089571
mov eax, dword [rbx]
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x21008a830
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x58
test r8b, r8b
je 0x21008a83d
mov dword [rdx + 8], r9d
mov rcx, qword [rdx]
mov r9d, 8
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 0x17
movabs rax, 0x100000001
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call sym.NtSetInformationFile
test eax, eax
js 0x21008a878
add rsp, 0x58
ret
test byte [0x210273880], 1
je 0x21008a870
mov dword [rsp + 0x20], eax
lea r9, [0x21028d668]
lea r8, str.void_set_pipe_non_blocking_HANDLE__bool_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
nop
add rsp, 0x58
ret
Function at 0x21008abb0
Capabilities:
Map section object

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x2d8
mov r9, qword [rcx + 0x20]
mov qword [rsp + 0x68], 0x58
mov rbx, rcx
mov esi, edx
mov qword [rsp + 0x70], 0x58
mov qword [rsp + 0x78], 0
test r9, r9
je 0x21008ae00
mov rax, qword [rbx]
lea rdx, [method.fhandler_base.get_dev__]
mov rax, qword [rax + 0x70]
cmp rax, rdx
jne 0x21008ae28
mov r8d, dword [rbx + 0x1b0]
lea r12, [rsp + 0xc0]
lea rdx, str.fifo_shmem._08x._016X
mov rcx, r12
lea rdi, [rsp + 0x80]
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
mov rdx, r12
mov rcx, rdi
call sym.RtlInitUnicodeString
mov dword [rsp + 0x90], 0x30
call sym.get_shared_parent_dir__
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa8], 2
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
test sil, sil
je 0x21008ad50
xor esi, esi
lea rdi, [rsp + 0x90]
lea r12, [rsp + 0x60]
mov r8, rdi
mov edx, 0xf0007
mov rcx, r12
call sym.NtOpenSection
test eax, eax
js 0x21008ad28
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.NtMapViewOfSection
mov edi, eax
test eax, eax
js 0x21008ae50
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x258], rax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x260], rax
movzx eax, sil
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop r12
ret
mov r8d, eax
mov edx, 0x2ba
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_fifo.cc
call sym.seterrno_from_nt_status_char_const__int__int_
mov eax, 0xffffffff
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop r12
ret
mov qword [rsp + 0x30], 0
lea rdi, [rsp + 0x90]
lea r12, [rsp + 0x60]
mov edx, 0xf0007
lea r9, [rsp + 0x68]
mov r8, rdi
mov rcx, r12
mov esi, 1
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 4
call sym.NtCreateSection
cmp eax, 0xc0000035
je 0x21008ac8c
test eax, eax
js 0x21008ad28
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.NtMapViewOfSection
mov edi, eax
test eax, eax
js 0x21008ae50
xor esi, esi
jmp 0x21008acfc
lea rcx, [rcx + 0x80]
xor edx, edx
call method.path_conv.get_nt_native_path__UNICODE_STRING_
xor ecx, ecx
mov rdx, rax
call sym.hash_path_name_unsigned_long___UNICODE_STRING_
mov qword [rbx + 0x20], rax
mov r9, rax
jmp 0x21008abe9
mov qword [rsp + 0x58], r9
mov rcx, rbx
lea r12, [rsp + 0xc0]
call rax
mov r9, qword [rsp + 0x58]
mov r8d, eax
jmp 0x21008ac0f
mov rcx, qword [rsp + 0x60]
call sym.NtClose
mov r8d, edi
mov edx, 0x2c2
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_fifo.cc
call sym.seterrno_from_nt_status_char_const__int__int_
mov eax, 0xffffffff
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x21008ae80
Capabilities:
Map section object

Disassembly:
push rbx
sub rsp, 0x60
xor r9d, r9d
mov rdx, 0xffffffffffffffff
lea rax, [rsp + 0x50]
mov rbx, rcx
mov rcx, qword [rcx + 0x258]
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
lea r8, [rsp + 0x58]
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x58
mov qword [rsp + 0x50], 0x58
mov qword [rsp + 0x58], 0
call sym.NtMapViewOfSection
test eax, eax
js 0x21008af01
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x260], rax
xor eax, eax
add rsp, 0x60
pop rbx
ret
mov r8d, eax
mov edx, 0x2d7
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_fifo.cc
call sym.seterrno_from_nt_status_char_const__int__int_
mov eax, 0xffffffff
jmp 0x21008aefb
Function at 0x21008af20
Capabilities:
Map section object

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x2d0
mov edx, dword [0x21034b024]
lea rax, [rdx + rdx*4]
lea rax, [rax + rax*4]
shl rax, 2
mov qword [rsp + 0x68], rax
mov rax, qword [rcx + 0x260]
mov rbx, rcx
movsxd rax, dword [rax + 0x50]
test rax, rax
jne 0x21008b0f0
mov r9, qword [rcx + 0x20]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], 0
test r9, r9
je 0x21008b10b
mov rax, qword [rbx]
lea rdx, [method.fhandler_base.get_dev__]
mov rax, qword [rax + 0x70]
cmp rax, rdx
jne 0x21008b170
mov r8d, dword [rbx + 0x1b0]
lea r12, [rsp + 0xc0]
mov rcx, r12
lea rsi, [rsp + 0x80]
lea rdx, str.fifo_shared_fc._08x._016X
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
mov rdx, r12
mov rcx, rsi
lea r12, [rsp + 0x60]
call sym.RtlInitUnicodeString
mov dword [rsp + 0x90], 0x30
call sym.get_shared_parent_dir__
mov dword [rsp + 0x28], 0x4000000
lea r9, [rsp + 0x68]
mov rcx, r12
mov qword [rsp + 0x30], 0
mov edx, 0xf0007
mov dword [rsp + 0x20], 4
mov qword [rsp + 0xa0], rsi
lea rsi, [rsp + 0x90]
mov r8, rsi
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa8], 2
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
call sym.NtCreateSection
cmp eax, 0xc0000035
je 0x21008b158
test eax, eax
js 0x21008b18f
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.NtMapViewOfSection
mov esi, eax
test eax, eax
js 0x21008b1ae
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
mov qword [rbx + 0x268], rax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x270], rax
mov rax, qword [rbx + 0x260]
mov r8d, dword [rax + 0x50]
test r8d, r8d
je 0x21008b130
shr rdx, 4
xchg dword [rax + 0x4c], edx
xor r8d, r8d
mov eax, r8d
add rsp, 0x2d0
pop rbx
pop rsi
pop r12
ret
mov r9, qword [rcx + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
test r9, r9
jne 0x21008af74
lea rcx, [rbx + 0x80]
xor edx, edx
call method.path_conv.get_nt_native_path__UNICODE_STRING_
xor ecx, ecx
mov rdx, rax
call sym.hash_path_name_unsigned_long___UNICODE_STRING_
mov qword [rbx + 0x20], rax
mov r9, rax
jmp 0x21008af74
xchg dword [rax + 0x50], edx
mov rax, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x260]
shr rax, 4
xchg dword [rdx + 0x4c], eax
mov eax, r8d
add rsp, 0x2d0
pop rbx
pop rsi
pop r12
ret
mov r8, rsi
mov edx, 0xf0007
mov rcx, r12
call sym.NtOpenSection
jmp 0x21008b045
mov qword [rsp + 0x58], r9
mov rcx, rbx
lea r12, [rsp + 0xc0]
call rax
mov r9, qword [rsp + 0x58]
mov r8d, eax
jmp 0x21008af9a
mov r8d, eax
mov edx, 0x2f9
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_fifo.cc
call sym.seterrno_from_nt_status_char_const__int__int_
mov r8d, 0xffffffff
jmp 0x21008b0dc
mov rcx, qword [rsp + 0x60]
call sym.NtClose
mov r8d, esi
mov edx, 0x301
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_fifo.cc
call sym.seterrno_from_nt_status_char_const__int__int_
mov r8d, 0xffffffff
jmp 0x21008b0dc
Function at 0x21008b1e0
Capabilities:
Map section object

Disassembly:
push rbx
sub rsp, 0x60
xor r9d, r9d
mov rax, qword [rcx + 0x260]
movsxd rax, dword [rax + 0x50]
lea rdx, [rsp + 0x50]
mov rbx, rcx
mov rcx, qword [rcx + 0x268]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x30], rdx
lea r8, [rsp + 0x58]
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
call sym.NtMapViewOfSection
test eax, eax
js 0x21008b264
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x270], rax
xor eax, eax
add rsp, 0x60
pop rbx
ret
mov r8d, eax
mov edx, 0x319
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_fifo.cc
call sym.seterrno_from_nt_status_char_const__int__int_
mov eax, 0xffffffff
jmp 0x21008b25e

Function at 0x21008bba0
Capabilities:
Map section object

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x58], 0
mov r8, rdx
mov rbx, rcx
mov edx, dword [0x21034b024]
lea rax, [rdx + r8 - 1]
mov rcx, rdx
lea rdx, [rdx + rdx*4]
neg rcx
lea rdx, [rdx + rdx*4]
and rax, rcx
shl rdx, 2
mov qword [rsp + 0x50], rax
cmp rax, rdx
ja 0x21008bc80
mov rdx, qword [rbx + 0x270]
mov rcx, 0xffffffffffffffff
call sym.NtUnmapViewOfSection
lea rax, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], 0
mov rcx, qword [rbx + 0x268]
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.NtMapViewOfSection
test eax, eax
js 0x21008bca8
mov rax, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x260]
mov qword [rbx + 0x270], rax
mov rax, qword [rsp + 0x50]
xchg dword [rdx + 0x50], eax
mov rax, qword [rsp + 0x50]
mov rdx, qword [rbx + 0x260]
shr rax, 4
xchg dword [rdx + 0x4c], eax
xor eax, eax
add rsp, 0x60
pop rbx
ret
test byte [0x210273880], 1
jne 0x21008bcbe
mov rax, qword [sym.msys_2.0.dll__impure_ptr]
mov dword [rax], 0xc
call sym.msys_2.0.dll___errno
mov dword [rax], 0xc
mov eax, 0xffffffff
jmp 0x21008bc79
mov r8d, eax
mov edx, 0x333
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_fifo.cc
call sym.seterrno_from_nt_status_char_const__int__int_
jmp 0x21008bca1
lea rax, str.int_fhandler_fifo::remap_shared_fc_handler_size_t_
mov dword [rsp + 0x30], 0xc
lea r9, [0x21028d787]
mov edx, 0x40
mov dword [rsp + 0x28], 0x329
lea r8, [0x21028d7a0]
lea rcx, [0x210273880]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21008bc89
Function at 0x21008d740
Capabilities:
Get file attributes

Disassembly:
push r12
push rbx
sub rsp, 0x78
xor eax, eax
mov r12d, dword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x21008d7ab
lea rdx, [rsp + 0x30]
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 0x18
call sym.NtQueryInformationFile
test eax, eax
js 0x21008d7c0
mov edx, dword [rsp + 0x54]
mov eax, 6
test edx, edx
jne 0x21008d7ab
mov edx, dword [rsp + 0x60]
cmp edx, 3
je 0x21008d828
ja 0x21008d7e0
mov eax, 2
cmp edx, 1
je 0x21008d7ab
xor eax, eax
cmp edx, 2
sete al
lea eax, [rax + rax*2 + 1]
mov dword [rbx + 8], eax
mov eax, r12d
add rsp, 0x78
pop rbx
pop r12
ret
test byte [0x210273880], 1
jne 0x21008d800
mov eax, 1
mov dword [rbx + 8], eax
mov eax, r12d
add rsp, 0x78
pop rbx
pop r12
ret
xor eax, eax
cmp edx, 4
sete al
lea eax, [rax + rax + 1]
mov dword [rbx + 8], eax
mov eax, r12d
add rsp, 0x78
pop rbx
pop r12
ret
mov dword [rsp + 0x20], eax
lea r9, str.NtQueryInformationFile_status__y
lea r8, str.fifo_client_connect_state_fifo_client_handler::query_and_set_state__
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21008d7c9
mov eax, 5
jmp 0x21008d7ab
Function at 0x21008ea80
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [method.fhandler_base.get_handle__]
mov rax, qword [rcx]
mov rdi, qword [rsp + 0xc0]
mov rax, qword [rax + 0x280]
mov dword [rdi], 0
mov r12, rcx
mov rbx, rdx
mov esi, r8d
mov r14, r9
cmp rax, rbp
jne 0x21008eb60
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x20], 0
call sym.ReadFile
mov r13d, eax
test eax, eax
je 0x21008eb87
lea r15, [0x210273880]
test byte [0x210273880], 1
je 0x21008eb46
mov rax, qword [r12]
mov r14d, dword [r14]
mov rax, qword [rax + 0x280]
cmp rax, rbp
jne 0x21008eba0
mov dword [rsp + 0x48], r14d
mov rax, qword [r12 + 0x18]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov eax, dword [rdi]
mov edx, 0x10
mov rcx, r15
mov dword [rsp + 0x20], r13d
lea r9, str._d__err__d___ReadFile___p___p__to_read__u__read__u__0_
lea r8, str.BOOL_fhandler_dev_floppy::read_file_void__DWORD__DWORD__int_
mov dword [rsp + 0x28], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, r13d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call rax
mov r9, r14
mov r8d, esi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call sym.ReadFile
mov r13d, eax
test eax, eax
jne 0x21008eae1
call sym.GetLastError
xor r13d, r13d
mov dword [rdi], eax
jmp 0x21008eae1
mov rcx, r12
call rax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rbx
mov rax, qword [rax]
jmp 0x21008eb1b