joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041d00
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0xc8], rax
test rcx, rcx
je 0x140041eb0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.1400d9cfc
movaps xmm6, xmmword [0x14017b970]
lea r14, [rsp + 0x80]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str....._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x48
call fcn.14009ac50
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140092f50
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.1400d06f4
mov ecx, eax
call fcn.1400d0efc
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140041eb4
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [0x1401a12c0]
xor r12d, r12d
mov rcx, qword [rsp + 0x30]
add rcx, r12
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.1400d9984
test rax, rax
je 0x140041e53
mov r15, rax
mov rax, rdi
sub rax, r12
cmp rax, r15
jb 0x140041ebf
add r15, r12
mov rcx, rbx
call fcn.1400d9170
test eax, eax
je 0x140041ec3
mov r12, r15
mov rcx, rbx
call fcn.1400d919c
test eax, eax
sete bl
mov rdi, r12
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [0x1401a12c0]
lea rcx, [rsp + 0x80]
call fcn.140092fd0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400bf690
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x140041e85
mov r14d, 0xffff
jmp 0x140041df1
xor ebx, ebx
jmp 0x140041e63
test r12, r12
mov eax, 0x10000
cmove r14, rax
lea r8, [r15 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [0x1401a12c0]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
mov r12, r15
jmp 0x140041e16
Function at 0x1400477d0
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400478b0
mov eax, dword [rsi]
mov dword [0x1401b15d0], eax
test al, 1
jne 0x1400477f1
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x1401c47f8]
test rcx, rcx
je 0x14004781f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401c47f8], 0
cmp qword [0x1401c4800], 0
jne 0x14004781f
and byte [0x1401b15d0], 0xfe
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x140047831
mov qword [0x1401c47f8], rax
jmp 0x1400477e9
mov rcx, qword [0x1401c4800]
test rcx, rcx
jne 0x14004785f
mov ecx, 0x18
call fcn.1400be2fc
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1401c4800], rax
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140047894
call fcn.14003ab40
cmp dword [rsi + 0x14], 0
jne 0x140047889
mov rcx, qword [0x1401c4800]
cmp byte [rcx + 0x17], 0
jns 0x140047883
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.140114660
lea rcx, [0x14018083d]
lea rdx, str....._third_partylibc_srcinclude_string:2719:_assertion___s___nullptr_failed:_string::assign_received_nullptr_n
call fcn.1400f81f0
int3
Function at 0x14004bb50
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.140094750
cmp byte [rdi + 0x17], 0
jns 0x14004bb91
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x14004bbb2
mov rcx, qword [rsp + 0x58]
call fcn.1400be338
test rsi, rsi
je 0x14004bc59
test edi, edi
je 0x14004bc59
mov ecx, edi
add rcx, rcx
call fcn.1400be36c
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x58]
mov rcx, r14
call fcn.140094750
cmp byte [r14 + 0x17], 0
jns 0x14004bbf5
mov r14, qword [rsp + 0x58]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x14004bc15
mov rcx, qword [rsp + 0x58]
call fcn.1400be338
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x14004bc77
mov rcx, rbx
call fcn.1400dc6b4
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.140094780
cmp byte [rsi + 0x17], 0
js 0x14004bc8a
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.1400be374
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400bf690
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14018083d]
lea rdx, str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
call fcn.1400f81f0
mov rcx, qword [rsi]
call fcn.1400be338
jmp 0x14004bc40
Function at 0x14004c300
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1401c4908]
test rdi, rdi
jne 0x14004c3b3
mov ecx, 0x50
call fcn.1400be2fc
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.1400be2fc
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x14004c3d5
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x1401c4908], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14004c3e8
mov rcx, rax
call fcn.1400dc6b4
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14004c400
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bf690
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14018083d]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1400f81f0
lea rcx, [0x14018083d]
lea rdx, str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
call fcn.1400f81f0
int3
Function at 0x14004c400
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 3
call fcn.14003d560
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x14004c58c
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x3c], 0
lea rcx, [0x1401901d8]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14004c5e3
lea rdx, [0x140190228]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004c5d2
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [0x1401a12c0]
mov rbx, rax
movsxd r12, dword [rsp + 0x3c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x30], 0
test r12, r12
je 0x14004c522
test r12d, r12d
js 0x14004c5d9
shl r12, 3
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.1400be2fc
mov r14, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
add rax, r15
mov qword [rsp + 0x30], rax
xor r15d, r15d
test r14, r14
je 0x14004c5ac
mov rdx, qword [rbx + r15]
mov rcx, r14
call fcn.140029340
add r14, 0x18
add r15, 8
cmp r12, r15
jne 0x14004c4fb
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14004bee0
movups xmmword [rsi], xmm6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x14004c549
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x14004c58c
mov rdi, qword [rsp + 0x28]
cmp rdi, rsi
je 0x14004c584
add rdi, 0xffffffffffffffe8
jmp 0x14004c577
mov rcx, qword [rdi]
call fcn.1400be338
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
je 0x14004c584
test rdi, rdi
je 0x14004c5bf
cmp byte [rdi + 0x17], 0
js 0x14004c563
jmp 0x14004c56b
mov rcx, rsi
call fcn.1400be338
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bf690
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x14018083d]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1400f81f0
lea rcx, [0x14018083d]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1400f81f0
xor ebx, ebx
jmp 0x14004c4af
lea rcx, [rsp + 0x20]
call fcn.1400f7500
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x14004c4ac
Function at 0x140051490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x1400514aa
test r8d, r8d
jne 0x1400514a3
call fcn.140066730
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.140050b80
Function at 0x1400579d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x140057b19
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x14017b970]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [0x1401a12c0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [0x1401a12c0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [0x1401a12c0]
test r14, r14
je 0x140057ab3
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x140057aa3
mov ecx, 1
call fcn.1400a1ab0
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x140057b1d
call fcn.140002fe0
lea rax, [0x140001d60]
lea rcx, section..text
mov qword [rsi + 0xf8], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bf690
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x140057afc
bt eax, 9
jae 0x140057b38
call fcn.1400040d0
lea rax, [0x1400045a0]
lea rcx, [0x1400042a0]
jmp 0x140057ae3
call fcn.14011af00
lea rax, [0x14011b700]
lea rcx, [0x14011ade0]
jmp 0x140057ae3

Function at 0x140057b60
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.1400a1ab0
mov ebp, eax
bt eax, 0x1d
jb 0x140057ba3
not ebp
test ebp, 0x128
jne 0x140057bc9
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140010eb0
mov ecx, 1
call fcn.1400a1ab0
bt eax, 9
jae 0x140057b83
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000ef40
mov ecx, 1
call fcn.1400a1ab0
mov ebp, eax
bt eax, 0x1c
jae 0x140057be8
xor ecx, ecx
call fcn.1400a1ab0
bt eax, 0x1e
jb 0x140057c12
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jb 0x140057c04
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000df00
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000f210
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.1400100b0
Function at 0x140057c30
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401c4b68]
mov ecx, dword [0x1401be1a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140057c6b
movzx eax, word [0x1401c4b38]
cmp eax, 9
jne 0x140057cb3
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x1401c4b68]
call fcn.1400be37c
cmp dword [0x1401c4b68], 0xffffffff
jne 0x140057c55
xorps xmm0, xmm0
movups xmmword [0x1401c4b58], xmm0
movups xmmword [0x1401c4b48], xmm0
movups xmmword [0x1401c4b38], xmm0
lea rcx, [0x1401c4b38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401c4b68]
call fcn.1400be430
jmp 0x140057c55
test eax, eax
je 0x140057c66
cmp eax, 6
jne 0x140057cc3
mov eax, 2
jmp 0x140057c66
cmp eax, 0xc
jne 0x140057ccf
mov eax, 3
jmp 0x140057c66
mov eax, 4
jmp 0x140057c66

Function at 0x140058600
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x14017b970]
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x1b
call fcn.14009ac50
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140092f50
mov rcx, rsi
call fcn.140090680
test al, al
je 0x140058745
mov rcx, rsi
call fcn.14003e140
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
cmp qword [rsi + 0x40], rax
je 0x1400586ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x14005876e
mov rax, rbx
inc rax
cmp rax, 2
jb 0x1400586e1
mov qword [rsi + 0x40], rbx
call fcn.14009ac70
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi + 0x40]
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140058789
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x140058745
lea rdx, fcn.14011c590
lea rcx, [rsp + 0x30]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
call fcn.14006b7d0
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.140092fd0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400bf690
mov eax, edi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14009ac70
mov rcx, qword [rsi + 0x40]
call fcn.140090030
mov qword [rsi + 0x40], 0
jmp 0x1400586cc
xor edi, edi
jmp 0x140058745
Function at 0x140058790
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x14017b970]
lea r15, [rsp + 0x60]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.MapFileRegionToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r12, [rsp + 0x40]
mov rcx, r12
mov r9d, 0x3a
call fcn.14009ac50
xor r14d, r14d
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.140092f50
mov rcx, rsi
call fcn.140090680
test al, al
je 0x140058917
test ebx, ebx
jne 0x140058972
mov ebp, 2
mov ebx, 4
xor r15d, r15d
mov rcx, rsi
call fcn.14003e140
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x28], 0
mov rcx, rax
xor edx, edx
mov r8d, ebp
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
cmp qword [rsi + 0x40], rax
je 0x14005889c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x140058946
mov rax, r14
inc rax
cmp rax, 2
jb 0x140058890
mov qword [rsi + 0x40], r14
call fcn.14009ac70
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi + 0x40]
inc r14
cmp r14, 2
jb 0x140058961
mov dword [rsp + 0x3c], 0
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
cmp rcx, qword [0x140195bd8]
jne 0x1400589b3
cmp rdx, qword [0x140195be0]
jne 0x1400589b3
mov rcx, rsi
call fcn.14003e280
xor r14d, r14d
test rax, rax
jle 0x140058917
mov qword [rsi + 0x38], rax
xor r8d, r8d
xor eax, eax
mov rcx, qword [rsi + 0x40]
mov qword [rsp + 0x20], rax
mov edx, ebx
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x140058961
movsxd rcx, dword [rsp + 0x3c]
add rax, rcx
mov qword [rsi + 0x30], rax
mov r14b, 1
lea rcx, [rsp + 0x60]
call fcn.140092fd0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400bf690
mov eax, r14d
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14009ac70
mov rcx, qword [rsi + 0x40]
call fcn.140090030
mov qword [rsi + 0x40], 0
jmp 0x14005887b
xor r14d, r14d
jmp 0x140058917
mov ebx, 0xaaaaaaaa
xor ebp, ebp
jmp 0x14005882f
dec ebx
cmp ebx, 3
ja case.default.0x140058987
lea rax, [0x140195bc4]
movsxd rcx, dword [rax + rbx*4]
add rcx, rax
jmp rcx
mov r14, qword [rdi + 8]
mov r15, r14
shr r15, 0x20
mov ebp, 4
mov ebx, 2
jmp 0x140058832
mov rcx, rsi
call fcn.140058600
mov r14d, eax
jmp 0x140058917
xor eax, eax
lea r14, [rsp + 0x40]
mov qword [r14], rax
lea r9, [rsp + 0x30]
mov qword [r9], rax
lea r15, [rsp + 0x3c]
mov qword [rsp + 0x20], r15
mov r8, r14
call fcn.140058c40
mov rcx, qword [rdi + 8]
movsxd rax, dword [r15]
mov r8, rax
sar r8, 0x3f
add rax, rcx
adc r8, 0
mov edx, r8d
and edx, 1
neg rdx
xor r8, rdx
setne r8b
mov r14, qword [r14]
test r14, r14
js 0x140058961
test r8b, r8b
jne 0x140058961
test rdx, rdx
js 0x140058961
mov r8, r14
shr r8, 0x20
mov qword [rsi + 0x38], rcx
jmp 0x1400588eb
mov ebp, 4
mov ebx, 2
jmp 0x14005882f
mov ebp, 8
mov ebx, 1
jmp 0x14005882f
Function at 0x1400637d0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x140063847
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x1401b1720], rax
jne 0x14006384a
mov rsi, rcx
call fcn.14006ee00
mov edx, 0x568
mov rcx, rax
xor r8d, r8d
call fcn.140025960
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.1400a9d60
mov ecx, dword [0x1401c4d88]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1401be1a0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x170], rdi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
int3
int3
Function at 0x14006ade0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x14006adb0]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x1401c7540]
lea rdx, [0x14006ac50]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14006aed8
cmp dword [0x1401c7548], 0
jne 0x14006aee5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x1401c754c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x14006ae8c
mov ecx, 1
mov edx, 0x28
call fcn.14009eed0
test rax, rax
je 0x14006aee5
mov r14, rax
mov ecx, dword [0x1401c754c]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14006aedd
lea r15, [0x1401c7550]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x1401c7560]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bf690
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400d2f50
mov rcx, r14
call fcn.14009ee30
mov rcx, rsi
mov rax, rdi
call qword [0x1401a12c0]
xor esi, esi
jmp 0x14006aebc

Function at 0x14006b350
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401bd758]
cmp ecx, 0xffffffff
je 0x14006b372
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006b377
call fcn.14006b4a0
mov eax, dword [0x1401c8db0]
mov ecx, dword [0x1401be1a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006b427
mov rbx, qword [0x1401c8da8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14006b470
mov rax, qword [0x1401c7598]
inc rax
xor ecx, ecx
lea rdx, [0x1401c75a0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14006b47d
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x1401c8da0]
inc ecx
mov dword [0x1401c8da0], ecx
mov dword [rax + 0x14], ecx
mov qword [0x1401c7598], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14006b46d
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401c8db0]
call fcn.1400be37c
cmp dword [0x1401c8db0], 0xffffffff
jne 0x14006b39c
mov ecx, 8
call fcn.1400be2fc
mov rbx, rax
mov rcx, rax
call fcn.140090230
mov qword [0x1401c8da8], rbx
lea rcx, [0x1401c8db0]
call fcn.1400be430
jmp 0x14006b39c
int3
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x14006b3b4
inc rcx
cmp rcx, 0x100
jne 0x14006b3c7
jmp 0x14006b40d