joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1413d23df
Capabilities:
Authenticate hmac

Disassembly:
xor edx, r11d
rol r9d, cl
jae 0x1413db8f8
mov r10d, 0xa308d8d
jmp 0x1413c071f
pop r11
mov ecx, dword [rbx + r10 - 0xa308d8d]
movsx edi, r10b
inc r10w
movzx r9d, r10b
lea rbx, [rbx + r10*8 - 0x51846c6c]
setg r10b
movzx ebp, r9w
xor ecx, r11d
jmp 0x1413c7e5e
add bp, 0x159f
sub rbp, 0xfffffffff59391a3
ror ecx, 3
inc bpl
lea rbp, [rbp*4 + 0x543de685]
call fcn.1413c7d6f
shr bpl, 0x25
or dil, r10b
not dil
mov ecx, r9d
mov word [rsi + r9*2 + 2], di
inc cx
add r9d, dword [r9 + rbx]
and cl, bpl
add ebp, ebp
xor r9d, r11d
jmp 0x1413f5eb6
bswap eax
call fcn.141396f6c
mov ebp, 0xb3087827
ror rbp, 0xa8
movzx r9d, bp
movzx di, byte [rsi + r9*2]
jae 0x1413e68b2
adc r8, r9
sub rax, 0xffffffff8abf6e1a
mov rbp, qword [rbp + rsi - 0x4dffffff]
lea rsi, [rsi + rdx*2 - 0x18b471ca]
push rdi
rol dil, 0xc7
mov dil, byte [rcx + rbx - 0x43306d05]
shl dx, cl
lea rbx, [rbx + rcx - 0x43306d04]
xor dil, r11b
shr byte [rsp + rcx - 0x43306d05], 0x83
shr cl, 0x87
adc dil, 0xa4
xor dil, 0x82
sar r10w, 0xc6
neg dil
rol dil, 1
add r10w, word [rsp + rcx - 0x43306cfe]
setae r10b
sbb dil, 0x31
dec r10b
neg dil
pop rcx
rol rdx, cl
jno 0x14140c7a1
xor r11, rdi
mov eax, 0xf63f1c3a
xor qword [rsp], 0xffffffffbd91e527
movzx ecx, word [rsp + 2]
mov qword [rcx + rsi - 0x6046], rdi
lea rsi, [rsi + rcx*2 - 0xc084]
pop rdx
mov edx, dword [rcx + rbx - 0x6036]
mov edi, r9d
or rcx, rax
xchg bpl, r9b
sbb rbx, 0xfffffffffffffff4
inc di
movzx r10d, bp
jns 0x14139e141
mov r10b, byte [rsi + r9*2 + 2]
jae 0x1413ccfad
lea rdx, [rbp + rcx - 0x63c7a5f4]
movzx edi, bp
ror r9d, 2
lea rcx, [rdi + rbp - 0xacf61f7]
inc bp
mov eax, 0x2ebcb331
bswap r9d
mov r10d, 0xb7110839
or edi, edi
xor cx, 0xf300
inc r9d
neg r9d
push r11
mov r11d, 0x68282d9c
jmp 0x141407017
xor dword [rsp + rcx - 0x43306d09], r9d
xor dil, bpl
cmovle r11, rbp
pop r11
bswap edx
je 0x1413a9eae
movsxd r9, r9d
jns 0x1413e62df
xor r11b, dil
lea r9, [rax + rax*4 - 0x7f4493c8]
add rdi, rsp
shr ax, 0x8e
not r10w
cmova r9, rdx
mov qword [rdi + rcx*4 - 4], rbp
sete cl
and r9w, cx
or rcx, r8
jmp rcx

Function at 0x1413d59a9
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + r10 - 0x5b55c2ff], rdx
mov qword [r10 + rsi - 0x5b55c313], r9
sal edx, 0x8b
lea rsi, [rsi + rax - 0xd6]
pop rdx
sub di, word [rsp + rax*8 - 0x60b]
jo 0x1413f6b44
pop rbp
jnp fcn.1413f9e24
ror r9, 0xbd
movzx eax, bpl
mov edi, dword [rbx + rbp - 0x2900]
or bpl, bpl
mov ecx, r9d
call fcn.141405d20

Function at 0x1413d71aa
Capabilities:
Authenticate hmac

Disassembly:
rol cl, 1
mov qword [rsp + rdx - 0x2b04], 0xfffffffff604b50f
sub dword [rsp + rdx - 0x2b03], r10d
xor r11b, cl
pop r9
xor r9d, edx
adc rcx, rsp
call fcn.1413c1dea

Function at 0x1413d8dd2
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rax*8 - 0x8000000], rdi
js 0x1413e5e11
mov edi, dword ss:[rcx + rax - 0x1000000]
cmovle rax, r10
shr dword [rsp + r9*2 - 0x42212800], 0x1c
xchg qword [rsp + r9 - 0x211093fa], rax
mov dword [rsi + r9*2 - 0x422127fe], edi
mov edi, 0x5ba84b32
lea rsi, [r9 + rsi - 0x211093fc]
lea rcx, [r9 + rdi*2 - 0x7b57605b]
mov qword [rsp + r9 - 0x21109402], r8
ret 8
Function at 0x1413dc646
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xchg r9d, ebp
ror al, cl
inc cl
push rdi
dec al
neg al
inc al
neg al
not al
sal qword [rsp + rdi - 0x1dc32641], 0x28
mov qword [rsp + rdi - 0x1dc32639], r9
xor al, 0x89
sub dword [rsp + rdi*4 - 0x770c98fc], ebp
rol al, 1
add qword [rsp + rbp - 0x7b97833e], rcx
xor r11b, al
call fcn.141390fc9
rol r10, 6
xadd rax, rdx
lea rax, [r9*2 + 0x190f893]
movzx ebp, dx
dec r10
xor r11, r10
mov qword [rsi + rdx*2 - 0x463fc006], r10
jmp 0x1413ed4cc
lea r10, [rdi*4 - 0x61547ad3]
xor cl, 0x22
lea rsi, [rsi + rax*8 - 0xc8b4e7e]
ror r9d, 0xe1
jp fcn.1413f9e24
mov r10d, 0xfd83ac90
mov r10d, dword [rsi]
jmp 0x1413dcb5d

Function at 0x1413e138b
Capabilities:
Authenticate hmac

Disassembly:
add dx, r10w
rol bpl, 0x21
mov qword [rsp], rax
mov word [rsi], dx
neg qword [rsp + 6]
push rax
mov r9d, dword [rbx]
lea rcx, [rdi*4 - 0x20f2c6ff]
shl rbp, cl
lea rdx, [rcx*8 + 0x7f378600]
adc rbx, 4
lea rdi, [rdi*4 + 0x2605b13f]
call fcn.141408a2f

Function at 0x1413e1cfd
Capabilities:
Authenticate hmac

Disassembly:
movzx edx, dil
or al, cl
not al
xchg rdx, r9
mov word [rsi + r9 + 2], ax
call fcn.1413c121f

Function at 0x1413ea43c
Capabilities:
Authenticate hmac

Disassembly:
cmovnp r10d, dword [rsp + r10 - 0x23074fe8]
xor r9d, r11d
call fcn.1413e746a
and cl, 0xb4
inc r10b
push rdx
neg r10b
pop rdi
mov eax, ebp
add r10b, 0xb6
rol qword [rsp + rbp - 0x341241f4], cl
pop rcx
xor r11b, r10b
or bpl, 0xb2
neg ebp
add r10, rsp
xor r9, 0x2a89d435
xor cx, word [r9 + r10 - 0x2f03622f]
ror al, 0xa6
rol dl, 0xe4
lea rsi, [rsi + r9*2 - 0x5e06c460]
jb 0x1413eb51f

Function at 0x1413f4dcd
Capabilities:
Authenticate hmac

Disassembly:
xor cl, r11b
pop rdi
movsx edx, byte [rsp + 9]
neg cl
ror cl, 1
jmp 0x1413d7fe0

Function at 0x1413f5e6b
Capabilities:
Authenticate hmac

Disassembly:
ror rax, cl
movsxd r9, r9d
shl ecx, cl
add r8, r9
or r10w, dx
call fcn.1413f38aa
mov r10d, dword [rbx]
call fcn.1413c2719
shl edi, 0x57
not r9d
mov qword [rsp + rcx*8 - 0x4c8], 0xffffffffd11654a1
bswap r9d
xchg qword [rsp + rcx*2 - 0x132], r10
xor r9d, 0xfda56a87
xadd ebp, edi
lea rax, [rdi*8 + 0x359e61b2]
mov qword [rsp + rdi - 0x5fd7bdcc], r11
and eax, ecx
xor dword [rsp + rdi - 0x5fd7bdcc], r9d
neg eax
pop r11
jle 0x1413ce2bf

Function at 0x1413f60ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsi, [rsi + r10*4 - 0x28c]
or word [rsp + r10*2 - 0x132], 0xfd8a
call fcn.1413f8578

Function at 0x1413f60e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsxd rcx, ecx
sets r9b
add r8, rcx
sal eax, 0x7a
movzx ebp, r10b
mov eax, dword [rsi + r9 - 5]
rol r10, 0xd0
mov qword [rsp + r9*8 - 8], rbx
cpuid
jbe fcn.1413e1921
mov dword [rsi + r9 - 5], eax
mov dword [rsi + r9*2 - 0xa], ebx
mov eax, ebp
inc edi
ror bpl, 0xe5
mov dword [rsi + r9*4 - 0x10], ecx
xor r9d, 0x9f864c94
shl edi, 0x7b
mov dword [rsi + rbp*4 - 0x330], edx
lea rsi, [rbp + rsi - 0xd8]
bswap edi
ja 0x1413f9cee
ror r9d, 0x28
pop rbx
call fcn.14139f679
Function at 0x1413f6d58
Capabilities:
Authenticate hmac

Disassembly:
lea rax, [r10 + rbp - 0x3865a763]
movsxd rdx, edx
add r8, rdx
shl cx, 0x62
ror bpl, 0xa1
mov edi, dword [rsi + rdi - 0x6aa9f2a2]
lea r9, [rcx*8 + 0x7b0db109]
mov ebp, dword [rsi + r10 + 4]
push r9
adc r10w, r10w
lea rsi, [rsi + r10*2 + 4]
sal ecx, 0x7f
call fcn.141390b82
movzx edx, byte [rbx + rbp - 0x42b69f81]
push rax
ror eax, 0xd2
lea rbx, [rbp + rbx - 0x42b69f80]
and ax, bp
xor dl, r11b
xchg r10b, bpl
call fcn.1413c1eb0
mov edi, 0x6aa9f2a2
mov edx, dword [rbx + rdi - 0x6aa9f2a2]
lea rcx, [rdi + rdi*4 + 0x7196b70a]
mov r10d, 0xf70d0418
neg rcx
lea rbx, [rbx + rdi - 0x6aa9f29e]
xor edx, r11d
ror edx, 1
neg edx
ror edx, 2
bswap edx
movzx ebp, dil
push rbp
dec byte [rsp + rdi - 0x6aa9f29f]
lea edx, [rdx + rbp*2 - 0x61390cc4]
ror r10w, cl
mov qword [rsp + rbp - 0xa2], r11
xchg r10b, bpl
xor dword [rsp + rdi - 0x6aa9f2a2], edx
sub r10, r10
pop r11
neg cl
jg 0x1413ecc4e
Function at 0x1413f76d5
Capabilities:
Authenticate hmac

Disassembly:
rol ebp, 1
sar word [rsp + rdx*4 - 0xb3], 0xeb
inc dl
neg ebp
xchg dword [rsp + r10*2 - 0x5628e000], ecx
not ebp
push r10
and word [rsp + rdx*4 - 0xaf], r10w
ror ebp, 1
or qword [rsp + r10 - 0x2b146ff8], r11
sal r10w, 0xa
rol r10w, 0xc7
setne byte [rsp + r10*2 - 0x5627fffc]
xor dword [rsp + r10 - 0x2b13fff8], ebp
sal r10b, 0xe3
call fcn.1413cc72d
lea rbx, [rbp + rbx - 0x781]
sal r9w, cl
xor r10d, r11d
xadd rbp, r9
je 0x1413e65b6
jb 0x1413f789a
lea r10d, [r10 + rcx*2 - 0x15b2fc8f]
push rcx
ror cl, cl
rol r10d, 1
rol bpl, 0xe5
mov rcx, qword [rsp + 8]
adc rcx, 0x228d4
jmp rcx
call fcn.1413fbb92
neg cl
ror r9b, 0x23
movsx edx, r9w
rol cl, 1
movsx eax, dx
sar bp, 0xe8
xadd di, bp
inc cl
jmp 0x1413eb6a0
ror r9b, 0x66
mov dword [rsi + rdi*2 - 0xbe], eax
lea rsi, [r9 + rsi - 0x85]
jae 0x1413b4495
jmp r8
not bpl
xchg byte [rsp + rax - 0x5e], dl
pop rdx
sub bpl, 0xa4
xor r11b, bpl
movsx r9d, dil
jmp 0x1413fb07e
and bp, ax
or r10d, dword [rbx + rbp - 0x79b70000]
lea rbx, [rbx + rbp - 0x79b6fffc]
xor r10d, r11d
mov edx, r9d
xor r10d, 0xf380660c
lea rcx, [rbp + rdx*4 - 0x3ae56be9]
inc ecx
lea r10d, [rbp + r10 - 0x27802774]
or bpl, 0x21
rol r10d, 2
neg ebp
lea r10d, [r10 + r9 - 0x5790c0b8]
call fcn.1413f7fcd
xor rbp, 0xffffffff85251280
je 0x1413a0188
xor cl, 0x9e
rol r9b, 0x65
not r9
xor al, r9b
xor r11b, cl
call fcn.1413ed102
mov r9d, dword [rsi + rax*4 - 0x184]
mov dword [r10 + rax*4 - 0x18c], r9d
mov qword [rsp + rax - 0x63], rax
or word [rsp + rax - 0x5f], ax
dec qword [rsp + rdi - 0x63]
movzx ebp, byte [rbx + rax*8 - 0x314]
sbb word [rsp + rax - 0x61], 0x7b99
lea rbx, [rbx + rax - 0x5e]
inc byte [rsp + rax - 0x61]
xor bpl, r11b
neg rcx
xor bpl, 0x31
sub byte [rsp + rax - 0x62], dil
sub bpl, 0xc
jmp 0x1413e13ca
xor ecx, r11d
call fcn.1413e6a17
add rbx, 4
mov r10d, 0xe812d9ae
call fcn.1413fc217
mov ebp, 0xd083bb06
lea r9, [rbp - 0x73df3943]
mov ebp, dword [rbx + r9 - 0x5ca481c3]
movzx edi, r9b
lea rbx, [rbx + rdi - 0xbf]
lea r10, [r9*4 - 0x21f6b071]
lea rax, [r10 + r10 + 0xd92d990]
xor ebp, r11d
xchg r9w, r10w
lea ebp, [rbp + r9*2 - 0x29c553ac]
xor ebp, 0x48b20639
call fcn.14140d6f7
mov edx, dword [rsi]
mov edi, dword [rsi + 4]
mov ecx, 0x77870e1e
mov ebp, 0xc62a8d9b
jmp 0x1413eb5a1
add rbp, rsp
mov eax, dword [rax + rbp - 0x63]
jmp 0x1413c55c9
Function at 0x14140cb57
Capabilities:
Authenticate hmac

Disassembly:
neg dil
xor word [rsp + rdx - 0xb1], 0x32ac
adc dil, 0xb6
xor r11b, dil
sub qword [rsp + rax - 0x60b7fff8], rdx
xchg ah, cl
lea rdi, [rsp + rdi + 0x10]
mov qword [rsp + rax - 0x60b8ff00], rcx
or cl, ah
mov r10w, word [rdi + rax - 0x60b8ff00]
shr byte [rsp + rdx*4 - 0x2e2], 0x63
inc cl
call fcn.141394c20
xor r10d, r11d
xchg ecx, edi
not rbp
jmp 0x1413b28bb
Function at 0x14000def6
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x290
mov edi, r8d
mov rax, rdx
mov rsi, rcx
mov rcx, qword [0x14030f948]
xor rcx, rsp
mov qword [rsp + 0x288], rcx
lea r9, [rsp + 0x17c]
mov dword [r9], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x180]
mov rcx, rax
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000dfa5
mov r8d, dword [rsp + 0x17c]
lea rbx, [rsp + 0x30]
lea rdx, [rsp + 0x180]
mov rcx, rbx
xor r9d, r9d
call fcn.14000e6a8
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000e020
call fcn.14000ebfa
cmp rax, 7
jbe 0x14000e020
mov rcx, qword [rsp + 0x30]
call fcn.14000e98e
cmp dword [rax], edi
jne 0x14000e08a
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
jmp 0x14000e002
mov ecx, 2
call fcn.14006f5c0
test al, al
je 0x14000dffb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._mojo_core_broker_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x37
mov r9d, 2
call fcn.140070300
lea rcx, [rsp + 0x48]
lea rdx, str.Error_reading_broker_pipe
mov r8d, 0x19
call fcn.140004ed8
mov rcx, rdi
call fcn.1400703d0
mov qword [rsi], 0
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140183a80
mov rax, rsi
add rsp, 0x290
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14006f5c0
test al, al
je 0x14000e06d
lea rdx, str..._.._mojo_core_broker_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x3e
mov r9d, 2
call fcn.14006f660
lea rcx, [rsp + 0x40]
lea rdx, str.Invalid_broker_message
mov r8d, reloc.WS2_32.dll_shutdown
call fcn.140004ed8
mov rcx, rsi
call fcn.14006fac0
lea rcx, [rsp + 0x180]
call sym.nacl64.exe__ovly_debug_event
lea rcx, [rsp + 0x17c]
call sym.nacl64.exe__ovly_debug_event
int3
mov ecx, 2
call fcn.14006f5c0
test al, al
je 0x14000e0d7
lea rdx, str..._.._mojo_core_broker_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x49
mov r9d, 2
call fcn.14006f660
lea rcx, [rsp + 0x40]
lea rdx, str.Unexpected_broker_message_type
mov r8d, 0x1e
call fcn.140004ed8
mov rcx, rsi
call fcn.14006fac0
lea rcx, [rsp + 0x180]
call sym.nacl64.exe__ovly_debug_event
lea rcx, [rsp + 0x17c]
call sym.nacl64.exe__ovly_debug_event
int3
Function at 0x14000e272
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
mov r13, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea r15, [rcx + 0x20]
mov rcx, r15
call fcn.140093ac0
mov ecx, 0x40
call fcn.14018360c
mov rbx, rax
xor esi, esi
mov edx, ntohs
mov rcx, rax
xor r8d, r8d
call fcn.14000e548
mov rcx, rbx
call fcn.14000e98e
mov qword [rax], 1
mov rcx, r13
shr rcx, 0x20
jne 0x14000e4f5
mov esi, r13d
mov dword [rax + 8], esi
lea r9, [rsp + 0x1dc]
mov dword [r9], 0
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e38d
mov eax, dword [rsp + 0x1dc]
cmp qword [rbx + 0x10], rax
jne 0x14000e38d
lea rcx, [rsp + 0x98]
call fcn.1400a335c
mov rdx, qword [rdi + 8]
lea rdi, [rsp + 0x90]
mov rcx, rdi
mov r8d, 2
call fcn.14000def6
mov rdi, qword [rdi]
test rdi, rdi
je 0x14000e3f6
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.14000e0f5
test al, al
je 0x14000e380
mov rcx, rdi
call fcn.14000ebfa
cmp rax, 0x17
ja 0x14000e40f
mov rcx, r14
call fcn.140070800
jmp 0x14000e48c
mov ecx, 2
call fcn.14006f5c0
test al, al
je 0x14000e3e9
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._mojo_core_broker_win.cc
lea rsi, [rsp + 0x98]
mov rcx, rsi
mov r8d, 0x8d
mov r9d, 2
call fcn.140070300
lea rcx, [rsp + 0xa8]
lea rdx, str.Error_sending_sync_broker_message
mov r8d, 0x21
call fcn.140004ed8
mov rcx, rsi
call fcn.1400703d0
mov rcx, r14
call fcn.140070800
jmp 0x14000e4b5
mov rcx, r14
call fcn.140070800
mov qword [rsp + 0x90], 0
jmp 0x14000e4a8
mov rcx, rdi
call fcn.14000e98e
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x58]
call fcn.14008be70
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.1400a335c
lea rbp, [rsp + 0x30]
lea rdx, [rsp + 0x98]
mov rcx, rbp
call fcn.1400a336e
lea r12, [rsp + 0x50]
mov rcx, r12
mov rdx, rbp
mov r8, rsi
call fcn.140024f75
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rbp, [rsp + 0x68]
mov rcx, rbp
mov rdx, r12
mov r8d, 1
mov r9, r13
call fcn.140095e90
mov rcx, r14
mov rdx, rbp
call fcn.140070fa0
mov qword [rsp + 0x90], 0
mov rcx, rdi
call fcn.14000e686
mov rcx, rdi
call fcn.140183668
lea rcx, [rsp + 0x98]
call fcn.1400a3432
mov rcx, rbx
call fcn.14000e686
mov rcx, rbx
call fcn.140183668
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140183a80
mov rax, r14
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
Function at 0x14000f62c
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000f683
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.140004348
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14000f673
mov qword [rsi], rdi
call fcn.14006f300
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140094d30
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140010534
Capabilities:
Write file on windows

Disassembly:
mov rax, qword [rcx + 0xe0]
cmp rax, qword [rcx + 0xe8]
jne 0x140010547
mov al, 1
ret
cmp qword [rcx + 0xd8], rax
jb 0x140010560
mov rdx, qword [rcx + 0xd0]
mov rdx, qword [rdx + rax*8]
jmp fcn.1400105e8
int3

Function at 0x140010564
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x28]
mov qword [rdi], rdx
mov rdx, rdi
call fcn.14000f038
lea rdx, [rsi + 0x80]
mov r8d, dword [rdi]
mov rcx, qword [rsi + 0x48]
mov qword [rsp + 0x20], rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400105bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1400105c9
mov byte [rsi + 0xa1], 1
lock inc dword [rsi + 8]
jmp 0x1400105d3
mov rcx, rsi
xor edx, edx
call fcn.14000f58a
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140183a80
nop
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400105e8
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rsi, [rsp + 0x28]
mov rcx, rdx
mov rdx, rsi
call fcn.14000ef62
mov rbx, qword [rsi]
mov rsi, qword [rsi + 8]
cmp rbx, rsi
je 0x140010633
mov rcx, rbx
call fcn.140024d32
add rbx, 0x20
cmp rsi, rbx
jne 0x140010622
lea rax, [r14 + 0xb0]
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi]
mov rcx, qword [r14 + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140010664
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140010676
mov byte [r14 + 0xf2], 1
lock inc dword [r14 + 8]
mov sil, 1
jmp 0x140010678
xor esi, esi
lea rcx, [rsp + 0x28]
call fcn.14000e4fc
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140183a80
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400255a4
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x140320ee0]
call fcn.1400253d6
mov rcx, rax
add rsp, 0x28
jmp fcn.140081650

Function at 0x140035862
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r8d
mov ebp, edx
mov r8, rcx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, qword [rcx + 0xc8]
mov dword [rsp + 0x20], edi
lea rdx, str.Entered_NaClSysSysconf__08I64xx___d__0x_08I32x__n
mov ecx, 3
mov r9d, ebp
call fcn.1400b8218
mov ebx, 0xffffffea
cmp ebp, 0xffffff
jg 0x1400358ee
cmp ebp, 1
je 0x14003590e
cmp ebp, 2
je 0x140035931
cmp ebp, 0x10000
jne 0x140035982
cmp dword [rsi + 0x620], 0
jne 0x140035982
mov rax, qword [rsi + 0x600]
movsx ecx, byte [rax + 0x25]
movsx edx, byte [rax + 0x1c]
add edx, edx
or edx, ecx
movsx eax, byte [rax + 4]
shl eax, 2
or eax, edx
jmp 0x14003595d
cmp ebp, 0x1000000
je 0x14003593b
cmp ebp, 0x1000001
je 0x140035957
cmp ebp, 0x1000002
jne 0x140035982
mov eax, dword [rsi + 0x620]
jmp 0x14003595d
mov eax, dword [0x140339190]
test eax, eax
jne 0x14003595d
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 0x20]
mov dword [0x140339190], eax
jmp 0x14003595d
mov dword [rsp + 0x30], 0x10000
jmp 0x140035961
cmp dword [0x140339178], 0
setne al
cmp qword [0x140339180], 0
setne cl
or cl, al
movzx eax, cl
jmp 0x14003595d
mov eax, dword [rsi + 0x61c]
mov dword [rsp + 0x30], eax
mov edx, edi
lea r8, [rsp + 0x30]
mov r9d, 4
mov rcx, rsi
call fcn.14003437c
xor ecx, ecx
test eax, eax
mov ebx, 0xfffffff2
cmovne ebx, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140183a80
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140041da5
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, rdx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], rcx
mov rsi, qword [rcx]
lea rdx, str.NaClPageAlloc___0x_I64x__n
mov ecx, 3
mov r8, rdi
call fcn.1400b8218
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rbx + 4]
cmp r8d, 0x1000
je 0x140041e15
lea rdx, str.page_size_is_0x_x__expected_0x_x_n
mov ecx, 2
mov r9d, 0x1000
call fcn.1400b8218
mov r8d, dword [rsp + 0x58]
cmp r8d, 0x10000
je 0x140041e3a
lea rdx, str.allocation_granularity_is_0x_x__expected_0x_x_n
mov ecx, 0xfffffffd
mov r9d, 0x10000
call fcn.1400b8218
add rdi, 0xffff
and rdi, 0xffffffffffff0000
xor r13d, r13d
mov r14, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rbx, str.NaClPageAlloc:__VirtualAlloc__0x_I64x__succeeded__0x_016I64x__releasing_and_re_allocating_in_64K_chunks...._n
mov r15, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x2000
mov r9d, 1
call r14
test rax, rax
je 0x140041f85
mov rsi, rax
mov ecx, 3
mov rdx, rbx
mov r8, rdi
mov r9, rax
call fcn.1400b8218
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call r15
test rdi, rdi
jle 0x140041f47
lea r12, [rsi + rdi]
mov rbx, rsi
mov edx, 0x10000
mov rcx, rbx
mov r8d, 0x2000
mov r9d, 1
call r14
test rax, rax
je 0x140041ee3
add rbx, 0x10000
cmp rbx, r12
jb 0x140041eb9
jmp 0x140041f47
call rbp
mov ecx, 0xfffffffd
lea rdx, str.NaClPageAlloc:_re_allocation_failed_at_0x_016I64x__error__d_n
mov r8, rbx
mov r9d, eax
call fcn.1400b8218
cmp rsi, rbx
jae 0x140041f18
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call r15
add rsi, 0x10000
jmp 0x140041efc
mov ecx, 2
lea rdx, str.NaClPageAllocAtAddr:_retrying_w_o_hint_n
call fcn.1400b8218
inc r13d
mov esi, 0
cmp r13d, 0x100
lea rbx, str.NaClPageAlloc:__VirtualAlloc__0x_I64x__succeeded__0x_016I64x__releasing_and_re_allocating_in_64K_chunks...._n
jne 0x140041e67
jmp 0x140041f99
lea rdx, str.NaClPageAlloc:_p__0x_016I64x__returning_success._n
mov ecx, 2
mov r8, rsi
call fcn.1400b8218
mov rax, qword [rsp + 0x28]
mov qword [rax], rsi
xor esi, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140183a80
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.NaClPageAlloc:_VirtualAlloc__0x_I64x__failed_n
mov ecx, 0xfffffffd
mov r8, rdi
call fcn.1400b8218
mov esi, 0xfffffff4
jmp 0x140041f65

Function at 0x140041fa0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rcx], 0
jmp fcn.140041da5