joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e8f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
lea r15, [rcx + 0x118]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14000e9b4
mov r12, qword [rsi + 0x130]
test r12, r12
je 0x14000e98c
mov rax, qword [rsi + 0x120]
or rax, qword [rsi + 0x128]
jne 0x14000e98c
lea rax, [rsi + 0x120]
movups xmm0, xmmword [r14]
movups xmmword [rax], xmm0
lock inc dword [r12 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
movups xmm0, xmmword [r14]
movups xmmword [r12 + 0x38], xmm0
add rsi, 8
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call fcn.140010230
lock dec dword [r12 + 8]
je 0x14000e9c1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsi, 0xfffffffffffffff8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.14000d2b0
mov rcx, r15
call fcn.1400ec2e0
jmp 0x14000e921
add r12, 8
mov rcx, r12
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1401afb50
Function at 0x1400153b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x70], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x140261350]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x60]
movaps xmmword [rcx], xmm0
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14001549d
mov r8, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
movabs rcx, 0xffffffffffff
and rcx, rax
shr rax, 0x30
and eax, 0x3fff
or eax, 0x8000
mov edx, r8d
and edx, 0xfff
or edx, 0x4000
mov r9d, r8d
shr r9d, 0x10
shr r8, 0x20
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x28], eax
lea rdx, str._08x__04x__04x__04x__012llx
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140102fa0
cmp byte [rdi + 0x17], 0
jns 0x1400154a0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140013f90
cmp byte [rsp + 0x57], 0
jns 0x140015486
mov rcx, qword [rsp + 0x40]
call fcn.140172a44
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401756e0
mov rax, rsi
add rsp, 0x78
pop rdi
pop rsi
ret
int3
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x140015486
Function at 0x140019820
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov dword [rcx], 1
xor eax, eax
mov qword [rcx + 8], rax
mov r15, qword [rdx]
mov qword [rdx], rax
lea r12, [r15 + 1]
cmp r12, 2
jb 0x140019854
call fcn.1400f24d0
cmp qword [rsi + 8], r15
je 0x140019886
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1400198a7
cmp r12, 2
jb 0x14001987e
mov qword [rsi + 8], r15
call fcn.1400f24d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14001991b
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400f24d0
mov r14, qword [rsi + 8]
cmp qword [0x1402a1a18], 0
je 0x1400198da
mov rcx, qword [0x1402a1a18]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401d7990.0]
mov qword [rsi + 8], 0
jmp 0x14001986f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14026b3c1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140019934
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140019915
call qword [case.0x1401d7990.0]
mov rcx, rax
xor edx, edx
call fcn.14003cbf0
jmp 0x1400198ba
xor ecx, ecx
mov dl, 1
jmp 0x14001990e
call fcn.1400f24d0
mov rcx, qword [rdi]
call fcn.1401571e0
mov qword [rdi], 0
jmp 0x140019896
xor ecx, ecx
jmp 0x14001990c

Function at 0x14001a0d0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, r8
mov rsi, rdx
mov r12, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, rbx
shr r15, 0x20
movzx eax, r9b
lea ebp, [rax + rax]
add ebp, 4
mov qword [rsp + 0x20], r12
mov rcx, r8
mov edx, ebp
mov r8d, r15d
mov r9d, ebx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x14001a197
movaps xmm0, xmmword [0x140261350]
lea rdi, [rsp + 0x30]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov r8d, 0x30
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rdi + 0x18]
sub rcx, r14
add rcx, qword [rdi + 8]
test rax, rax
cmove rcx, rax
mov byte [rsi], 1
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401756e0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1401e7ae0
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov edx, ebp
mov r8d, r15d
mov r9d, ebx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
jne 0x14001a132
call fcn.1401e7ae0
mov byte [rsi], 0
jmp 0x14001a178
Function at 0x14001b100
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1402a39b0]
mov ecx, dword [0x140296f94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001b16d
mov ecx, dword [0x140288f70]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x14001b162
mov rdx, qword [0x1402a39a0]
shl rdx, 4
mov r8d, dword [rax + rdx + 8]
cmp r8d, dword [0x1402a39a8]
jne 0x14001b162
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14001b1b7
mov dword [rsi], ecx
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402a39b0]
call fcn.140172b08
cmp dword [0x1402a39b0], 0xffffffff
jne 0x14001b129
mov qword [0x1402a39a8], 0
lea rcx, [0x1402a39a0]
mov qword [0x1402a39a0], 0xffffffffffffffff
xor edx, edx
call fcn.140002400
lea rcx, [0x1402a39b0]
call fcn.140172aa8
jmp 0x14001b129
mov ecx, dword [rax]
jmp 0x14001b162

Function at 0x14001b1c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dword [rcx + 0x10], 0
je 0x14001b1f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401756e0
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x10], eax
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.14001b100
mov eax, dword [rdi]
mov dword [rsi + 0x14], eax
mov eax, dword [0x1402a3998]
mov ecx, dword [0x140296f94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001b274
mov ecx, dword [0x140288f70]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x14001b268
mov rdx, qword [0x1402a3988]
shl rdx, 4
mov r8d, dword [rax + rdx + 8]
cmp r8d, dword [0x1402a3990]
jne 0x14001b268
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14001b270
mov dword [rsi + 0x18], ecx
jmp 0x14001b1db
mov ecx, dword [rax]
jmp 0x14001b268
lea rcx, [0x1402a3998]
call fcn.140172b08
cmp dword [0x1402a3998], 0xffffffff
jne 0x14001b22f
mov qword [0x1402a3990], 0
lea rcx, [0x1402a3988]
mov qword [0x1402a3988], 0xffffffffffffffff
xor edx, edx
call fcn.140002400
lea rcx, [0x1402a3998]
call fcn.140172aa8
jmp 0x14001b22f
Function at 0x14001bd20
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140175680
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.140177800
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001bde1
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14001bde5
lea rdi, [rsp + 0x840]
mov rcx, rdi
call fcn.140173694
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14001be40
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401756e0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14001bdc2
cmp eax, 2
jne 0x14001be30
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.140177800
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14001be37
lea rdi, [rsp + 0x40]
jmp 0x14001bdaa
mov edi, 0x3f4
jmp 0x14001bdc2
mov edi, 0xea
jmp 0x14001bdc2

Function at 0x14001caf0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x50]
mov qword [r15 + 0x50], rax
movaps xmm0, xmmword [0x140261350]
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x28]
mov rcx, r14
mov r9d, 0x5b
call fcn.14011b9f0
mov rcx, r15
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call fcn.14010e570
test byte [0x140289010], 0x19
jne 0x14001cbe5
test esi, esi
js 0x14001cbfb
lea r9, [rsp + 0x28]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001cc02
mov esi, dword [rsp + 0x28]
test esi, esi
js 0x14001cc15
lea rcx, [rsp + 0x50]
call fcn.140140790
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401756e0
mov eax, esi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdx, [rsp + 0x48]
mov qword [rdx], r14
lea rcx, str.ScopedBlockingCall
call fcn.1401d6b20
jmp 0x14001cb86
mov esi, 0xffffffff
jmp 0x14001cbba
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x14001cbba
int3
Function at 0x140021390
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x1400213dc
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400213e7
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400213ca
mov qword [rdi], rsi
call fcn.1400f24d0
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400f24d0
mov r14, qword [rdi]
cmp qword [0x1402a1a18], 0
je 0x140021418
mov rcx, qword [0x1402a1a18]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401d7990.0]
mov qword [rdi], 0
jmp 0x1400213b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14026b3c1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140021459
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140021453
call qword [case.0x1401d7990.0]
mov rcx, rax
xor edx, edx
call fcn.14003cbf0
jmp 0x1400213f9
xor ecx, ecx
mov dl, 1
jmp 0x14002144c
xor ecx, ecx
jmp 0x14002144a
Function at 0x140023410
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xc0]
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x58], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.140172a4c
mov rsi, rax
mov rax, qword [0x14028a5a0]
and rax, r15
cmp rax, qword [0x14028a588]
je 0x1400234d4
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x140037c40]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400234de
test r14, r14
je 0x140023529
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401756e0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, r15
call fcn.1400eaf60
jmp 0x14002346d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1400234f7
mov ebp, eax
cmp eax, 0x5af
je 0x1400234f7
cmp ebp, 0xe
jne 0x140023537
mov rcx, rbx
call fcn.1401da5b0
test rsi, rsi
je 0x1400234b0
mov rcx, qword [rsi]
mov rax, qword [0x14028a5a0]
and rax, rcx
cmp rax, qword [0x14028a588]
jne 0x14002351f
call fcn.1400ebe70
mov rcx, rsi
call fcn.140172a44
jmp 0x1400234b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400234b0
mov eax, dword [0x14029b568]
mov ecx, dword [0x140296f94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400235af
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov edx, ebp
call fcn.1400b8c90
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
cmovs rcx, qword [rbx + 8]
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, qword [0x14029b560]
call fcn.1400f24c0
cmp byte [rbx + 0x17], 0
jns 0x1400234ff
mov rcx, qword [rsp + 0x30]
call fcn.140172a44
jmp 0x1400234ff
lea rcx, [0x14029b568]
call fcn.140172b08
cmp dword [0x14029b568], 0xffffffff
jne 0x140023558
lea rcx, str.create_thread_last_error
mov edx, 0x20
call method.std::Cr::basic_streambuf_char__struct_std::Cr::char_traits_char__.virtual_40
mov qword [0x14029b560], rax
lea rcx, [0x14029b568]
call fcn.140172aa8
jmp 0x140023558
Function at 0x140025500
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
call qword [case.0x1401d7990.0]
mov byte [rsi + 0x429], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [case.0x1401d7990.0]
test rax, rax
je 0x140025594
mov eax, dword [0x1402a1940]
mov ecx, dword [0x140296f94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002559a
mov ecx, dword [0x140288f70]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400255e4
mov rcx, qword [0x1402a1930]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x1402a1938]
mov rdx, qword [0x1402a1930]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1402a1940]
call fcn.140172b08
cmp dword [0x1402a1940], 0xffffffff
jne 0x14002555e
mov qword [0x1402a1938], 0
lea rcx, [0x1402a1930]
mov qword [0x1402a1930], 0xffffffffffffffff
xor edx, edx
call fcn.140002400
lea rcx, [0x1402a1940]
call fcn.140172aa8
jmp 0x14002555e
test rsi, rsi
je 0x140025594
call fcn.14003bc30
jmp 0x140025570

Function at 0x140025b90
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x140025bbc
call fcn.1400f24d0
mov qword [rsi], 0
test r15, r15
je 0x140025bf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140025c22
cmp r12, 2
jb 0x140025bea
mov qword [rsi], r15
call fcn.1400f24d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.14014c850
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400f24d0
mov r14, qword [rsi]
cmp qword [0x1402a1a18], 0
je 0x140025c53
mov rcx, qword [0x1402a1a18]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401d7990.0]
mov qword [rsi], 0
jmp 0x140025bdc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14026b3c1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140025c94
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140025c8e
call qword [case.0x1401d7990.0]
mov rcx, rax
xor edx, edx
call fcn.14003cbf0
jmp 0x140025c34
xor ecx, ecx
mov dl, 1
jmp 0x140025c87
xor ecx, ecx
jmp 0x140025c85
Function at 0x1400263d0
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x50]
mov qword [rbx + 0x50], r14
movaps xmm0, xmmword [0x140261350]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0xa8
call fcn.14011b9f0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call fcn.14010e570
test byte [0x140289010], 0x19
jne 0x1400264a2
lea rdi, [rsp + 0x28]
mov qword [rdi], r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rdi]
lea rcx, [rsp + 0x50]
call fcn.140140790
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401756e0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, [rsp + 0x48]
mov qword [rdx], rdi
lea rcx, str.ScopedBlockingCall
call fcn.1401d6b20
jmp 0x140026459
Function at 0x140027a30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x1402a19b8]
mov ecx, dword [0x140296f94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140027c0a
mov ecx, dword [0x140288f70]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140027a98
mov rcx, qword [0x1402a19a8]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x1402a19b0]
mov rdx, qword [0x1402a19a8]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov eax, dword [0x140299c98]
mov ecx, dword [0x140296f94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140027bbc
mov ecx, dword [0x140288f70]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140027af7
mov rcx, qword [0x140299c88]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x140299c90]
mov rdx, qword [0x140299c88]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140027b0a
lock dec dword [rcx + 8]
je 0x140027c62
mov rsi, qword [rsi]
test rsi, rsi
je 0x140027b66
lock dec dword [rsi + 8]
jne 0x140027b66
mov rcx, qword [rsi]
mov rax, qword [rcx + 8]
lea rdx, [0x1401d6b00]
cmp qword [rcx + 0x10], rdx
jne 0x140027ba4
lea rcx, [0x1401ed3e0]
cmp rax, rcx
jne 0x140027ba4
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140027b4a
lock dec dword [rcx]
je 0x140027c58
mov rdi, qword [rsi + 0x10]
test rdi, rdi
je 0x140027b58
lock dec dword [rdi]
je 0x140027b6e
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140172a44
nop
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rdi + 0x20]
mov rax, qword [0x14028a5a0]
and rax, rcx
cmp rax, qword [0x14028a588]
je 0x140027c6c
mov qword [rdi + 0x20], 0
lea rcx, [rdi + 8]
call fcn.14000b2f0
mov rcx, rdi
call fcn.140172a44
jmp 0x140027b58
mov r8, qword [case.0x1401d7990.0]
mov rcx, rsi
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp r8
lea rcx, [0x140299c98]
call fcn.140172b08
cmp dword [0x140299c98], 0xffffffff
jne 0x140027abd
mov qword [0x140299c90], 0
lea rcx, [0x140299c88]
mov qword [0x140299c88], 0xffffffffffffffff
xor edx, edx
call fcn.140002400
lea rcx, [0x140299c98]
call fcn.140172aa8
jmp 0x140027abd
lea rcx, [0x1402a19b8]
call fcn.140172b08
cmp dword [0x1402a19b8], 0xffffffff
jne 0x140027a5e
mov qword [0x1402a19b0], 0
lea rcx, [0x1402a19a8]
mov qword [0x1402a19a8], 0xffffffffffffffff
xor edx, edx
call fcn.140002400
lea rcx, [0x1402a19b8]
call fcn.140172aa8
jmp 0x140027a5e
call fcn.140172a44
jmp 0x140027b4a
call fcn.14011cbd0
jmp 0x140027b0a
call fcn.1400ebe70
jmp 0x140027b89
Function at 0x140027c80
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rax, [0x14025f090]
mov qword [rcx], rax
cmp byte [rcx + 0x58], 0
je 0x140027cfb
mov eax, dword [0x140299c20]
mov ecx, dword [0x140296f94]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140027d83
mov ecx, dword [0x140288f70]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140027cfb
mov rcx, qword [0x140299c10]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x140299c18]
mov rdx, qword [0x140299c10]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
lea rax, [rsi + 0x38]
mov rcx, qword [rsi + 0x40]
cmp rcx, rax
jne 0x140027dd1
mov rdi, qword [rsi + 0x20]
test rdi, rdi
jne 0x140027d34
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140027e0a
mov qword [rsi + 0x10], rcx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140172a44
mov rbx, qword [rsi + 0x28]
mov rcx, rdi
cmp rbx, rdi
jne 0x140027d52
mov qword [rsi + 0x28], rdi
call fcn.140172a44
jmp 0x140027d15
call fcn.1400e5d90
jmp 0x140027d6d
lea r14, [rbx - 8]
mov rcx, qword [rbx - 8]
mov rax, qword [0x14028a5a0]
and rax, rcx
cmp rax, qword [0x14028a588]
je 0x140027d4b
mov qword [rbx - 8], 0
mov rbx, r14
cmp r14, rdi
jne 0x140027d52
mov rcx, qword [rsi + 0x20]
jmp 0x140027d40
lea rcx, [0x140299c20]
call fcn.140172b08
cmp dword [0x140299c20], 0xffffffff
jne 0x140027cc1
mov qword [0x140299c18], 0
lea rcx, [0x140299c10]
mov qword [0x140299c10], 0xffffffffffffffff
xor edx, edx
call fcn.140002400
lea rcx, [0x140299c20]
call fcn.140172aa8
jmp 0x140027cc1
xorps xmm0, xmm0
cmp qword [rcx + 0x10], 0
je 0x140027dff
mov qword [rcx + 0x10], 0
mov rdx, qword [rcx]
mov r8, qword [rcx + 8]
mov qword [rdx + 8], r8
mov rdx, qword [rcx]
mov r8, qword [rcx + 8]
mov qword [r8], rdx
movups xmmword [rcx], xmm0
mov rcx, qword [rsi + 0x40]
cmp rcx, rax
je 0x140027d0c
jmp 0x140027dd4
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret