joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065940
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401d8650]
cmp rdi, 1
jbe 0x140065969
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400b71a0
lea rcx, [0x1401d8650]
call fcn.1400b0e40
test al, al
je 0x1400659af
mov qword [0x1401d8658], 0
lea rbx, [0x1401d8650]
lea rdi, [0x1401d8658]
mov rcx, rdi
xor edx, edx
call fcn.140055680
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140050cc0
jmp 0x140065957
mov rdi, qword [0x1401d8650]
jmp 0x140065957

Function at 0x140065de0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140065df5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x140066550
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x50]
mov qword [rbx + 0x50], rax
movaps xmm0, xmmword [0x1401a01c0]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.MapImageToMemory
lea r8, str..._.._base_files_memory_mapped_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x1a
call fcn.1400b0f20
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1400b6db0
mov rcx, rsi
call fcn.1400b8c10
test al, al
je 0x1400666a7
mov rcx, rsi
call fcn.140057b20
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
cmp qword [rsi + 0x40], rax
je 0x14006664f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x1400666d0
mov rax, rbx
inc rax
cmp rax, 2
jb 0x140066643
mov qword [rsi + 0x40], rbx
call fcn.1400b0f40
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi + 0x40]
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400666eb
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x1400666a7
lea rdx, fcn.140124ca0
lea rcx, [rsp + 0x30]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
call fcn.140073570
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.1400b6e10
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400d5720
mov eax, edi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400b0f40
mov rcx, qword [rsi + 0x40]
call fcn.1400b9290
mov qword [rsi + 0x40], 0
jmp 0x14006662e
xor edi, edi
jmp 0x1400666a7
Function at 0x1400666f0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x1401a01c0]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.MapFileRegionToMemory
lea r8, str..._.._base_files_memory_mapped_file_win.cc
lea rbp, [rsp + 0x40]
mov rcx, rbp
mov r9d, 0x39
call fcn.1400b0f20
xor r15d, r15d
mov rcx, rdi
mov rdx, rbp
xor r8d, r8d
call fcn.1400b6db0
mov rcx, rsi
call fcn.1400b8c10
test al, al
je 0x14006687d
test ebx, ebx
jne 0x1400668aa
mov ebx, 2
xor edi, edi
mov rcx, rsi
call fcn.140057b20
mov dword [rsp + 0x20], r15d
mov qword [rsp + 0x28], 0
mov rcx, rax
xor edx, edx
mov r8d, ebx
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
cmp qword [rsi + 0x40], rax
je 0x140066802
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x1400668c0
mov rax, rdi
inc rax
cmp rax, 2
jb 0x1400667f6
mov qword [rsi + 0x40], rdi
call fcn.1400b0f40
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x40]
inc rdi
cmp rdi, 2
jb 0x14006692c
mov dword [rsp + 0x3c], 0
lea rdx, [0x1401af288]
mov rcx, r14
call fcn.1400669d0
test al, al
je 0x1400668db
mov rcx, rsi
call fcn.140057c60
xor r15d, r15d
test rax, rax
jle 0x14006687d
mov qword [rsi + 0x38], rax
xor r8d, r8d
xor eax, eax
and ebx, 2
add ebx, 2
mov rcx, qword [rsi + 0x40]
mov qword [rsp + 0x20], rax
mov edx, ebx
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x14006692c
movsxd rcx, dword [rsp + 0x3c]
add rax, rcx
mov qword [rsi + 0x30], rax
mov r15b, 1
lea rcx, [rsp + 0x60]
call fcn.1400b6e10
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400d5720
mov eax, r15d
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp ebx, 3
jne 0x140066934
mov rcx, rsi
call fcn.140066550
mov r15d, eax
jmp 0x14006687d
call fcn.1400b0f40
mov rcx, qword [rsi + 0x40]
call fcn.1400b9290
mov qword [rsi + 0x40], 0
jmp 0x1400667e1
xor eax, eax
lea rdi, [rsp + 0x40]
mov qword [rdi], rax
lea r9, [rsp + 0x30]
mov qword [r9], rax
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov r8, rdi
call fcn.140066b60
mov r15, qword [rdi]
test r15, r15
js 0x14006692c
mov rcx, qword [r14 + 8]
movsxd rax, dword [rsp + 0x3c]
add rax, rcx
js 0x14006692c
mov r8, r15
shr r8, 0x20
mov qword [rsi + 0x38], rcx
jmp 0x140066847
xor r15d, r15d
jmp 0x14006687d
cmp ebx, 2
jne 0x14006694e
mov r15, qword [r14 + 8]
mov rdi, r15
shr rdi, 0x20
mov ebx, 4
jmp 0x140066798
cmp ebx, 1
jne 0x14006695d
mov ebx, 4
jmp 0x140066796
xor ebx, ebx
jmp 0x140066796
Function at 0x140070470
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1401da188]
mov ecx, dword [0x1401d17f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400704d0
lea rsi, [0x1401da180]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400d5720
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1401da188]
call fcn.1400d5010
cmp dword [0x1401da188], 0xffffffff
jne 0x1400704ac
lea rsi, [rsp + 0x34]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400d8590
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.1400d4eb8
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1401da1d0]
mov ecx, dword [0x1401d17f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140070590
lea r8, [0x1401da1a0]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r9d, edi
call fcn.1400706b0
mov qword [0x1401da180], rsi
lea rcx, [0x1401da188]
call fcn.1400d50a8
jmp 0x1400704ac
lea rcx, [0x1401da1d0]
call fcn.1400d5010
cmp dword [0x1401da1d0], 0xffffffff
jne 0x140070561
xorps xmm0, xmm0
movups xmmword [0x1401da1c0], xmm0
movups xmmword [0x1401da1b0], xmm0
movups xmmword [0x1401da1a0], xmm0
lea rcx, [0x1401da1a0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401da1d0]
call fcn.1400d50a8
jmp 0x140070561

Function at 0x140070600
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401da1d0]
mov ecx, dword [0x1401d17f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007063c
movzx ecx, word [0x1401da1a0]
cmp cx, 9
jne 0x140070684
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x1401da1d0]
call fcn.1400d5010
cmp dword [0x1401da1d0], 0xffffffff
jne 0x140070625
xorps xmm0, xmm0
movups xmmword [0x1401da1c0], xmm0
movups xmmword [0x1401da1b0], xmm0
movups xmmword [0x1401da1a0], xmm0
lea rcx, [0x1401da1a0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401da1d0]
call fcn.1400d50a8
jmp 0x140070625
xor eax, eax
test cx, cx
je 0x140070637
cmp cx, 6
jne 0x140070698
mov eax, 2
jmp 0x140070637
cmp cx, 0xc
jne 0x1400706a5
mov eax, 3
jmp 0x140070637
mov eax, 4
jmp 0x140070637

Function at 0x140072620
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401da230]
cmp rdi, 1
jbe 0x140072649
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400b71a0
lea rcx, [0x1401da230]
call fcn.1400b0e40
test al, al
je 0x14007268f
mov qword [0x1401da238], 0
lea rbx, [0x1401da230]
lea rdi, [0x1401da238]
mov rcx, rdi
xor edx, edx
call fcn.140055680
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140050cc0
jmp 0x140072637
mov rdi, qword [0x1401da230]
jmp 0x140072637
Function at 0x1400755d0
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x1400757cb
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x1401cb370], rax
jne 0x1400757ce
mov rsi, rcx
mov byte [rsp + 0x3f], 0xaa
lea rdi, [rcx + 0x2f8]
lea r14, [rcx + 0x48]
mov ebx, 1
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, r14
call r15
test al, al
jne 0x140075660
jmp 0x1400757b7
pause
dec eax
jne 0x14007563b
add ebp, ebx
add ebx, ebx
cmp ebx, 0x40
mov eax, 0x40
cmovge ebx, eax
cmp ebp, 0x3e8
jl 0x14007562c
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rdi]
mov rbx, qword [rax]
test rbx, rbx
je 0x14007574d
mov byte [rsp + 0x3f], 0
mov rdx, qword [rbx]
test rdx, rdx
je 0x140075746
mov ecx, dword [rsi + 0x310]
mov rdi, rdx
bswap rdi
test edi, 0x1fc000
je 0x1400757c6
mov rbp, rdi
xor rbp, rbx
cmp rbp, 0x1fffff
ja 0x1400757c6
not rdx
cmp qword [rbx + 8], rdx
jne 0x1400757c6
prefetcht0 byte [rdi]
mov qword [rax], rdi
inc word [rax + 0x18]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0xaa0]
mov qword [rsi + 0xaa0], rax
mov rcx, qword [rsi + 0xaa8]
cmp rcx, rax
cmovae rax, rcx
mov qword [rsi + 0xaa8], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rbx
mov rdx, rsi
call fcn.1400cf5e0
mov ecx, dword [0x1401dae50]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1401d17f4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x150], rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d5720
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
jmp 0x1400756bb
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov r9d, 0x2f8
mov rcx, rdi
mov rdx, rsi
mov r8d, 2
call fcn.1400a4680
test rax, rax
je 0x1400757d1
mov rbx, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x1400756c2
mov eax, ebx
test ebx, ebx
jg 0x14007563b
jmp 0x140075643
call fcn.14010ad40
int3
int3
xor ebx, ebx
jmp 0x1400756ec
Function at 0x140077c20
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140077c47
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140077c81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140077ca0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400d5720
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140077d60
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x140077d57
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x25f
mov r9d, 2
call fcn.140126e40
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400a5d10
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1400b6800
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140077d31
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a5d10
cmp byte [rsp + 0x4f], 0
jns 0x140077d4d
mov rcx, qword [rsp + 0x38]
call fcn.1400d4ef4
lea rcx, [rsp + 0x50]
call fcn.140126ec0
xor esi, esi
jmp 0x140077c84
Function at 0x140077d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140077d87
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140077db9
mov dil, 1
test al, 0x10
je 0x140077e75
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400d5720
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x140077f38
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x24a
mov r9d, 2
call fcn.140126e40
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400a5d10
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1400b6800
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140077e4a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a5d10
cmp byte [rsp + 0x5f], 0
jns 0x140077e66
mov rcx, qword [rsp + 0x48]
call fcn.1400d4ef4
lea rcx, [rsp + 0x60]
call fcn.140126ec0
jmp 0x140077f38
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x140077f38
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x24e
mov r9d, 2
call fcn.140050ec0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400a5d10
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1400b6800
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140077efd
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a5d10
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400a5d10
cmp byte [rsp + 0x5f], 0
jns 0x140077f2e
mov rcx, qword [rsp + 0x48]
call fcn.1400d4ef4
lea rcx, [rsp + 0x60]
call fcn.140051360
xor edi, edi
jmp 0x140077d9d
Function at 0x140079490
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r12, rdx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x20]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140078090
mov rax, qword [rsi]
test rax, rax
je 0x14007950b
mov rbx, qword [rax + 0x38]
mov rdi, qword [rax + 0x40]
xor esi, esi
cmp rbx, rdi
jne 0x140079512
lea rcx, [rsp + 0x20]
call fcn.140078bb0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 3
jmp 0x1400794e2
lea r14, [r12 + 0x18]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x14007952f
add rbx, 0x70
cmp rbx, rdi
je 0x1400794e2
jmp 0x14007951e
cmp byte [rbx + 0x27], 0
jns 0x14007953b
mov rcx, qword [rbx + 0x10]
jmp 0x14007953f
lea rcx, [rbx + 0x10]
call r13
test al, 0x10
jne 0x140079524
mov r15, qword [r12 + 8]
cmp r15, qword [r12 + 0x10]
je 0x14007956b
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.140079e80
add r15, 0x68
mov qword [r12 + 8], r15
jmp 0x140079524
mov rcx, r12
mov rdx, rbx
call fcn.140148150
jmp 0x140079524

Function at 0x140079580
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r12, rdx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x20]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140078090
mov rax, qword [rsi]
test rax, rax
je 0x1400795fb
mov rbx, qword [rax + 0x38]
mov rdi, qword [rax + 0x40]
xor esi, esi
cmp rbx, rdi
jne 0x140079602
lea rcx, [rsp + 0x20]
call fcn.140078bb0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 3
jmp 0x1400795d2
lea r14, [r12 + 0x18]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x14007964e
cmp byte [rbx + 0x27], 0
jns 0x140079620
mov rcx, qword [rbx + 0x10]
jmp 0x140079624
lea rcx, [rbx + 0x10]
call r13
test al, 0x10
jne 0x14007964e
mov r15, qword [r12 + 8]
cmp r15, qword [r12 + 0x10]
je 0x14007965d
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.140079e80
add r15, 0x68
mov qword [r12 + 8], r15
add rbx, 0x70
cmp rbx, rdi
je 0x1400795d2
jmp 0x14007960e
mov rcx, r12
mov rdx, rbx
call fcn.140148150
jmp 0x14007964e
Function at 0x14008e2a0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1401db528], 0
jne 0x14008e2dd
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14008e2d0
mov dword [rdi], eax
mov dword [0x1401db530], eax
mov qword [0x1401db528], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x14008f250
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovb eax, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008f2b8
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14008f2c1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d5720
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14008f2a1
int3
mov rcx, qword [rcx + 8]
jmp 0x14008f250

Function at 0x14008f2d0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov ecx, 0xffffffff
cmp r8, rcx
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x14008f378
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14008f367
cmp eax, 0xffffffff
je 0x14008f38c
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d5720
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x14008f316
mov eax, dword [rsp + 0x2c]
jmp 0x14008f347
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14008f349
int3

Function at 0x14008f810
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14008f730
test rax, rax
jne 0x14008f84f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14008f86b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14008f8c1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.140126e40
lea rcx, [rsp + 0x40]
lea rdx, [0x1401b670a]
mov r8d, 0xc
call fcn.1400a5d10
mov rcx, rsi
call fcn.140126ec0
xor esi, esi
jmp 0x14008f84f
Function at 0x14008fd60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovb eax, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008f2b8
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14008f2c1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d5720
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14008f2a1
int3
mov rcx, qword [rcx + 8]
jmp 0x14008f250