joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037b10
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.140078938
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x140037f30]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140037bb1
test rbp, rbp
je 0x140037bdc
mov qword [rbp], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400797f0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x140037bca
mov ebp, eax
cmp eax, 0x5af
je 0x140037bca
cmp ebp, 0xe
jne 0x140037be7
mov rcx, r15
call fcn.1400ccb30
mov rcx, r14
call fcn.140078974
jmp 0x140037b8f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140037b8f
mov eax, dword [0x1401143a0]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140037c56
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, ebp
call fcn.140036060
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x140114398]
call fcn.14006d7c0
cmp byte [rsi + 0x17], 0
jns 0x140037bd2
mov rcx, qword [rsp + 0x38]
call fcn.140078974
jmp 0x140037bd2
lea rcx, [0x1401143a0]
call fcn.140078a90
cmp dword [0x1401143a0], 0xffffffff
jne 0x140037c08
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140043c30
mov qword [0x140114398], rax
lea rcx, [0x1401143a0]
call fcn.140078b28
jmp 0x140037c08
Function at 0x14003e790
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x38]
mov rsi, qword [rcx + 0x40]
cmp rbx, rsi
jne 0x14003e7b8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, r8
mov edi, edx
cmp dword [rbx + 0x68], edx
jne 0x14003e840
cmp byte [rbx + 0x27], 0
jns 0x14003e7ce
mov rcx, qword [rbx + 0x10]
jmp 0x14003e7d2
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x14003e840
mov r15, qword [r14 + 8]
cmp r15, qword [r14 + 0x10]
je 0x14003e913
movups xmm0, xmmword [rbx]
movups xmmword [r15], xmm0
lea rcx, [r15 + 0x10]
lea rdx, [rbx + 0x10]
call fcn.140059cc0
lea rcx, [r15 + 0x28]
cmp byte [rbx + 0x3f], 0
js 0x14003e901
lea rax, [rbx + 0x28]
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov rax, qword [rbx + 0x60]
mov qword [r15 + 0x60], rax
movups xmm0, xmmword [rbx + 0x40]
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [r15 + 0x50], xmm1
movups xmmword [r15 + 0x40], xmm0
add r15, 0x68
mov qword [r14 + 8], r15
add rbx, 0x70
cmp rbx, rsi
je 0x14003e7aa
mov r15, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], edi
jne 0x14003e8ef
cmp byte [rbx + 0x27], 0
jns 0x14003e869
mov rcx, qword [rbx + 0x10]
jmp 0x14003e86d
lea rcx, [rbx + 0x10]
call r15
test al, 0x10
jne 0x14003e8ef
mov r12, qword [r14 + 8]
cmp r12, qword [r14 + 0x10]
je 0x14003e8b0
movups xmm0, xmmword [rbx]
movups xmmword [r12], xmm0
lea rcx, [r12 + 0x10]
lea rdx, [rbx + 0x10]
call fcn.140059cc0
lea rcx, [r12 + 0x28]
cmp byte [rbx + 0x3f], 0
js 0x14003e8bd
mov rax, qword [rbx + 0x38]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbx + 0x28]
movups xmmword [rcx], xmm0
jmp 0x14003e8ca
mov rcx, r14
mov rdx, rbx
call fcn.1400d3130
jmp 0x14003e8ef
mov rdx, qword [rbx + 0x28]
mov r8, qword [rbx + 0x30]
call fcn.140056fa0
mov rax, qword [rbx + 0x60]
mov qword [r12 + 0x60], rax
movups xmm0, xmmword [rbx + 0x40]
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [r12 + 0x50], xmm1
movups xmmword [r12 + 0x40], xmm0
add r12, 0x68
mov qword [r14 + 8], r12
add rbx, 0x70
cmp rsi, rbx
je 0x14003e7aa
jmp 0x14003e854
mov rdx, qword [rbx + 0x28]
mov r8, qword [rbx + 0x30]
call fcn.140056fa0
jmp 0x14003e81e
mov rcx, r14
mov rdx, rbx
call fcn.1400d3130
jmp 0x14003e840
Function at 0x14003f300
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
mov rcx, qword [r8]
cmovns rcx, r8
lea rdx, [rsp + 0x60]
mov qword [rdx], rcx
cmovs rax, qword [r8 + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.14005cd00
cmp byte [rsi + 0x17], 0
jns 0x14003f35b
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.14005cd00
cmp byte [rdi + 0x17], 0
jns 0x14003f380
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x14003f39f
mov rcx, qword [rsp + 0x48]
call fcn.140078974
cmp byte [rsp + 0x87], 0
jns 0x14003f3b3
mov rcx, qword [rsp + 0x70]
call fcn.140078974
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400797f0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003f460
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.14005cd00
cmp byte [rdi + 0x17], 0
jns 0x14003f4a1
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x14003f4c2
mov rcx, qword [rsp + 0x58]
call fcn.140078974
test r14, r14
je 0x14003f56e
test edi, edi
je 0x14003f56e
mov ecx, edi
add rcx, rcx
call fcn.1400789ac
mov rbx, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.14005cd00
cmp byte [rsi + 0x17], 0
jns 0x14003f503
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x14003f523
mov rcx, qword [rsp + 0x58]
call fcn.140078974
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x14003f58c
mov rcx, rbx
call fcn.140092480
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.14005d050
cmp byte [r14 + 0x17], 0
js 0x14003f590
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
test rbx, rbx
je 0x14003f56e
mov rcx, rbx
call fcn.1400789b4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400797f0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x14003f535
mov rcx, qword [r14]
call fcn.140078974
jmp 0x14003f54f
Function at 0x14003fee0
Capabilities:
Check os version

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x178], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x14003ffbc
and eax, 0xfeff
cmp eax, 6
je 0x14003ffbc
mov eax, dword [0x140116558]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14003ff83
lea rcx, [0x140116558]
call fcn.140078a90
cmp dword [0x140116558], 0xffffffff
jne 0x14003ff83
lea rcx, str.kernel32.dll
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.1400402c0
mov qword [0x140116550], rax
lea rcx, [0x140116558]
call fcn.140078b28
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x140116550]
mov esi, eax
test eax, eax
je 0x14003ffc9
test esi, esi
setne bl
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400797f0
mov eax, ebx
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov bl, 1
jmp 0x14003ff9f
mov ecx, 2
call fcn.140064750
test al, al
je 0x14003ff9a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x21
mov r9d, 2
call fcn.1400cb600
lea rcx, [rsp + 0x40]
lea rdx, str.InitializeCriticalSectionEx
mov r8d, 0x1b
call fcn.140051090
mov rcx, rdi
call fcn.1400cb6f0
jmp 0x14003ff9a

Function at 0x140040330
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401165a0]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004038c
movzx eax, word [0x140116570]
cmp ax, 9
jne 0x1400403ee
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400797f0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1401165a0]
call fcn.140078a90
cmp dword [0x1401165a0], 0xffffffff
jne 0x140040365
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x140116590], xmm2
movups xmmword [0x140116580], xmm1
movups xmmword [0x140116570], xmm0
lea rcx, [0x1401165a0]
call fcn.140078b28
jmp 0x140040365
xor esi, esi
test ax, ax
je 0x140040377
cmp ax, 6
jne 0x140040405
mov esi, 2
jmp 0x140040377
cmp ax, 0xc
jne 0x140040415
mov esi, 3
jmp 0x140040377
mov esi, 4
jmp 0x140040377
Function at 0x140040550
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400405c3
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400405c3
cmp dword [rsp + 0x38], 4
jne 0x1400405c3
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400797f0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x1400405e0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140079780
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14007c0b0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140040693
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140040697
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.140058750
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400797f0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140040674
cmp eax, 2
jne 0x1400406dc
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14007c0b0
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x1400406e3
lea rdx, [rsp + 0x40]
jmp 0x14004066a
mov edi, 0x3f4
jmp 0x140040674
mov edi, 0xea
jmp 0x140040674
Function at 0x140041a10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401165c0]
cmp rdi, 1
jbe 0x140041a39
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14006d450
lea rcx, [0x1401165c0]
call fcn.1400407a0
test al, al
je 0x140041a7f
mov qword [0x1401165c8], 0
lea rbx, [0x1401165c0]
lea rdi, [0x1401165c8]
mov rcx, rdi
xor edx, edx
call fcn.140042ce0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140040840
jmp 0x140041a27
mov rdi, qword [0x1401165c0]
jmp 0x140041a27

Function at 0x140042b80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14010f5d8]
cmp ecx, 0xffffffff
je 0x140042ba5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x140042ba0

Function at 0x140042bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.140079780
sub rsp, rax
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x14010f5d8]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x140042c64
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140042c93
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14007c0b0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400789ac
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14007bca0
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400797f0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1400489a0
test al, al
je 0x140042c96
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140042c99
mov eax, 0xffffffff
lock cmpxchg dword [0x14010f5d8], ecx
jne 0x140042cbe
mov ecx, dword [rsp + 0x2c]
jmp 0x140042be8
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.1400489a0
test al, al
je 0x140042cd6
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140042cd6
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x140042c7b
mov ecx, dword [rsp + 0x2c]
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x14010f5d8]
mov dword [rsp + 0x2c], ecx
jmp 0x140042be8
int3
Function at 0x140042ce0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov eax, 0xffffffff
mov qword [rcx], rax
mov ecx, dword [0x14010f5d8]
cmp ecx, 0xffffffff
je 0x140042dc2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140042dc2
mov eax, dword [0x140117e68]
mov ecx, dword [0x14010f734]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140042dcc
mov rbx, qword [0x140117e60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140042e12
mov rax, qword [0x140116658]
inc rax
xor ecx, ecx
lea r8, [0x140116660]
lea edx, [rax + rcx]
movzx edi, dl
lea rdx, [rdi + rdi*2]
cmp dword [r8 + rdx*8], 0
jne 0x140042e1f
lea rax, [r8 + rdx*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x140116658], rdi
mov dword [rsi], edi
mov eax, dword [rax + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
cmp eax, 0xffffffff
je 0x140042e34
cmp eax, 0x100
jge 0x140042e37
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140042bb0
jmp 0x140042d14
lea rcx, [0x140117e68]
call fcn.140078a90
cmp dword [0x140117e68], 0xffffffff
jne 0x140042d39
mov ecx, 8
call fcn.140078938
mov rbx, rax
mov rcx, rax
call fcn.14005e210
mov qword [0x140117e60], rbx
lea rcx, [0x140117e68]
call fcn.140078b28
jmp 0x140042d39
mov rcx, rbx
call fcn.14005e220
jmp 0x140042d51
inc rcx
cmp rcx, 0x100
jne 0x140042d64
jmp 0x140042d96
int3
int3

Function at 0x1400469b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovb eax, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140046a18
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x140046a21
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400797f0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x140046a01
int3
mov rcx, qword [rcx + 8]
jmp 0x1400469b0
Function at 0x140046a30
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov ecx, 0xffffffff
cmp r8, rcx
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x140046ad8
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140046ac7
cmp eax, 0xffffffff
je 0x140046aec
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400797f0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x140046a76
mov eax, dword [rsp + 0x2c]
jmp 0x140046aa7
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x140046aa9
int3

Function at 0x140046f80
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.140046ea0
test rax, rax
jne 0x140046fbf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x140046fdb
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400797f0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140064750
test al, al
je 0x140047031
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xf4
mov r9d, 2
call fcn.1400cb600
lea rcx, [rsp + 0x38]
lea rdx, [0x1400f9a92]
mov r8d, 0xc
call fcn.140051090
mov rcx, rsi
call fcn.1400cb6f0
xor esi, esi
jmp 0x140046fbf

Function at 0x1400474c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovb eax, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140046a18
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x140046a21
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400797f0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x140046a01
int3
mov rcx, qword [rcx + 8]
jmp 0x1400469b0

Function at 0x1400489a0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400489b5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x14004aa90
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1401180c0], 0
jne 0x14004aacd
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14004aac0
mov dword [rdi], eax
mov dword [0x1401180c8], eax
mov qword [0x1401180c0], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x14004c250
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r12, rdx
mov r13, rcx
lea r15, [rcx + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14004c431
mov r8, qword [r13 + 0x28]
test r8, r8
je 0x14004c3cf
mov rax, r12
shr rax, 0x20
lea edx, [r12*8]
add rdx, 8
xor rdx, rax
movabs rbx, 0x9ddfea08eb382d69
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rdx, rax
xor rdx, rcx
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rbx
mov rax, r8
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, r8
sub rax, rdx
movabs rdx, 0x3333333333333333
mov rbx, rax
and rbx, rdx
shr rax, 2
and rax, rdx
add rax, rbx
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs rdi, 0x101010101010101
imul rdi, rax
shr rdi, 0x38
cmp rdi, 1
ja 0x14004c43e
lea rbx, [r8 - 1]
and rbx, rcx
mov rax, qword [r13 + 0x20]
mov rax, qword [rax + rbx*8]
test rax, rax
je 0x14004c3cf
mov rsi, qword [rax]
test rsi, rsi
je 0x14004c3cf
lea r9, [r8 - 1]
mov rax, qword [rsi + 8]
cmp rax, rcx
jne 0x14004c3b6
cmp qword [rsi + 0x10], r12
jne 0x14004c3c7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [0x1401189c0]
cmp rdi, 1
jbe 0x14004c3e8
mov rcx, rdi
call fcn.14006d410
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call fcn.14006d450
mov rcx, qword [r14 + 0x28]
mov rdx, r12
call qword [rcx + 8]
mov rcx, rdi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14006d450
cmp edi, 1
ja 0x14004c45a
and rax, r9
cmp rax, rbx
jne 0x14004c3cf
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14004c357
mov rcx, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea rcx, [0x1401189c0]
call fcn.1400407a0
test al, al
je 0x14004c470
mov qword [0x1401189c8], 0
lea rbx, [0x1401189c0]
lea rdi, [0x1401189c8]
mov rcx, rdi
xor edx, edx
call fcn.140042ce0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140040840
jmp 0x14004c37c
mov rcx, r15
call fcn.14005e220
jmp 0x14004c27d
mov rbx, rcx
cmp rcx, r8
jb 0x14004c33a
mov rax, rcx
xor edx, edx
div r8
mov rbx, rdx
jmp 0x14004c33a
cmp rax, r8
jb 0x14004c3c2
xor edx, edx
div r8
mov rax, rdx
jmp 0x14004c3c2
mov rdi, qword [0x1401189c0]
jmp 0x14004c37c
Function at 0x14004c920
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401189a8]
cmp rdi, 1
jbe 0x14004c949
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14006d450
lea rcx, [0x1401189a8]
call fcn.1400407a0
test al, al
je 0x14004c98f
mov qword [0x1401189b0], 0
lea rbx, [0x1401189a8]
lea rdi, [0x1401189b0]
mov rcx, rdi
xor edx, edx
call fcn.140042ce0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140040840
jmp 0x14004c937
mov rdi, qword [0x1401189a8]
jmp 0x14004c937