joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a3f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x14001a436
mov r15, rbx
test r15, r15
je 0x14001a511
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x14001a492
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x14001a481
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.14010c000
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x14001a412
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14001a52d
lea rcx, [r13*8]
call fcn.1400d2b88
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x14001a4f3
xor r15d, r15d
mov r8, rcx
add r8, r15
je 0x14001a511
mov r9, qword [r14 + r15]
mov qword [r8], r9
add r15, 8
cmp rdx, r15
jne 0x14001a4d8
add r15, rcx
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x14001a513
add rbx, 0xfffffffffffffff8
jne 0x14001a506
ud2
test r12, r12
je 0x14001a412
mov rcx, r12
call fcn.1400d2b80
mov r15, qword [rsi + 0x10]
jmp 0x14001a412
call fcn.140111390
int3
Function at 0x14001e340
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x14020f888]
mov ecx, dword [0x1402053a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001e475
mov ecx, dword [0x1402047a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14001e3a1
mov rcx, qword [0x14020f878]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14020f880]
jne 0x14001e3a1
add rax, rcx
cmp qword [rax], 0
jne 0x14001e434
mov ecx, 4
call fcn.1400d2b88
mov rsi, rax
mov dword [rax], 0
mov ecx, dword [0x1402047a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14001e46e
mov rcx, qword [0x14020f878]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14020f880]
jne 0x14001e46e
add rax, rcx
mov rdi, qword [rax]
mov ecx, dword [0x1402047a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x14001e407
test rsi, rsi
je 0x14001e42b
call fcn.140013680
mov rcx, qword [0x14020f878]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14020f880]
mov rdx, qword [0x14020f878]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
test rdi, rdi
jne 0x14001e4c8
mov ecx, dword [0x1402047a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14001e46a
mov rcx, qword [0x14020f878]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14020f880]
jne 0x14001e46a
add rax, rcx
mov rax, qword [rax]
add rsp, 0x28
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14001e463
xor edi, edi
jmp 0x14001e3eb
lea rcx, [0x14020f888]
call fcn.1400d2c50
cmp dword [0x14020f888], 0xffffffff
jne 0x14001e36b
mov qword [0x14020f880], 0
lea rcx, [0x14020f878]
mov qword [0x14020f878], 0xffffffffffffffff
lea rdx, [0x14004bac0]
call fcn.140028300
lea rcx, [0x14020f888]
call fcn.1400d2be4
jmp 0x14001e36b
mov rcx, rdi
call fcn.1400d2b80
jmp 0x14001e434
Function at 0x140028300
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402047a0]
cmp ecx, 0xffffffff
je 0x1400283da
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x1400283da
mov eax, dword [0x14020ec40]
mov ecx, dword [0x1402053a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400283e4
mov rbx, qword [0x14020ec38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140028429
mov rax, qword [0x14020d428]
inc rax
xor ecx, ecx
lea rdx, [0x14020d430]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x140028436
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x14020ec30]
inc ecx
mov dword [0x14020ec30], ecx
mov dword [rax + 0x14], ecx
mov qword [0x14020d428], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x140028426
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140013680
jmp 0x14002832a
lea rcx, [0x14020ec40]
call fcn.1400d2c50
cmp dword [0x14020ec40], 0xffffffff
jne 0x14002834f
mov ecx, 8
call fcn.1400d2b88
mov qword [rax], 0
mov qword [0x14020ec38], rax
lea rcx, [0x14020ec40]
call fcn.1400d2be4
jmp 0x14002834f
int3
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x140028367
inc rcx
cmp rcx, 0x100
jne 0x14002837a
jmp 0x1400283c0

Function at 0x14002a030
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14002a079
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14002a095
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002a071
mov qword [rsi], rdi
call fcn.140078a00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14002a107
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140078a00
mov r14, qword [rsi]
cmp qword [0x140208550], 0
je 0x14002a0c6
mov rcx, qword [0x140208550]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1401e8220]
mov qword [rsi], 0
jmp 0x14002a05f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1401da154]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002a10a
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14002a101
call qword [0x1401e8220]
mov rcx, rax
xor edx, edx
call fcn.14002a2a0
jmp 0x14002a0a7
xor ecx, ecx
mov dl, 1
jmp 0x14002a0fa
int3
xor ecx, ecx
jmp 0x14002a0f8
Function at 0x14002a200
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14002a22a
call fcn.140078a00
cmp qword [rsi], r14
je 0x14002a259
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14002a27e
cmp r15, 2
jb 0x14002a251
mov qword [rsi], r14
call fcn.140078a00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14002a294
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140078a00
mov rcx, qword [rsi]
call fcn.1400c59e0
mov qword [rsi], 0
jmp 0x14002a243
mov rcx, rdi
call fcn.1400c89e0
jmp 0x14002a26f

Function at 0x14002a480
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x14002a5b1
lea rax, [rsp + 0x35]
mov byte [rax + 2], 0x15
lea rcx, str.ExitCodeWatcherThread
lea rdx, [rsp + 0x20]
cmp rdx, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14002a5af
lea rcx, [rsi + 0x10]
movups xmm0, xmmword [str.ExitCodeWatcherThread]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
movabs rax, 0x6461657268547265
mov qword [rdi + 0xd], rax
mov byte [rdi + 0x15], 0
mov rdx, rdi
call fcn.14002a5d0
cmp byte [rdi + 0x17], 0
js 0x14002a5b4
mov dword [rsi + 0x90], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x98], 0
test rax, rax
je 0x14002a579
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x98]
inc rax
cmp rax, 2
jae 0x14002a591
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002a571
mov qword [rsi + 0x98], rdi
call fcn.140078a00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d4e20
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.140078a00
mov rcx, qword [rsi + 0x98]
call fcn.1400c59e0
mov qword [rsi + 0x98], 0
jmp 0x14002a55b
ud2
int3
mov rcx, qword [rsp + 0x20]
call fcn.1400d2b80
jmp 0x14002a513
Function at 0x140033280
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x178], rax
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
lea rax, [0x1401c9660]
mov qword [rcx], rax
lea rax, [0x1401c8578]
mov qword [rcx + 0x18], rax
xor ecx, ecx
mov qword [rsi + 0x20], rcx
mov byte [rsi + 0x28], cl
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rcx
mov byte [rsi + 0x40], cl
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [rsi + 0x20]
test rcx, rcx
setne al
cmp rcx, rdi
sete dl
and dl, al
cmp dl, 1
je 0x1400333c9
test rcx, rcx
jne 0x1400333ce
mov qword [rsi + 0x20], rdi
cmp dword [0x140208460], 3
setl al
test rdi, rdi
sete cl
and cl, al
cmp cl, 1
je 0x1400333e2
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [rsi + 0x38]
test rcx, rcx
setne al
cmp rcx, rdi
sete dl
and dl, al
cmp dl, 1
je 0x1400333c9
test rcx, rcx
jne 0x1400333d8
mov qword [rsi + 0x38], rdi
cmp dword [0x140208460], 3
setl al
test rdi, rdi
sete cl
and cl, al
cmp cl, 1
je 0x14003342f
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400784e0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14003347c
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400d4e20
mov rax, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
call fcn.1400eb400
call fcn.140078400
jmp 0x140033309
call fcn.140078400
jmp 0x14003335a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwin_session_end_watcher.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x5b
mov r9d, 2
call fcn.1401357a0
lea rcx, [rsp + 0x48]
lea rdx, str.CreateEvent
mov r8d, 0xb
call fcn.1400d0590
mov rcx, rdi
call fcn.140135810
jmp 0x140033328
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwin_session_end_watcher.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x5e
mov r9d, 2
call fcn.1401357a0
lea rcx, [rsp + 0x48]
lea rdx, str.CreateEvent
mov r8d, 0xb
call fcn.1400d0590
mov rcx, rdi
call fcn.140135810
jmp 0x140033379
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r9d, 0x1b
call fcn.1400916b0
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov rdx, rdi
call fcn.1401381b0
lea rdx, [0x1401df310]
mov rcx, rbx
call fcn.14015eaa0
mov rcx, rbx
call fcn.14010dab0
jmp 0x1400333ab
Function at 0x140034460
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1401c7000]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
jne 0x140034504
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x1400344b0
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400d4e20
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.14010c6a0
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x1400344a7
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
call fcn.140180970
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x1400344a7
Function at 0x140035960
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400359f3
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140035a07
cmp eax, 0xffffffff
je 0x1400359f0
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d4e20
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400359d2
mov rcx, rdi
call r15
cmp eax, 3
jne 0x140035a38
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400359c3
jmp 0x1400359f3
mov eax, dword [rsp + 0x2c]
jmp 0x1400359d0

Function at 0x140035bb0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x140035bc5
mov r8d, r8d
add rsp, 0x28
jmp fcn.140035bf0
test r8d, r8d
jne 0x140035be4
lea rcx, [0x14020b408]
lea rdx, [0x140077930]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
add rsp, 0x28
ret
Function at 0x14003c7c0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x10040
call fcn.1400d4dc0
sub rsp, rax
mov rsi, rdx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x10038], rax
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rax
mov r8, rdi
call fcn.1400aea80
test rsi, rsi
jne 0x14003c860
cmp byte [rsp + 0x37], 0
js 0x14003c81d
lea rcx, [rsp + 0x20]
jmp 0x14003c822
mov rcx, qword [rsp + 0x20]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
cmp byte [rsp + 0x37], 0
jns 0x14003c843
mov rcx, qword [rsp + 0x20]
call fcn.1400d2b80
mov rcx, qword [rsp + 0x10038]
xor rcx, rsp
call fcn.1400d4e20
mov eax, ebx
add rsp, 0x10040
pop rbx
pop rdi
pop rsi
ret
lea rbx, [rsp + 0x3a]
mov r8d, 0xfffe
mov rcx, rbx
mov dl, 0xaa
call fcn.14010c6a0
cmp byte [rsp + 0x37], 0
jns 0x14003c881
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x14003c832
cmp eax, 0x7fff
jae 0x14003c8b2
mov edx, eax
lea rcx, [rsp + 0x3a]
mov r8, rsi
call fcn.140131580
jmp 0x14003c832
int3
Function at 0x140040400
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rcx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov ecx, 0x65c2937b
xor eax, eax
lock cmpxchg dword [rsi], ecx
jne 0x1400405a8
mov dword [0x140206810], ebx
lea rbp, [0x140206810]
movabs rax, 0x100000000
mov qword [0x140206930], rax
movaps xmm6, xmmword [0x1401c7000]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov r14, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, rdi
call r14
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [0x140206938], rcx
mov r15d, 0x20
mov qword [0x140206940], r15
mov r12d, 0x40
mov qword [0x140206948], r12
mov dword [0x140206950], ebx
mov qword [0x140206818], rbx
lea rax, [0x140206818]
mov r13, 0xffffffffb37cc16a
xor rax, r13
mov qword [0x140206820], rax
mov qword [0x140206828], rbp
mov dword [0x140206838], ebx
lea rcx, [0x140206840]
mov r8d, 0xf0
xor edx, edx
call fcn.14010c6a0
mov dword [0x140206958], ebx
lea rbp, [0x140206958]
mov qword [0x140206a78], rbx
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdi, [rsp + 0x20]
mov rcx, rdi
call r14
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [0x140206a80], rcx
mov qword [0x140206a88], r15
mov qword [0x140206a90], r12
mov dword [0x140206a98], ebx
mov qword [0x140206960], rbx
lea rax, [0x140206960]
xor rax, r13
mov qword [0x140206968], rax
mov qword [0x140206970], rbp
mov dword [0x140206980], ebx
lea rcx, [0x140206988]
mov r8d, 0xf0
xor edx, edx
call fcn.14010c6a0
mov eax, 0xdd
xchg dword [rsi], eax
cmp eax, 0x5a308d2
je 0x1400405c8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d4e20
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r9d, edx
lea r8, [0x1401cc2a0]
mov rcx, rsi
mov edx, 3
call fcn.140040800
test eax, eax
jne 0x140040585
jmp 0x14004043a
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d4e20
mov rcx, rsi
mov dl, 1
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14010eaf0
Function at 0x140041710
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140041737
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140041771
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140041790
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400d4e20
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140041870
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400d4e20
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140076b30
test al, al
je 0x14004185b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x265
mov r9d, 2
call fcn.1401357a0
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400d0590
mov rdi, rax
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x1400417f3
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
test rax, rax
js 0x140041862
sete al
test rsi, rsi
setne cl
or cl, al
je 0x140041862
lea rsi, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400c70a0
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x140041835
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400d0590
cmp byte [rsp + 0x57], 0
jns 0x140041851
mov rcx, qword [rsp + 0x40]
call fcn.1400d2b80
lea rcx, [rsp + 0x58]
call fcn.140135810
xor esi, esi
jmp 0x140041774
ud2

Function at 0x140041870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x140041897
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004193d
mov dil, 1
test al, 0x10
je 0x1400418c9
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400d4e20
mov eax, edi
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140076b30
test al, al
je 0x140041936
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.140134ae0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400d0590
mov rcx, rax
mov rdx, rsi
call fcn.140136a60
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400d0590
mov rcx, rdi
call fcn.140134e30
xor edi, edi
jmp 0x1400418ad
mov ecx, 2
call fcn.140076b30
test al, al
je 0x140041936
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.1401357a0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400d0590
mov rcx, rax
mov rdx, rsi
call fcn.140136a60
mov rcx, rdi
call fcn.140135810
jmp 0x140041936
Function at 0x1400448f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov sil, 1
test r8, r8
je 0x140044976
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r12d, 0xffffffff
lea r15, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, r12
mov r8d, 0xffffffff
cmovb r8, rdi
mov dword [rsp + 0x30], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rbx
mov r9, r15
call r13
test eax, eax
je 0x14004499e
mov eax, dword [rsp + 0x30]
cmp rax, r12
je 0x14004499b
add rbx, rax
sub rdi, rax
jne 0x140044937
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400d4e20
mov eax, esi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
cmp dword [0x140208460], 2
jg 0x1400449ef
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x8c
mov r9d, 2
call fcn.1401357a0
lea rcx, [rsp + 0x40]
lea rdx, [0x1401e14b8]
mov r8d, 9
call fcn.1400d0590
mov rcx, rsi
call fcn.140135810
xor esi, esi
jmp 0x140044976

Function at 0x140047110
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1401f6040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140047aa0
mov rax, qword [rsi]
test rax, rax
je 0x140047187
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14004718e
lea rcx, [rsp + 0x28]
call fcn.1400471f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d4e20
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140047160
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
jne 0x1400471b2
cmp byte [rbx + 0x27], 0
js 0x1400471a7
lea rcx, [rbx + 0x10]
jmp 0x1400471ab
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x1400471bd
add rbx, 0x70
cmp rbx, r15
je 0x140047160
jmp 0x140047195
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x1400471dc
mov rcx, r14
mov rdx, rbx
call fcn.14015ad90
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x1400471b2
mov rcx, rdi
mov rdx, rbx
call fcn.14015ac40
mov r14, rax
jmp 0x1400471d6