joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004efe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1b8
mov rsi, rcx
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
cmp byte [rcx + 0x17], 0
jns 0x14004f007
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004f0e6
mov dil, 1
test al, 0x10
jne 0x14004f0f6
mov ecx, 2
call fcn.14004a3e0
test al, al
je 0x14004f0f4
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x232
mov r9d, 2
call fcn.14004a490
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400048d0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.140033340
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14004f0a9
mov r8, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rcx, rdi
mov rdx, rsi
call fcn.1400048d0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400048d0
cmp byte [rsp + 0x67], 0
jns 0x14004f0da
mov rcx, qword [rsp + 0x50]
call fcn.140089d80
lea rcx, [rsp + 0x68]
call fcn.14004a920
jmp 0x14004f0f4
mov ecx, 2
call fcn.14004a3e0
test al, al
jne 0x14004f112
xor edi, edi
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14008a0f0
mov eax, edi
add rsp, 0x1b8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x22e
mov r9d, 2
call fcn.14004b090
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400048d0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x40]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.140033340
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14004f191
mov r8, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rcx, rdi
mov rdx, rsi
call fcn.1400048d0
cmp byte [rsp + 0x67], 0
jns 0x14004f1ad
mov rcx, qword [rsp + 0x50]
call fcn.140089d80
lea rcx, [rsp + 0x68]
call fcn.14004b180
jmp 0x14004f0f4
Function at 0x1400509a0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x38]
mov rsi, qword [rcx + 0x40]
cmp rbx, rsi
je 0x140050a45
mov r14, r8
mov ebp, edx
mov r15, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], ebp
jne 0x140050a3c
cmp byte [rbx + 0x27], 0
jns 0x1400509da
mov rcx, qword [rbx + 0x10]
jmp 0x1400509de
lea rcx, [rbx + 0x10]
call r15
test al, 0x10
jne 0x140050a3c
mov rdi, qword [r14 + 8]
cmp rdi, qword [r14 + 0x10]
je 0x140050a31
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
lea rcx, [rdi + 0x10]
lea rdx, [rbx + 0x10]
call fcn.14002d440
lea rcx, [rdi + 0x28]
lea rdx, [rbx + 0x28]
call fcn.140027140
movups xmm0, xmmword [rbx + 0x40]
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm1
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x60], rax
add rdi, 0x68
mov qword [r14 + 8], rdi
jmp 0x140050a3c
mov rcx, r14
mov rdx, rbx
call fcn.1400516b0
add rbx, 0x70
cmp rsi, rbx
jne 0x1400509c9
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400526f0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x140052724
mov rax, qword [r12 + 8]
test rax, rax
je 0x140052753
bt ebx, 8
jae 0x140052738
mov eax, ebx
and eax, 0x200
jne 0x140052753
cmp edi, 2
lea rax, [0x1400e4a90]
lea rcx, [0x1400e4c90]
cmove rcx, rax
cmp word [rcx], 0
je 0x140052772
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008a0f0
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x140052753
cmp byte [0x1400e4a80], 0
setne al
bt ebx, 8
jb 0x140052753
shr ebx, 9
and ebx, 1
or bl, al
je 0x140052753
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
js 0x1400527d3
mov rdi, r12
jmp 0x1400527dc
mov rdi, qword [r12]
mov rbp, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rbx, qword [rsi + 8]
mov r13, rbp
sub r13, rbx
jb 0x140052819
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.14009e044
test eax, eax
je 0x140052827
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x1400527fb
jmp 0x140052899
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x140052836
test dx, dx
jne 0x140052819
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x140052864
cmp ebp, 2
jne 0x14005285a
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x140052864
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x14005287c
dec r13
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x14005286e
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x140052820
cmp dword [rsp + 0x2c], 0
je 0x140052753
cmp byte [r12 + 0x17], 0
js 0x1400528b1
mov rax, r12
jmp 0x1400528b5
mov rax, qword [r12]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.140028b90
jmp 0x140052753
Function at 0x140054320
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
test dl, dl
je 0x14005437c
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x14005437c
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov dword [rdi], 0x18
xor ecx, ecx
call fcn.1400543e0
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], 1
jmp 0x14005437e
xor edi, edi
movzx edx, bl
shl edx, 0x13
or edx, 3
cmp byte [rsi + 0x17], 0
jns 0x140054390
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rdi
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008a0f0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140054720
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x178], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x1400547a9
and eax, 0xfeff
cmp eax, 6
je 0x1400547a9
mov eax, dword [0x1400e50c0]
mov ecx, dword [0x1400e4628]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005481a
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x1400e50b8]
mov sil, 1
test eax, eax
jne 0x1400547b5
mov ecx, 2
call fcn.14004a3e0
test al, al
jne 0x1400547d0
xor esi, esi
jmp 0x1400547b5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov sil, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14008a0f0
mov eax, esi
add rsp, 0x180
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21
mov r9d, 2
call fcn.14004b090
lea rcx, [rsp + 0x40]
lea rdx, [0x1400be5a1]
mov r8d, 0x1b
call fcn.1400048d0
mov rcx, rsi
call fcn.14004b180
jmp 0x1400547a5
lea rcx, [0x1400e50c0]
call fcn.140089ea0
cmp dword [0x1400e50c0], 0xffffffff
jne 0x14005477f
lea rcx, [0x1400baa40]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.140054b10
mov qword [0x1400e50b8], rax
lea rcx, [0x1400e50c0]
call fcn.140089f38
jmp 0x14005477f
Function at 0x140054b80
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov eax, dword [0x1400e5650]
mov ecx, dword [0x1400e4628]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054be2
lea rsi, [0x1400e5648]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14008a0f0
mov rax, rsi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1400e5650]
call fcn.140089ea0
cmp dword [0x1400e5650], 0xffffffff
jne 0x140054bbd
lea rsi, [rsp + 0x6c]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14008d400
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140089d30
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1400e5688]
mov ecx, dword [0x1400e4628]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054ca2
lea r8, [0x1400e5658]
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r9d, edi
call fcn.140054e20
mov qword [0x1400e5648], rsi
lea rcx, [0x1400e5650]
call fcn.140089f38
jmp 0x140054bbd
lea rcx, [0x1400e5688]
call fcn.140089ea0
cmp dword [0x1400e5688], 0xffffffff
jne 0x140054c73
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movups xmmword [0x1400e5678], xmm2
movups xmmword [0x1400e5668], xmm1
movups xmmword [0x1400e5658], xmm0
lea rcx, [0x1400e5688]
call fcn.140089f38
jmp 0x140054c73

Function at 0x140054d30
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1400e5688]
mov ecx, dword [0x1400e4628]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140054d8c
movzx eax, word [0x1400e5658]
cmp ax, 9
jne 0x140054dee
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008a0f0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1400e5688]
call fcn.140089ea0
cmp dword [0x1400e5688], 0xffffffff
jne 0x140054d65
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x1400e5678], xmm2
movups xmmword [0x1400e5668], xmm1
movups xmmword [0x1400e5658], xmm0
lea rcx, [0x1400e5688]
call fcn.140089f38
jmp 0x140054d65
xor esi, esi
test ax, ax
je 0x140054d77
cmp ax, 6
jne 0x140054e05
mov esi, 2
jmp 0x140054d77
cmp ax, 0xc
jne 0x140054e15
mov esi, 3
jmp 0x140054d77
mov esi, 4
jmp 0x140054d77
Function at 0x140055450
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400554d7
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400554c1
cmp dword [rsp + 0x38], 4
jne 0x1400554c1
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008a0f0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x1400554c1

Function at 0x1400554e0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rsi
push rdi
mov eax, 0x1048
call fcn.14008a080
sub rsp, rax
mov rsi, r8
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055574
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140055578
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.1400289c0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14008a0f0
mov eax, edi
add rsp, 0x1048
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x140055558
cmp eax, 2
jne 0x1400555aa
lea rcx, [rsp + 0x840]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x1400555b1
lea rdx, [rsp + 0x40]
jmp 0x14005554e
mov edi, 0x3f4
jmp 0x140055558
mov edi, 0xea
jmp 0x140055558

Function at 0x140056300
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
test r8, r8
je 0x14005637c
cmp r8, 1
jne 0x140056312
xor ecx, ecx
jmp 0x14005635e
mov r9, r8
and r9, 0xfffffffffffffffe
xor ecx, ecx
lea r10, [0x1400be7b0]
nop word cs:[rax + rax]
nop dword [rax]
movzx r11d, al
movzx esi, byte [rdx + rcx]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, al
movzx esi, byte [rdx + rcx + 1]
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add rcx, 2
cmp r9, rcx
jne 0x140056330
test r8b, 1
je 0x14005637c
movzx r8d, al
movzx ecx, byte [rdx + rcx]
xor ecx, r8d
lea rdx, [0x1400be7b0]
shr eax, 8
xor eax, dword [rdx + rcx*4]
pop rsi
ret
Function at 0x140058890
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rcx
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [0x1400c0020]
mov qword [rcx], rax
add rcx, 8
call fcn.14003c550
lea rcx, [rsi + 0x10]
call fcn.14003c550
xor edi, edi
mov byte [rsi + 0x18], dil
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], edi
call fcn.14003c550
mov byte [rsi + 0x48], dil
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rdi
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebx, 0x3f800000
mov dword [rsi + 0xd0], ebx
mov dword [rsi + 0xd8], edi
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebx
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebx
mov qword [rsi + 0x150], rdi
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x158], ebx
movups xmmword [rsi + 0x160], xmm6
movups xmmword [rsi + 0x170], xmm6
mov dword [rsi + 0x180], ebx
mov qword [rsi + 0x1a0], rdi
movups xmmword [rsi + 0x188], xmm6
mov dword [rsi + 0x198], edi
mov eax, dword [0x1400c19d0]
mov qword [rsi + 0x1a8], rax
lea rcx, [rsi + 0x1b0]
call fcn.140066750
lea rcx, [rsi + 0x2f8]
movups xmmword [rsi + 0x2e0], xmm6
mov qword [rsi + 0x2f0], rdi
xor edx, edx
call fcn.1400606c0
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.1400606c0
lea rcx, [rsi + 0x308]
xor edx, edx
call fcn.1400606c0
movups xmmword [rsi + 0x310], xmm6
movups xmmword [rsi + 0x320], xmm6
mov dword [rsi + 0x330], ebx
movups xmmword [rsi + 0x338], xmm6
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
movups xmmword [rsi + 0x361], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
call fcn.140004e20
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x198], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x190], rax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140035000
lea rbx, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
call fcn.140035060
mov rax, qword [rbx]
mov qword [rsi + 0x130], rax
mov rcx, rdi
call fcn.140034fb0
mov rcx, rsi
call fcn.140058b00
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x140058aec
call fcn.140064410
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
call fcn.140064570
mov qword [0x1400e5a90], rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008a0f0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x140058aa5
Function at 0x14005e1c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14005e1fc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14005e206
add rdi, rbx
sub rsi, rbx
jne 0x14005e1da
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x1400602b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e191c]
cmp ecx, 0xffffffff
je 0x1400602d5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400602d0

Function at 0x1400602e0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov ecx, dword [0x1400e191c]
cmp ecx, 0xffffffff
je 0x1400603b4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x1400603b4
mov eax, dword [0x1400e7308]
mov ecx, dword [0x1400e4628]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400603be
mov rbx, qword [0x1400e7300]
mov rcx, rbx
call fcn.14003c560
mov rcx, qword [0x1400e5af0]
inc rcx
mov r8d, 0x100
lea rax, [0x1400e5b00]
movzx edi, cl
lea rdx, [rdi + rdi*2]
cmp dword [rax + rdx*8], 0
jne 0x140060404
lea rcx, [rax + rdx*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1400e5af0], rdi
mov dword [rsi], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
cmp eax, 0xffffffff
je 0x14006042b
cmp eax, 0x100
jge 0x14006042e
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140060440
jmp 0x14006030c
lea rcx, [0x1400e7308]
call fcn.140089ea0
cmp dword [0x1400e7308], 0xffffffff
jne 0x140060331
mov ecx, 8
call fcn.140089d30
mov rbx, rax
mov rcx, rax
call fcn.14003c550
mov qword [0x1400e7300], rbx
lea rcx, [0x1400e7308]
call fcn.140089f38
jmp 0x140060331
lea edx, [rcx + 1]
movzx edi, dl
lea rdx, [rdi + rdi*2]
cmp dword [rax + rdx*8], 0
je 0x140060368
add rcx, 2
add r8, 0xfffffffffffffffe
jne 0x140060357
jmp 0x14006038b
int3
int3
Function at 0x140060440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14008a080
sub rsp, rax
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov ecx, dword [0x1400e191c]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1400604ec
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006052e
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14008d400
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.140089dbc
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14008cff0
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14008a0f0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.14006b6b0
test al, al
je 0x140060531
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140060534
mov eax, 0xffffffff
lock cmpxchg dword [0x1400e191c], ecx
mov ecx, dword [rsp + 0x2c]
je 0x140060470
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1400e191c]
mov dword [rsp + 0x2c], ecx
jmp 0x140060470
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.14006b6b0
test al, al
je 0x140060559
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140060559
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x140060503
int3

Function at 0x140060630
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400e191c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140060664
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140060664
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14006065e

Function at 0x140060670
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400e191c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400606ae
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x1400606a7
call fcn.140060440
jmp 0x14006068e
Function at 0x140062870
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006292e
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1400628fe
cmp eax, 0xffffffff
je 0x14006290f
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008a0f0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x140062912
mov eax, dword [rsp + 0x2c]
jmp 0x1400628de
int3
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400628d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400628e0

Function at 0x140062ff0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.140062f20
test rax, rax
jne 0x14006303f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x14006303f
mov ecx, 2
call fcn.14004a3e0
test al, al
jne 0x14006305b
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14008a0f0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xf4
mov r9d, 2
call fcn.14004b090
lea rcx, [rsp + 0x38]
lea rdx, [0x1400c03ab]
mov r8d, 0xc
call fcn.1400048d0
mov rcx, rsi
call fcn.14004b180
jmp 0x14006303d

Function at 0x14006b6b0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14006b6cd
mov dword [rsi], eax
mov al, 1
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14006b6c7