joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401dee60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1401deec1
test byte [rbx + 6], 0xf
jne 0x1401deeb4
xor edi, edi
cmp word [rbx + 4], di
jne 0x1401deeb4
cmp word [rbx + 2], di
jne 0x1401deeb4
cmp word [rbx], di
jne 0x1401deeb4
lea esi, [rdi + 1]
jmp 0x1401deeb9
mov esi, 2
movzx eax, si
jmp 0x1401df0be
xor edi, edi
test cx, cx
jne 0x1401deedc
mov rcx, rbx
call fcn.1401e3bd8
movzx ecx, ax
cmp di, ax
jl 0x1401df0bb
movsx edx, cx
test esi, esi
jle 0x1401def0c
sub ebp, edx
cmp ebp, esi
jg 0x1401def0c
movsd xmm0, qword [0x140227680]
cmp word [rbx + 6], di
jge 0x1401deefe
xorps xmm0, xmmword [0x140221750]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1401df0be
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x1401def39
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1401df0be
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, reloc.WS2_32.dll_recv
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x1401df0b0
test ebp, ebp
jns 0x1401df0b0
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x1401defd4
movzx ecx, word [rbx + 4]
mov eax, 0xfff0
movzx edx, word [rbx + 2]
sub ax, bp
shr ax, 4
movzx r9d, r11w
add ax, si
movzx r8d, ax
movzx eax, r8w
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], dx
movzx edx, cx
movzx ecx, r9w
mov r9d, edi
sub r8, rsi
jne 0x1401defa5
mov word [rbx + 4], cx
movzx r11d, di
mov word [rbx + 2], dx
neg bp
je 0x1401df053
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x1401df069
jne 0x1401df088
test byte [rbx], sil
je 0x1401df088
add word [rbx], si
jne 0x1401df088
add word [rbx + 2], si
jne 0x1401df088
add word [rbx + 4], si
jne 0x1401df088
add r11w, si
mov word [rbx + 6], r11w
jmp 0x1401def31
cmp r11w, r15w
jne 0x1401def31
cmp word [rbx + 4], di
jne 0x1401def31
cmp word [rbx + 2], di
jne 0x1401def31
cmp word [rbx], di
je 0x1401df0bb
jmp 0x1401def31
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401e83d0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r8d
mov ebp, edx
mov r8, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, qword [rcx + 0xc8]
mov dword [rsp + 0x20], edi
lea rdx, str.Entered_NaClSysSysconf__08I64xx___d__0x_08I32x__n
mov ecx, 3
mov r9d, ebp
call fcn.1401f7e70
mov ebx, 0xffffffea
cmp ebp, 0xffffff
jg 0x1401e8463
cmp ebp, 1
je 0x1401e8487
cmp ebp, 2
je 0x1401e84bc
cmp ebp, 0x10000
jne 0x1401e850d
cmp dword [rsi + 0x620], 0
jne 0x1401e850d
mov rax, qword [rsi + 0x600]
movsx ecx, byte [rax + 0x25]
movsx edx, byte [rax + 0x1c]
add edx, edx
or edx, ecx
movsx eax, byte [rax + 4]
shl eax, 2
or eax, edx
jmp 0x1401e84e8
cmp ebp, 0x1000000
je 0x1401e84c6
cmp ebp, 0x1000001
je 0x1401e84e2
cmp ebp, 0x1000002
jne 0x1401e850d
mov eax, dword [rsi + 0x620]
jmp 0x1401e84e8
mov eax, dword [0x140387080]
test eax, eax
jne 0x1401e84e8
movaps xmm0, xmmword [0x140232ef0]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 0x20]
mov dword [0x140387080], eax
jmp 0x1401e84e8
mov dword [rsp + 0x30], 0x10000
jmp 0x1401e84ec
cmp dword [0x140387068], 0
setne al
cmp qword [0x140387070], 0
setne cl
or cl, al
movzx eax, cl
jmp 0x1401e84e8
mov eax, dword [rsi + 0x61c]
mov dword [rsp + 0x30], eax
mov edx, edi
lea r8, [rsp + 0x30]
mov r9d, 4
mov rcx, rsi
call fcn.1401e6d80
xor ecx, ecx
test eax, eax
mov ebx, 0xfffffff2
cmovne ebx, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401a4270
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1401f2f20
Capabilities:
Get system information on windows

Disassembly:
mov qword [rcx], 0
jmp 0x1401f2d00
Function at 0x1401f3650
Capabilities:
Suspend thread

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x508
mov ebp, edx
mov rsi, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x500], rax
add rcx, 0xe0
call fcn.1401f7f50
cmp dword [rsi + 0xf0], 1
jne 0x1401f3743
lea rdi, [rsp + 0x30]
mov r8d, 0x4d0
mov rcx, rdi
mov dl, 0xaa
call fcn.1401a64a0
cmp dword [rsi + 0xd4], 0
jne 0x1401f36d3
lea rax, str.natp__host_thread_is_defined
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_thread_suspension.c
mov ecx, 0xfffffffc
mov r9d, reloc.WS2_32.dll_setsockopt
call fcn.1401f7e70
mov rbx, qword [rsi + 0xd8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1401f3702
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClUntrustedThreadSuspend:_SuspendThread___call_failed__error__u_n
mov ecx, 0xfffffffc
mov r8d, eax
call fcn.1401f7e70
test ebp, ebp
je 0x1401f3760
mov rdi, qword [rsi + 0xf8]
test rdi, rdi
je 0x1401f376a
mov dword [rdi + 0x30], 0x100003
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1401f3743
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClUntrustedThreadSuspend:_GetThreadContext___failed__error__u_n
mov ecx, 0xfffffffc
mov r8d, eax
call fcn.1401f7e70
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.1401a4270
nop
add rsp, 0x508
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov dword [rsp + 0x60], 0x100001
jmp 0x1401f3719
mov ecx, 0x4d0
call fcn.1401a00f0
mov rdi, rax
mov qword [rsi + 0xf8], rax
test rax, rax
jne 0x1401f3712
lea rdx, str.NaClUntrustedThreadSuspend:_malloc___failed_n
mov ecx, 0xfffffffc
call fcn.1401f7e70
mov rdi, qword [rsi + 0xf8]
jmp 0x1401f3712

Function at 0x1401f37a0
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
cmp dword [rcx + 0xf0], 1
jne 0x1401f3810
cmp dword [rsi + 0xd4], 0
jne 0x1401f37e4
lea rax, str.natp__host_thread_is_defined
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_thread_suspension.c
mov ecx, 0xfffffffc
mov r9d, reloc.WS2_32.dll_setsockopt
call fcn.1401f7e70
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1401f3810
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClUntrustedThreadResume:_ResumeThread___call_failed__error__u_n
mov ecx, 0xfffffffc
mov r8d, eax
call fcn.1401f7e70
add rsi, 0xe0
mov rcx, rsi
add rsp, 0x30
pop rsi
jmp fcn.1401f7f80
Function at 0x1401f38e0
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x30
mov eax, dword [rcx + 0x100]
test eax, eax
je 0x1401f3994
mov rsi, rcx
mov dword [rdx], eax
mov dword [rcx + 0x100], 0
mov rax, qword [rcx + 0xc8]
lock dec dword [rax + 0x70c]
cmp dword [rcx + 0xd4], 0
jne 0x1401f3943
lea rax, str.natp__host_thread_is_defined
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_thread_suspension.c
mov ecx, 0xfffffffc
mov r9d, reloc.WS2_32.dll_setsockopt
call fcn.1401f7e70
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1401f399e
cmp dword [0x1403962f4], 0
mov esi, 1
je 0x1401f3996
cmp eax, 1
ja 0x1401f3996
lea rax, str.previous_suspend_count___2
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_thread_suspension.c
mov ecx, 0xfffffffc
mov r9d, 0x97
call fcn.1401f7e70
jmp 0x1401f3996
xor esi, esi
mov eax, esi
add rsp, 0x30
pop rsi
ret
lea rdx, str.NaClAppThreadUnblockIfFaulted:_ResumeThread___call_failed_n
mov ecx, 0xfffffffc
call fcn.1401f7e70
mov esi, 1
jmp 0x1401f3996
Function at 0x1401f4c80
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1403908e0], 0
je 0x1401f4cc6
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401a4270
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1403908c0]
test rdi, rdi
je 0x1401f4d67
test byte [reloc.WS2_32.dll_accept], 1
je 0x1401f4ca9
cmp byte [rdi + 0x17], 0
jns 0x1401f4ce8
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403908e0], rax
inc rax
cmp rax, 1
ja 0x1401f4ca9
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401a64a0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401f4e28
xor esi, esi
jmp 0x1401f4ca9
mov ecx, 0x18
call fcn.1401a2e6c
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401a64a0
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x140232ef0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1400c6920
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x1401f4dcb
mov r8, qword [rdi + 8]
mov rcx, rdi
mov dx, 0x5c
call fcn.1400ba150
cmp rax, 0xffffffffffffffff
je 0x1401f4e0d
movzx ecx, byte [rdi + 0x17]
mov rdx, rcx
test cl, cl
jns 0x1401f4dec
mov rdx, qword [rdi + 8]
cmp rdx, rax
jbe 0x1401f4ef6
mov rdx, rax
inc rdx
test cl, cl
js 0x1401f4ed7
mov word [rdi + rax*2 + 2], 0
mov byte [rdi + 0x17], dl
lea rdx, str.debug.log
mov rcx, rdi
call fcn.1400ba5f0
mov qword [0x1403908c0], rdi
jmp 0x1401f4cd6
mov rcx, qword [0x1403908c0]
lea rdx, [rsp + 0x40]
call fcn.1400b98f0
mov rcx, qword [0x1403908c0]
movzx eax, byte [rcx + 0x17]
test al, al
js 0x1401f4eea
mov rdx, rcx
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1401f4e6a
lea rdx, [0x140236140]
call fcn.1400ba5f0
mov rcx, qword [0x1403908c0]
lea rdx, str.debug.log
call fcn.1400ba5f0
mov rcx, qword [0x1403908c0]
cmp byte [rcx + 0x17], 0
jns 0x1401f4e86
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403908e0], rax
inc rax
cmp rax, 1
ja 0x1401f4ca9
mov qword [0x1403908e0], 0
jmp 0x1401f4d60
mov rcx, qword [rdi]
mov word [rcx + rax*2 + 2], 0
mov qword [rdi + 8], rdx
jmp 0x1401f4e0d
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
jmp 0x1401f4e4f
mov rcx, rdi
call fcn.1400b7d70
int3
Function at 0x1401f64c0
Capabilities:
Create pipe

Disassembly:
push rsi
sub rsp, 0xa0
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140232ef0]
lea rdx, [rsp + 0x60]
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov dword [rdx + 0x2f], 0xaaaaaaaa
call fcn.14010d7e0
mov rsi, 0xffffffffffffffff
test al, al
je 0x1401f6571
lea rsi, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14010d840
cmp byte [rsi + 0x17], 0
jns 0x1401f6525
mov rsi, qword [rsp + 0x48]
mov eax, 0x1000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x3e8
mov rcx, rsi
mov edx, 0x80003
mov r8d, 1
mov r9d, 0xff
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
cmp byte [rsp + 0x5f], 0
jns 0x1401f6571
mov rcx, qword [rsp + 0x48]
call fcn.1401a2ea8
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401a4270
mov rax, rsi
add rsp, 0xa0
pop rsi
ret
Function at 0x1401f6590
Capabilities:
Connect pipe
Create pipe

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x140232ef0]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov dword [rdi + 0x2f], 0xaaaaaaaa
lea r14, str._s_u._lu
lea r15, str..pipechrome.nacl.
lea rbx, [rsp + 0x48]
mov ebp, 0x1000
mov r13, qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12d, 1
lock xadd dword [0x1403962f0], r12d
inc r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
mov edx, gethostbyname
mov rcx, rdi
mov r8, r14
mov r9, r15
call fcn.1401f6780
mov rcx, rbx
mov rdx, rdi
call fcn.14010d840
cmp byte [rsp + 0x5f], 0
mov rcx, rbx
jns 0x1401f6643
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x3e8
mov edx, 0x80003
xor r8d, r8d
mov r9d, 1
call r13
mov qword [rsi], rax
cmp byte [rsp + 0x5f], 0
jns 0x1401f6684
mov rcx, qword [rsp + 0x48]
call fcn.1401a2ea8
mov rax, qword [rsi]
cmp rax, 0xffffffffffffffff
je 0x1401f6696
cmp qword [rsi], 0xffffffffffffffff
je 0x1401f65f5
jmp 0x1401f66b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1401f668a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x1401f668a
jmp 0x1401f674d
lea rdi, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14010d840
cmp byte [rdi + 0x17], 0
jns 0x1401f66d0
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x110000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 8], rax
cmp byte [rsp + 0x5f], 0
jns 0x1401f6716
mov rcx, qword [rsp + 0x48]
call fcn.1401a2ea8
mov rax, qword [rsi + 8]
mov rcx, qword [rsi]
cmp rax, 0xffffffffffffffff
je 0x1401f6747
xor edi, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1401f6752
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1401f6752
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0xffffffff
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401a4270
mov eax, edi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401f6d60
Capabilities:
Connect pipe

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov esi, r8d
mov r12, rdx
mov rbx, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rcx, rdx
call fcn.140202020
test eax, eax
je 0x1401f6de5
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x3c]
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov ebp, 0xffffffff
test eax, eax
je 0x1401f6df5
test byte [rsp + 0x3c], 1
jne 0x1401f6e15
mov rcx, rbx
mov rdx, r12
mov r8d, esi
xor r9d, r9d
call fcn.14010da40
mov ebp, eax
jmp 0x1401f6df5
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401a4270
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
lea r15, [rsp + 0x38]
mov rcx, rbx
xor edx, edx
call rdi
test eax, eax
jne 0x1401f6e2f
call r13
cmp eax, 0x217
je 0x1401f6e6a
cmp eax, 0x218
jne 0x1401f6df0
mov dword [rsp + 0x38], 0
test sil, 1
jne 0x1401f6df0
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call r14
jmp 0x1401f6e2f
mov dword [rsp + 0x38], 0
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call r14
mov rcx, rbx
mov rdx, r12
mov r8d, esi
mov r9b, 1
call fcn.14010da40
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rsp + 0x38], 1
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
cmp ebp, 0xffffffff
jne 0x1401f6df5
call r13
cmp eax, 0x6d
jne 0x1401f6df5
test sil, 1
je 0x1401f6e2f
mov ecx, 0x218
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1401f6df5

Function at 0x1401f9ca0
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call fcn.1401b7448
test eax, eax
je 0x1401f9cc0
call fcn.1401bae2c
mov ecx, dword [rax]
call fcn.1401f7250
neg eax
add rsp, 0x28
ret
xor eax, eax
jmp 0x1401f9cbb
Function at 0x1401fa080
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
xor esi, esi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401fa0df
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401fa106
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdx, str.NaClHostDescTruncate:_could_not_truncate_file:_last_error__d._n
mov ecx, 0xfffffffd
mov r8d, eax
call fcn.1401f7e70
cmp esi, 0x4c8
jne 0x1401fa0fb
lea rdx, str.NaClHostDescTruncate:_this_is_due_to_an_existing_mapping_of_the_same_file._n
mov ecx, 0xfffffffd
call fcn.1401f7e70
jmp 0x1401fa0fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdx, str.NaClHostDescTruncate:_SetFilePointerEx_failed:_last_error__d._n
mov ecx, 0xfffffffd
mov r8d, eax
call fcn.1401f7e70
mov ecx, esi
call fcn.1401fb400
mov esi, eax
neg esi
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1401fac60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x38]
mov qword [rdi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
lea rdx, str.Entered_NaClCalibrateWindowsClockQpc_n
mov ecx, 5
call fcn.1401f7e70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rdi]
mov esi, dword [rdi + 4]
mov rax, rsi
shl rax, 0x20
or rax, rbx
movabs rcx, 0x346dc5d63886594b
mul rcx
mov r15, rdx
shr r15, 0xb
add r15, 0x3e8
mov r12, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r14, qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rsp + 0x28]
call r12
xor ebp, ebp
test eax, eax
je 0x1401fade6
lea rcx, [rsp + 0x30]
call r14
lea rcx, [rsp + 0x20]
call r12
test eax, eax
je 0x1401fade6
mov r8, qword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
mov rdi, r8
sub rdi, r9
imul rax, rdi, 0x3e8
cqo
idiv qword [r13 + 0x48]
mov r10, rax
mov edx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov ecx, eax
xor ecx, esi
mov ebp, edx
xor ebp, ebx
or ebp, ecx
setne cl
test rdi, rdi
js 0x1401fad6c
cmp r10, 4
jg 0x1401fad6c
test cl, cl
jne 0x1401fad99
test cl, cl
cmovne esi, eax
cmovne ebx, edx
shl rax, 0x20
or rax, rdx
movabs rcx, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
cmp rdx, r15
jb 0x1401facfe
xor ebp, ebp
jmp 0x1401fadb6
shl rax, 0x20
or rax, rdx
movabs rcx, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
mov ebp, 1
mov qword [r13 + 0x28], rdx
mov rax, rdi
shr rax, 0x3f
add rax, rdi
sar rax, 1
add rax, r9
mov qword [r13 + 0x50], rax
mov qword [r13 + 0x58], r8
lea rdx, str.Leaving_NaClCalibrateWindowsClockQpc_:__d_n
mov ecx, 5
mov r8d, ebp
call fcn.1401f7e70
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401a4270
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401ffcd0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbp, qword [0x140396848]
test rbp, rbp
je 0x1401ffd1a
mov r14, rcx
mov r15, qword [0x140396850]
xor ebx, ebx
xor esi, esi
xor edi, edi
mov rdx, qword [r15 + rbx]
mov rcx, r14
call fcn.1401ce960
test eax, eax
je 0x1401ffd2d
inc rdi
add rsi, 0x10
add rbx, 0x28
cmp rbp, rdi
jne 0x1401ffcfa
xor ebp, ebp
mov eax, ebp
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rdx, str.NaClFaultInject:_found__s_n
mov ecx, 6
mov r8, r14
call fcn.1401f7e70
xor ebp, ebp
cmp qword [0x140396848], rdi
je 0x1401ffd1c
mov r12, qword [0x140396850]
cmp dword [r12 + rbx + 8], 0
je 0x1401ffe3a
lea rdx, str.NaClFaultInject:_thread_specific_counter_n
mov ecx, 6
call fcn.1401f7e70
cmp qword [0x140396848], rdi
ja 0x1401ffda3
lea rax, str.counter_ix___gNaClNumFaultInjectInfo
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_fault_injection_fault_injection.c
mov ecx, 0xfffffffc
mov r9d, 0x168
call fcn.1401f7e70
cmp dword [0x140396840], 0
je 0x1401ffd1c
mov ecx, dword [0x14039685c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r15, rax
test rax, rax
jne 0x1401ffe61
mov r14, qword [0x140396848]
mov rcx, r14
shl rcx, 4
call fcn.1401a00f0
mov r15, rax
test rax, rax
jne 0x1401ffe14
lea rax, str.NULL___counters
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_fault_injection_fault_injection.c
mov ecx, 0xfffffffc
mov r9d, 0x177
call fcn.1401f7e70
mov r14, qword [0x140396848]
test r14, r14
je 0x1401ffe2a
shl r14, 4
mov rcx, r15
xor edx, edx
mov r8, r14
call fcn.1401a64a0
mov ecx, dword [0x14039685c]
mov rdx, r15
call fcn.140200030
jmp 0x1401ffe61
lea rdx, str.NaClFaultInject:_global_counter_n
mov ecx, 6
call fcn.1401f7e70
mov rcx, qword [0x140396838]
add rcx, rsi
call fcn.1401f7f50
mov r15, qword [0x140396830]
mov rax, r15
add rax, rsi
je 0x1401ffd1c
mov r8, qword [r15 + rsi]
mov r9, qword [r15 + rsi + 8]
lea rdx, str.NaClFaultInject:_counter__I64x__I64x__n
mov ecx, 6
call fcn.1401f7e70
mov rax, qword [r15 + rsi]
xor ebp, ebp
cmp rax, qword [r12 + rbx + 0x18]
jae 0x1401ffec7
mov r14, qword [r12 + rbx + 0x10]
lea rdi, [rax + rax*2]
xor ebp, ebp
cmp dword [r14 + rdi*8], 0
je 0x1401ffee7
mov rax, qword [r15 + rsi + 8]
inc rax
mov qword [r15 + rsi + 8], rax
cmp rax, qword [r14 + rdi*8 + 0x10]
jb 0x1401ffec7
mov qword [r15 + rsi + 8], 0
inc qword [r15 + rsi]
cmp dword [r12 + rbx + 8], 0
jne 0x1401ffd1c
add rsi, qword [0x140396838]
mov rcx, rsi
call fcn.1401f7f80
jmp 0x1401ffd1c
mov r8, qword [r14 + rdi*8 + 8]
lea rdx, str.NaClFaultInject:_should_fail__value__I64x_n
mov ecx, 6
call fcn.1401f7e70
mov rdx, qword [r14 + rdi*8 + 8]
mov ecx, dword [0x140396860]
call fcn.140200030
mov ebp, 1
jmp 0x1401ffea6