joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bae00
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400bae00
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, r8d
mov rsi, rdx
mov r14, rcx
test byte [rdx], 1
je 0x1400bae24
mov rsi, qword [rsi + 0x10]
jmp 0x1400bae28
add rsi, 2
mov ebx, r9d
and ebx, 0xfffffff
test r9b, 4
je 0x1400bae44
cmp byte [r14 + 0x50], 0
je 0x1400bae58
or ebx, 0x80000000
test bl, 8
je 0x1400bae6b
cmp byte [r14 + 0x68], 0
je 0x1400bae65
or ebx, 0x40000000
jmp 0x1400bae6b
or ebx, 0x20000000
test bl, 8
jne 0x1400bae49
jmp 0x1400bae6b
or ebx, 0x10000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r13d, 0
je 0x1400bae7f
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov ebp, 0
je 0x1400bae8f
mov rbp, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
je 0x1400baea2
lea rcx, [r14 + 0x20]
call fcn.14003d040
mov r15, rax
xor r12d, r12d
cmp byte [r14 + 0x18], 0
je 0x1400baf0b
mov rcx, r14
call fcn.14003d040
mov r9, rax
cmp edi, 4
ja 0x1400baec9
mov eax, edi
lea rcx, [0x140196ca0]
mov r12d, dword [rcx + rax*4]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov edx, r12d
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x1400baef5
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
cmp edi, 4
jbe 0x1400baebc
jmp 0x1400baec9

Function at 0x1400bf9b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 8]
jmp 0x1400bf9c7
mov rsi, qword [rsi + 0x218]
test rsi, rsi
je 0x1400bfa01
xor edi, edi
xchg qword [rsi], rdi
test rdi, rdi
je 0x1400bf9c0
nop word cs:[rax + rax]
tzcnt rcx, rdi
mov ebx, 1
shl rbx, cl
lea rcx, [rsi + rcx*8]
add rcx, 0x10
call fcn.14000cb40
xor rdi, rbx
jne 0x1400bf9e0
jmp 0x1400bf9c0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400d1e30
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov ebx, r9d
mov rsi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
test r8b, r8b
je 0x1400d1e93
lea r8, [rsp + 0x38]
mov rcx, rdx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400d1ec6
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1400d1ed2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp rdi, 0xffffffffffffffff
je 0x1400d1ed6
call fcn.140054d90
jmp 0x1400d1ed8
or ebx, 8
lea r8, [rsp + 0x38]
mov rcx, rdx
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400d1ec6
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x40], 0
test rbx, rbx
jne 0x1400d1f47
jmp 0x1400d1f6b
mov byte [rsi], 0
mov byte [rsi + 8], 0
jmp 0x1400d1fac
xor edi, edi
jmp 0x1400d1ee0
xor edi, edi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
or ebx, 8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
xor r14d, r14d
mov rcx, rdi
mov edx, ebx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
mov rbx, qword [rsp + 0x40]
cmovne r14, rbx
mov qword [rsp + 0x38], r14
test r14, r14
je 0x1400d1f9b
lea rax, [rdi + 1]
cmp rax, 2
jae 0x1400d1fc7
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400d1f63
mov qword [rsp + 0x40], rbx
call fcn.140054d90
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14000b7e0
mov byte [rsi + 8], 1
mov rax, qword [rsp + 0x40]
inc rax
cmp rax, 2
jb 0x1400d1fac
call fcn.140054d90
mov rcx, qword [rsp + 0x40]
call fcn.140035570
jmp 0x1400d1fac
mov byte [rsi], 0
mov byte [rsi + 8], 0
lea rax, [rdi + 1]
cmp rax, 2
jae 0x1400d1fd9
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140143c30
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140054d90
mov rcx, rdi
call fcn.140035570
jmp 0x1400d1eaa
call fcn.140054d90
mov rcx, rdi
jmp 0x1400d1f94
Function at 0x1400d2c40
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
or r8d, 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400d2cfb
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400d2cfb
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400d2cc3
mov qword [rsp + 0x30], rbx
call fcn.140054d90
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14000b7e0
mov byte [rsi + 8], 1
mov rax, qword [rsp + 0x30]
inc rax
cmp rax, 2
jb 0x1400d2d02
call fcn.140054d90
mov rcx, qword [rsp + 0x30]
call fcn.140035570
jmp 0x1400d2d02
mov byte [rsi], 0
mov byte [rsi + 8], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140143c30
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400d2d20
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov rdx, qword [0x1401c2c08]
xor rdx, rsp
mov qword [rsp + 0x38], rdx
mov rcx, qword [rcx]
movabs rdx, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rdx
or r9d, 8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 2
mov edx, r9d
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400d2dde
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400d2dde
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400d2da6
mov qword [rsp + 0x30], rbx
call fcn.140054d90
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14000b7e0
mov byte [rsi + 8], 1
mov rax, qword [rsp + 0x30]
inc rax
cmp rax, 2
jb 0x1400d2de5
call fcn.140054d90
mov rcx, qword [rsp + 0x30]
call fcn.140035570
jmp 0x1400d2de5
mov byte [rsi], 0
mov byte [rsi + 8], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140143c30
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400d4b3f
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x198], rax
lea rsi, [rcx + 2]
test byte [rcx], 1
mov rcx, rsi
je 0x1400d4b6e
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1400d4c7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400d4baf
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140143c30
mov rcx, rdi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.1400d4c98
mov ecx, 2
call fcn.140051fe0
test al, al
je 0x1400d4c79
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x265
mov r9d, 2
call fcn.1400533b0
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14000206f
mov rbx, rax
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400d4c15
mov r8, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
jmp 0x1400d4c18
shr r8d, 1
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, rsi
call fcn.140001af2
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.1400457b0
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400d4c4e
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
jmp 0x1400d4c56
shr r8d, 1
lea rdx, [rsp + 0x41]
mov rcx, rbx
call fcn.14000206f
test byte [rsp + 0x40], 1
je 0x1400d4c6f
mov rcx, qword [rsp + 0x50]
call fcn.1401438d8
lea rcx, [rsp + 0x58]
call fcn.1400534a0
xor ebx, ebx
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140143c30
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400d4c98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x170], rax
test byte [rcx], 1
je 0x1400d4cc1
mov rcx, qword [rsi + 0x10]
jmp 0x1400d4cc5
lea rcx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d4d4e
mov dil, 1
test al, 0x10
jne 0x1400d4db1
mov ecx, 2
call fcn.140051fe0
test al, al
je 0x1400d4daf
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.1400520b0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000206f
mov rcx, rax
mov rdx, rsi
call fcn.140056d20
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.14000206f
mov rcx, rdi
call fcn.1400525a0
jmp 0x1400d4daf
mov ecx, 2
call fcn.140051fe0
test al, al
je 0x1400d4daf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.1400533b0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000206f
mov rcx, rax
mov rdx, rsi
call fcn.140056d20
mov rcx, rdi
call fcn.1400534a0
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140143c30
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
Function at 0x1400d651e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x1400d65b2
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.1400f9138
test al, al
jne 0x1400d657a
add rdi, 0x70
cmp rdi, r12
jne 0x1400d655f
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x1400d65b2
test byte [rdi + 0x10], 1
je 0x1400d658c
mov rcx, qword [rdi + 0x20]
jmp 0x1400d6590
lea rcx, [rdi + 0x12]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1400d65b2
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140143c30
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400d7ac2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x68]
cmp eax, edx
jne 0x1400d7ad9
test byte [rcx + 0x10], 1
je 0x1400d7ae8
mov rcx, qword [rcx + 0x20]
jmp 0x1400d7aec
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
jmp 0x1400d7b05
add rcx, 0x12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x1400dfeb0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401c8ab0]
test rax, rax
jne 0x1400dfef4
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1401c8ab0]
test rax, rax
je 0x1400dfee1
cmp eax, 2
jne 0x1400dff42
mov ecx, 2
call fcn.140051fe0
test al, al
je 0x1400dffde
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x90
mov r9d, 2
call fcn.1400520b0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1400dffd1
mov eax, 1
lock xadd qword [0x1401c8ae8], rax
inc rax
cmp rax, 2
jl 0x1400dff66
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1401c8a68], eax
mov qword [0x1401c8a60], rsi
mov rcx, qword [0x1401c2c90]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140051fe0
test al, al
je 0x1400dffde
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 2
call fcn.1400520b0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.14000206f
mov rcx, rsi
call fcn.1400525a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140143c30
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1400ecbf8
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400ecc0a
add rsp, 0x28
jmp fcn.1400d2100
lea rcx, [0x140180113]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.140005804
int3

Function at 0x1400edcd0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rax, qword [rcx]
jne 0x1400edcfe
test rax, rax
jne 0x1400edcfe
cmp dword [rsi + 0x14], 0
jne 0x1400edcfe
cmp qword [rsi + 8], 0
je 0x1400ede02
lea rcx, [rax + 1]
cmp rcx, 2
jb 0x1400edd1e
call fcn.140054d90
mov rcx, qword [rsi]
call fcn.140035570
mov qword [rsi], 0
xor eax, eax
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 1]
cmp rdx, 2
jb 0x1400edd47
call fcn.140054d90
mov rcx, qword [rsi + 8]
call fcn.140035570
mov qword [rsi + 8], 0
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rsi + 0x10], 0
mov r14, qword [rdi]
cmp rax, r14
je 0x1400edd9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400edd7f
call fcn.140054d90
mov rcx, qword [rsi]
call fcn.140035570
mov qword [rsi], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400edd91
mov qword [rsi], r14
call fcn.140054d90
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsi + 8]
mov r14, qword [rdi + 8]
cmp rcx, r14
je 0x1400eddec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jb 0x1400eddd1
call fcn.140054d90
mov rcx, qword [rsi + 8]
call fcn.140035570
mov qword [rsi + 8], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400edde4
mov qword [rsi + 8], r14
call fcn.140054d90
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ecx, ecx
xor eax, eax
jmp 0x1400edd4f
Function at 0x1400edf20
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x1400edfd9
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], 0
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r14
mov rbx, rax
call r14
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne bl
je 0x1400edfdd
mov r14, qword [rsp + 0x38]
cmp qword [rsi], r14
je 0x1400edfed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400edfc5
call fcn.140054d90
mov rcx, qword [rsi]
call fcn.140035570
mov qword [rsi], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400edfe5
mov qword [rsi], r14
call fcn.140054d90
jmp 0x1400edfe5
mov bl, 1
jmp 0x1400edfed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140143c30
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400ee110
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.1400edeb0
test al, al
je 0x1400ee13e
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdi, [rsi + 0x30]
mov rcx, rdi
xor edx, edx
call fcn.1400ee196
mov rcx, qword [rsi + 0x48]
mov qword [rsi + 0x48], 0
test rcx, rcx
je 0x1400ee162
call fcn.140163350
mov rcx, rdi
xor edx, edx
call fcn.1400ee196
lea rcx, [rsi + 0x28]
call fcn.140002e90
lea rcx, [rsi + 0x20]
call fcn.140002e90
lea rcx, [rsi + 0x18]
call fcn.140002e90
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400ede10
Function at 0x1400eee08
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400edeb0
test al, al
je 0x1400eee2a
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x1400f1b30
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400f1b45
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x1400f25e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, dword [0x1401c8bc8]
mov ecx, dword [0x1401c65c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x40]
jg 0x1400f2669
lea rcx, [0x1401c8bb8]
call fcn.1400b9090
test rax, rax
jne 0x1400f2656
mov ecx, 4
call fcn.140143888
mov rdi, rax
mov dword [rax], 0
lea rbx, [0x1401c8bb8]
mov rcx, rbx
call fcn.1400b9090
mov rsi, rax
mov rcx, rbx
mov rdx, rdi
call fcn.1400b90d0
test rsi, rsi
je 0x1400f2656
mov rcx, rsi
call fcn.1401438d8
lea rcx, [0x1401c8bb8]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400b9090
lea rcx, [0x1401c8bc8]
call fcn.1401439f0
cmp dword [0x1401c8bc8], 0xffffffff
jne 0x1400f2608
xorps xmm0, xmm0
movups xmmword [0x1401c8bb8], xmm0
lea rcx, [0x1401c8bb8]
lea rdx, [0x140002e30]
call fcn.1400b9120
lea rcx, [0x1401c8bc8]
call fcn.140143a88
jmp 0x1400f2608

Function at 0x1400f78bb
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x5c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f79bb
lea r14, str.bytes_read___static_cast_DWORD___1_
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea rbp, [rsp + 0x30]
lea r12, [rsp + 0x50]
mov ecx, dword [rsp + 0x5c]
mov edx, 0xffffffff
mov r8, r14
call fcn.1400f787d
test rax, rax
je 0x1400f797b
mov r13, rax
mov rcx, rbp
lea rdx, [0x140189e67]
lea r8, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
mov r9d, 0x7f
call fcn.140054d70
mov rcx, r12
mov rdx, r13
mov r8d, 0xffffffff
mov r9, rbp
call fcn.14005fd60
mov rcx, r12
call fcn.14005ff10
mov eax, dword [rsp + 0x5c]
test eax, eax
jne 0x1400f79d3
mov rcx, rdi
call r15
cmp eax, 3
jne 0x1400f79cf
mov dword [rsp + 0x5c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
lea r9, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400f792a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400f79d5
mov eax, dword [rsp + 0x5c]
mov esi, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140143c30
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400f80d5
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400f7fb8
test rax, rax
jne 0x1400f816c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1400f816c
mov ecx, 2
call fcn.140051fe0
test al, al
je 0x1400f816a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.1400533b0
lea rcx, [rsp + 0x40]
lea rdx, [0x14019b227]
mov r8d, 0xc
call fcn.14000206f
mov rcx, rsi
call fcn.1400534a0
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140143c30
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret

Function at 0x1400f87be
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x168], rax
test byte [rcx], 1
je 0x1400f87ea
mov rcx, qword [rsi + 0x10]
jmp 0x1400f87ee
lea rcx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f880d
mov edi, eax
bt eax, 0xa
jae 0x1400f8805
test bl, bl
je 0x1400f886e
and edi, 0x10
shr edi, 4
jmp 0x1400f8870
mov ecx, 2
call fcn.140051fe0
test al, al
je 0x1400f886e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1400533b0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000206f
mov rcx, rax
mov rdx, rsi
call fcn.140056d20
mov rcx, rdi
call fcn.1400534a0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140143c30
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret