joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057c40
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x14017f960]
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x1c
call fcn.14009ae60
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140091430
mov rcx, rsi
call fcn.14008ea20
test al, al
je 0x140057d8c
mov rcx, rsi
call fcn.14003ceb0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rsi + 0x40]
cmp rcx, rax
je 0x140057d2e
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x140057db5
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140057d22
mov qword [rsi + 0x40], rdi
call fcn.14009ae80
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140057dd0
mov qword [rsp + 0x20], 0
xor edi, edi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140057d8c
mov rbx, rax
lea rax, fcn.140121430
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], rbx
call fcn.140068d10
mov eax, dword [rax + 0x50]
test rax, rax
setne dil
je 0x140057d8c
mov qword [rsi + 0x30], rbx
mov qword [rsi + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.1400914b0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400c2d30
mov eax, edi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14009ae80
mov rcx, qword [rsi + 0x40]
call fcn.14008e270
mov qword [rsi + 0x40], 0
jmp 0x140057d0f
xor edi, edi
jmp 0x140057d8c
Function at 0x140057de0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x14017f960]
lea r15, [rsp + 0x60]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.MapFileRegionToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r12, [rsp + 0x40]
mov rcx, r12
mov r9d, 0x42
call fcn.14009ae60
xor r14d, r14d
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.140091430
mov rcx, rsi
call fcn.14008ea20
test al, al
je 0x140057f66
test edi, edi
jne 0x140057fb5
mov ebp, 2
mov edi, 4
xor r15d, r15d
mov rcx, rsi
call fcn.14003ceb0
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x28], 0
mov rcx, rax
xor edx, edx
mov r8d, ebp
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
cmp qword [rsi + 0x40], rax
je 0x140057eec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x140057f95
mov rax, r14
inc rax
cmp rax, 2
jb 0x140057ee0
mov qword [rsi + 0x40], r14
call fcn.14009ae80
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi + 0x40]
inc r14
cmp r14, 2
jb 0x140057fb0
mov dword [rsp + 0x3c], 0
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
cmp rcx, qword [0x14019a6b0]
jne 0x140057ff7
cmp rdx, qword [0x14019a6b8]
jne 0x140057ff7
mov rcx, rsi
call fcn.14003cff0
xor r14d, r14d
test rax, rax
jle 0x140057f66
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, qword [rsi + 0x40]
mov qword [rsp + 0x20], rax
mov edx, edi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140057fb0
movsxd rcx, dword [rsp + 0x3c]
add rax, rcx
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov r14b, 1
lea rcx, [rsp + 0x60]
call fcn.1400914b0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400c2d30
mov eax, r14d
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14009ae80
mov rcx, qword [rsi + 0x40]
call fcn.14008e270
mov qword [rsi + 0x40], 0
jmp 0x140057ecb
xor r14d, r14d
jmp 0x140057f66
dec edi
cmp edi, 3
ja case.default.0x140057fce
lea rax, [0x14019a6a0]
movsxd rcx, dword [rax + rdi*4]
add rcx, rax
jmp rcx
mov rcx, rsi
call fcn.140057c40
mov r14d, eax
jmp 0x140057f66
mov r14, qword [rbx + 8]
mov r15, r14
shr r15, 0x20
mov ebp, 4
mov edi, 2
jmp 0x140057e82
xor eax, eax
lea r14, [rsp + 0x40]
mov qword [r14], rax
lea r9, [rsp + 0x30]
mov qword [r9], rax
lea r15, [rsp + 0x3c]
mov qword [rsp + 0x20], r15
mov r8, r14
call fcn.1400582a0
mov rbx, qword [rbx + 8]
movsxd rax, dword [r15]
mov rdx, rax
sar rdx, 0x3f
add rax, rbx
adc rdx, 0
mov ecx, edx
and ecx, 1
neg rcx
xor rdx, rcx
setne dl
mov r14, qword [r14]
test r14, r14
js 0x140057fb0
test dl, dl
jne 0x140057fb0
test rcx, rcx
js 0x140057fb0
test rax, rax
je 0x140057fb0
mov r8, r14
shr r8, 0x20
jmp 0x140057f3a
mov ebp, 4
mov edi, 2
jmp 0x140057e7f
mov ebp, 8
mov edi, 1
jmp 0x140057e7f
mov edi, 0xaaaaaaaa
xor ebp, ebp
jmp 0x140057e7f
Function at 0x140061630
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x1400616a7
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x1401b66f0], rax
jne 0x1400616aa
mov rsi, rcx
call fcn.140067930
mov edx, 0x570
mov rcx, rax
xor r8d, r8d
call fcn.140055840
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.1400adaa0
mov ecx, dword [0x1401cada0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1401c31d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x170], rdi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
int3
int3
Function at 0x140068400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x1400683d0]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x1401cefe8]
lea rdx, [0x140068270]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400684f8
cmp dword [0x1401ceff0], 0
jne 0x140068505
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x1401ceff4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x1400684ac
mov ecx, 1
mov edx, 0x28
call fcn.14009f870
test rax, rax
je 0x140068505
mov r14, rax
mov ecx, dword [0x1401ceff4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400684fd
lea r15, [0x1401ceff8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x1401cf000]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov esi, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c2d30
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400d70e0
mov rcx, r14
call fcn.14009f7d0
mov rcx, rsi
mov rax, rdi
call qword [0x1401a61b0]
xor esi, esi
jmp 0x1400684dc

Function at 0x140068970
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401c2768]
cmp ecx, 0xffffffff
je 0x140068a4a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140068a4a
mov eax, dword [0x1401d0850]
mov ecx, dword [0x1401c31d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140068a54
mov rbx, qword [0x1401d0848]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140068a9d
mov rax, qword [0x1401cf038]
inc rax
xor ecx, ecx
lea rdx, [0x1401cf040]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x140068aaa
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x1401d0840]
inc ecx
mov dword [0x1401d0840], ecx
mov dword [rax + 0x14], ecx
mov qword [0x1401cf038], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x140068a9a
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140068ac0
jmp 0x14006899a
lea rcx, [0x1401d0850]
call fcn.1400c22fc
cmp dword [0x1401d0850], 0xffffffff
jne 0x1400689bf
mov ecx, 8
call fcn.1400c227c
mov rbx, rax
mov rcx, rax
call fcn.14008e590
mov qword [0x1401d0848], rbx
lea rcx, [0x1401d0850]
call fcn.1400c23b0
jmp 0x1400689bf
int3
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x1400689d7
inc rcx
cmp rcx, 0x100
jne 0x1400689ea
jmp 0x140068a30
Function at 0x140068ac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1400c2cd0
sub rsp, rax
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1401c2768]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x140068b74
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140068bb2
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400fa470
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400c22ec
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400f9dd0
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400c2d30
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.140076530
test al, al
je 0x140068bb5
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140068bb8
mov eax, 0xffffffff
lock cmpxchg dword [0x1401c2768], ecx
je 0x140068af8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401c2768]
mov dword [rsp + 0x2c], ecx
jmp 0x140068af8
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.140076530
test al, al
je 0x140068bdd
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140068bdd
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x140068b8b
int3

Function at 0x140068bf0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1401c2768]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x140068c3b
and rax, 0xfffffffffffffffc
je 0x140068c6e
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x140068c6e
add rax, rcx
mov rsi, qword [rax]
jmp 0x140068c70
lea rdx, [0x14019d773]
lea r8, str....._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r9d, 0x1fb
call fcn.14009ae60
movabs rdx, 0x141dd76000
mov rcx, rsi
call fcn.14011a340
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2d30
mov rax, rsi
add rsp, 0x50
pop rsi
ret

Function at 0x140068c90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401c2768]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x140068cb8
test rdi, rdi
je 0x140068cd1
call fcn.140068ac0
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140069280
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x140069290
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x1400692b1
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400692d1
cmp byte [r14 + 0x50], 1
je 0x14006935c
or edi, 0x20000000
test dil, 8
jne 0x140069367
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400692ef
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x140069300
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
je 0x14006938e
cmp byte [r14 + 0x18], 1
je 0x14006939f
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x1400693af
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x140069384
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x1400692d1
cmp byte [r14 + 0x68], 1
jne 0x140069379
or edi, 0x40000000
jmp 0x1400692db
or edi, 0x10000000
jmp 0x1400692db
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140069347
lea rcx, [r14 + 0x20]
call fcn.14003ceb0
mov r15, rax
jmp 0x14006930b
mov rcx, r14
call fcn.14003ceb0
mov r9, rax
jmp 0x140069319
cmp ebx, 4
jne 0x1400693be
mov edx, 6
jmp 0x140069326
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400693d0
mov edx, 7
jmp 0x140069326
cmp ebx, 1
jne 0x1400693df
mov edx, 4
jmp 0x140069326
xor edx, edx
jmp 0x140069326
Function at 0x140069290
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x140069290
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x1400692b1
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400692d1
cmp byte [r14 + 0x50], 1
je 0x14006935c
or edi, 0x20000000
test dil, 8
jne 0x140069367
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400692ef
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x140069300
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
je 0x14006938e
cmp byte [r14 + 0x18], 1
je 0x14006939f
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x1400693af
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x140069384
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x1400692d1
cmp byte [r14 + 0x68], 1
jne 0x140069379
or edi, 0x40000000
jmp 0x1400692db
or edi, 0x10000000
jmp 0x1400692db
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140069347
lea rcx, [r14 + 0x20]
call fcn.14003ceb0
mov r15, rax
jmp 0x14006930b
mov rcx, r14
call fcn.14003ceb0
mov r9, rax
jmp 0x140069319
cmp ebx, 4
jne 0x1400693be
mov edx, 6
jmp 0x140069326
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400693d0
mov edx, 7
jmp 0x140069326
cmp ebx, 1
jne 0x1400693df
mov edx, 4
jmp 0x140069326
xor edx, edx
jmp 0x140069326

Function at 0x1400693f0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x140069428
cmp byte [r15 + 0x50], 1
je 0x1400694bf
or edi, 0x20000000
test dil, 8
jne 0x1400694ca
xor r14d, r14d
cmp byte [r15 + 0x60], 0
mov r12d, 0
je 0x140069446
mov r12, qword [r15 + 0x58]
cmp byte [r15 + 0x48], 0
mov r13d, 0
je 0x140069457
mov r13, qword [r15 + 0x40]
cmp byte [r15 + 0x38], 1
je 0x1400694f1
cmp byte [r15 + 0x18], 1
je 0x140069502
xor r9d, r9d
cmp ebx, 4
jne 0x1400694b0
mov edx, 6
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x1400694e7
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [rbx - 2]
cmp eax, 2
jae 0x140069512
mov edx, 7
jmp 0x14006947a
or edi, 0x80000000
jmp 0x140069428
cmp byte [r15 + 0x68], 1
jne 0x1400694dc
or edi, 0x40000000
jmp 0x140069432
or edi, 0x10000000
jmp 0x140069432
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006949b
lea rcx, [r15 + 0x20]
call fcn.14003ceb0
mov r14, rax
jmp 0x140069462
mov rcx, r15
call fcn.14003ceb0
mov r9, rax
jmp 0x140069470
mov edx, 1
test ebx, ebx
je 0x14006947a
cmp ebx, 1
jne 0x14006952e
mov edx, 4
jmp 0x14006947a
xor edx, edx
jmp 0x14006947a
Function at 0x14006ba60
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1401d0890], 0
jne 0x14006ba9d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14006ba90
mov dword [rdi], eax
mov dword [0x1401d0898], eax
mov qword [0x1401d0890], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x14006c9b0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14006c9d7
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14006ca11
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14006ca30
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400c2d30
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.14006cb30
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400c2d30
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14009abb0
test al, al
je 0x14006cafb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x265
mov r9d, 2
call fcn.140118ff0
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14007ee10
mov rdi, rax
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x14006ca93
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
test rax, rax
js 0x14006cb02
sete al
test rsi, rsi
setne cl
or cl, al
je 0x14006cb15
lea rsi, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140092b90
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x14006cad5
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.14007ee10
cmp byte [rsp + 0x57], 0
jns 0x14006caf1
mov rcx, qword [rsp + 0x40]
call fcn.1400c22b8
lea rcx, [rsp + 0x58]
call fcn.140119060
xor esi, esi
jmp 0x14006ca14
lea rcx, [0x140183d1d]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.1400fc0a0
lea rcx, [0x140183d1d]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.1400fc0a0
int3
Function at 0x14006cb30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x14006cb57
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006cbfd
mov dil, 1
test al, 0x10
je 0x14006cb89
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400c2d30
mov eax, edi
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14009abb0
test al, al
je 0x14006cbf6
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.140046020
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14007ee10
mov rcx, rax
mov rdx, rsi
call fcn.140119e40
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.14007ee10
mov rcx, rdi
call fcn.140046630
xor edi, edi
jmp 0x14006cb6d
mov ecx, 2
call fcn.14009abb0
test al, al
je 0x14006cbf6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.140118ff0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14007ee10
mov rcx, rax
mov rdx, rsi
call fcn.140119e40
mov rcx, rdi
call fcn.140119060
jmp 0x14006cbf6
Function at 0x14006e040
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14006ccf0
mov rax, qword [rsi]
test rax, rax
je 0x14006e0b7
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14006e0be
lea rcx, [rsp + 0x28]
call fcn.14006d7b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c2d30
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14006e090
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
jne 0x14006e0e2
cmp byte [rbx + 0x27], 0
js 0x14006e0d7
lea rcx, [rbx + 0x10]
jmp 0x14006e0db
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14006e0ed
add rbx, 0x70
cmp rbx, r15
je 0x14006e090
jmp 0x14006e0c5
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14006e10c
mov rcx, r14
mov rdx, rbx
call fcn.14012eda0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14006e0e2
mov rcx, rdi
mov rdx, rbx
call fcn.14012ec40
mov r14, rax
jmp 0x14006e106

Function at 0x14006e120
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1401b4040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14006ccf0
mov rax, qword [rsi]
test rax, rax
je 0x14006e197
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14006e19e
lea rcx, [rsp + 0x28]
call fcn.14006d7b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c2d30
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14006e170
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x14006e1c2
cmp byte [rbx + 0x27], 0
js 0x14006e1b7
lea rcx, [rbx + 0x10]
jmp 0x14006e1bb
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14006e1cd
add rbx, 0x70
cmp rbx, r15
je 0x14006e170
jmp 0x14006e1a5
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14006e1ec
mov rcx, r14
mov rdx, rbx
call fcn.14012eda0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14006e1c2
mov rcx, rdi
mov rdx, rbx
call fcn.14012ec40
mov r14, rax
jmp 0x14006e1e6