joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d01a0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x190
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x108], 0xfffffffffffffffe
mov rsi, rcx
cmp byte [rcx + 0x17], 0
jns 0x1400d01c9
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x1400d02c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400d01fc
mov rcx, rsi
add rsp, 0x190
pop rdi
pop rsi
pop rbp
jmp fcn.1400d0340
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::CreateDirectoryIfNecessary_const_base::FilePath__
lea r8, str.third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov r9d, 0x266
call fcn.1400f3e50
lea rdx, str.CreateDirectory
mov r8d, 0x10
mov rcx, rdi
call fcn.140013430
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
mov qword [rbp + 0xe0], rcx
cmovs rax, qword [rsi + 8]
mov qword [rbp + 0xe8], rax
lea rsi, [rbp + 0xf0]
lea rdx, [rbp + 0xe0]
mov rcx, rsi
call fcn.1400f24f0
movzx r8d, byte [rbp + 0x107]
test r8b, r8b
cmovs r8, qword [rbp + 0xf8]
cmovs rsi, qword [rbp + 0xf0]
mov rcx, rdi
mov rdx, rsi
call fcn.140013430
cmp byte [rbp + 0x107], 0
jns 0x1400d02b6
mov rcx, qword [rbp + 0xf0]
call fcn.14010e7fc
lea rcx, [rbp - 0x48]
call fcn.1400f3e80
xor eax, eax
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d0340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x118], 0xfffffffffffffffe
mov rsi, rcx
cmp byte [rcx + 0x17], 0
jns 0x1400d0369
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d0459
mov ecx, eax
mov al, 1
test cl, 0x10
jne 0x1400d051e
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::EnsureDirectory_const_base::FilePath__
lea r8, str.third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov r9d, 0x255
call fcn.1400f33f0
lea rdx, str.GetFileAttributes
mov r8d, 0x12
mov rcx, rdi
call fcn.140013430
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
mov qword [rbp + 0xf0], rcx
cmovs rax, qword [rsi + 8]
mov qword [rbp + 0xf8], rax
lea rsi, [rbp + 0x100]
lea rdx, [rbp + 0xf0]
mov rcx, rsi
call fcn.1400f24f0
movzx r8d, byte [rbp + 0x117]
test r8b, r8b
cmovs r8, qword [rbp + 0x108]
cmovs rsi, qword [rbp + 0x100]
mov rcx, rdi
mov rdx, rsi
call fcn.140013430
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.140013430
cmp byte [rbp + 0x117], 0
jns 0x1400d044b
mov rcx, qword [rbp + 0x100]
call fcn.14010e7fc
lea rcx, [rbp - 0x48]
call fcn.1400f3c40
jmp 0x1400d051c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::EnsureDirectory_const_base::FilePath__
lea r8, str.third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov r9d, 0x251
call fcn.1400f3e50
lea rdx, str.GetFileAttributes
mov r8d, 0x12
mov rcx, rdi
call fcn.140013430
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
mov qword [rbp + 0xe0], rcx
cmovs rax, qword [rsi + 8]
mov qword [rbp + 0xe8], rax
lea rsi, [rbp + 0x100]
lea rdx, [rbp + 0xe0]
mov rcx, rsi
call fcn.1400f24f0
movzx r8d, byte [rbp + 0x117]
test r8b, r8b
cmovs r8, qword [rbp + 0x108]
cmovs rsi, qword [rbp + 0x100]
mov rcx, rdi
mov rdx, rsi
call fcn.140013430
cmp byte [rbp + 0x117], 0
jns 0x1400d0513
mov rcx, qword [rbp + 0x100]
call fcn.14010e7fc
lea rcx, [rbp - 0x48]
call fcn.1400f3e80
xor eax, eax
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d27c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
lea rdx, [rbp - 0x10]
call fcn.1400d0c50
mov r15, qword [rbp - 0x10]
test r15, r15
je 0x1400d28ac
movups xmm0, xmmword [rdi]
movaps xmmword [rbp - 0x20], xmm0
mov rdi, qword [r15 + 0x40]
mov r12, qword [r15 + 0x48]
mov ebx, 1
cmp rdi, r12
je 0x1400d28b1
lea r14, [rbp - 0x20]
nop dword [rax + rax]
mov rcx, rdi
mov rdx, r14
call fcn.1400f80e0
test al, al
jne 0x1400d283b
add rdi, 0x70
cmp rdi, r12
jne 0x1400d2820
mov rdi, r12
cmp rdi, qword [r15 + 0x48]
je 0x1400d28b1
lea r14, [rdi + 0x10]
cmp byte [rdi + 0x27], 0
mov rcx, r14
jns 0x1400d2852
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1400d28b1
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
lea rcx, [rsi + 0x10]
mov rdx, r14
call fcn.1400cf320
cmp rdi, rsi
je 0x1400d28f1
lea rcx, [rsi + 0x28]
lea rdx, [rdi + 0x28]
cmp byte [rsi + 0x3f], 0
movzx eax, byte [rdi + 0x3f]
js 0x1400d28cb
test al, al
js 0x1400d28d9
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
jmp 0x1400d28f1
mov ebx, 3
lea rcx, [rbp - 0x10]
call fcn.1400d1ab0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
test al, al
jns 0x1400d28e8
mov r8, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x28]
jmp 0x1400d28ec
mov rdx, qword [rdi + 0x28]
mov r8, qword [rdi + 0x30]
call fcn.1400483c0
jmp 0x1400d28f1
movzx r8d, al
call fcn.1400482a0
mov rax, qword [rdi + 0x60]
mov qword [rsi + 0x60], rax
movups xmm0, xmmword [rdi + 0x40]
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [rsi + 0x50], xmm1
movups xmmword [rsi + 0x40], xmm0
xor ebx, ebx
jmp 0x1400d28b1
Function at 0x1400d29c0
Capabilities:
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r12, r8
mov esi, edx
mov rdi, qword [rcx + 0x40]
mov r14, qword [rcx + 0x48]
mov r15, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov qword [rbp - 0x18], r8
cmp rdi, r14
jne 0x1400d2a1d
jmp 0x1400d2ac8
mov rcx, r12
mov rdx, rdi
call fcn.1400d4b10
nop dword [rax + rax]
add rdi, 0x70
cmp rdi, r14
je 0x1400d2ac8
cmp dword [rdi + 0x68], esi
jne 0x1400d2a10
lea rbx, [rdi + 0x10]
cmp byte [rdi + 0x27], 0
mov rcx, rbx
jns 0x1400d2a33
mov rcx, qword [rdi + 0x10]
call r15
test al, 0x10
jne 0x1400d2a10
mov rax, qword [r12 + 8]
cmp rax, qword [r12 + 0x10]
je 0x1400d29fd
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
lea r12, [rax + 0x10]
mov rcx, r12
mov rdx, rbx
mov qword [rbp - 0x10], rax
call fcn.1400cf210
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x28]
cmp byte [rdi + 0x3f], 0
js 0x1400d2a81
lea rax, [rdi + 0x28]
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
jmp 0x1400d2a92
mov qword [rbp - 0x20], r12
mov rdx, qword [rdi + 0x28]
mov r8, qword [rdi + 0x30]
call fcn.140047b70
mov rax, qword [rdi + 0x60]
mov rcx, qword [rbp - 0x10]
mov qword [rcx + 0x60], rax
movups xmm0, xmmword [rdi + 0x40]
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x40], xmm0
add rcx, 0x68
mov r12, qword [rbp - 0x18]
mov qword [r12 + 8], rcx
add rdi, 0x70
cmp rdi, r14
jne 0x1400d2a1d
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x1400d2be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov r12d, r9d
mov rsi, r8
mov r14, rdx
mov rdi, rcx
lea rdx, [rbp - 0x18]
call fcn.1400d0c50
mov r13, qword [rbp - 0x18]
test r13, r13
je 0x1400d2c7a
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x30], xmm0
mov r14, qword [r13 + 0x40]
mov rbx, qword [r13 + 0x48]
mov r15d, 1
cmp r14, rbx
je 0x1400d2c80
mov byte [rbp - 1], r12b
lea r12, [rbp - 0x30]
nop
mov rcx, r14
mov rdx, r12
call fcn.1400f80e0
test al, al
jne 0x1400d2c5b
add r14, 0x70
cmp r14, rbx
jne 0x1400d2c40
mov r14, rbx
cmp r14, qword [r13 + 0x48]
je 0x1400d2c80
mov eax, dword [r14 + 0x68]
test eax, eax
je 0x1400d2c9d
xor ecx, ecx
cmp eax, 1
sete cl
lea r15d, [rcx + rcx*2]
inc r15d
jmp 0x1400d2c80
mov r15d, 3
lea rcx, [rbp - 0x18]
call fcn.1400d1ab0
mov eax, r15d
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r12, [r14 + 0x10]
cmp byte [r14 + 0x27], 0
mov rcx, r12
jns 0x1400d2caf
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d2c80
shr eax, 3
and eax, 2
mov r15d, eax
jne 0x1400d2c80
mov byte [r13 + 0x38], 1
mov dword [r14 + 0x68], 1
mov ecx, 0xb8
call fcn.14010e7c0
mov rcx, rax
mov qword [rbp - 0x10], rax
call fcn.1400f4df0
movups xmm0, xmmword [r14]
mov rax, qword [rbp - 0x10]
movups xmmword [rax + 8], xmm0
lea r15, [rax + 0x18]
mov rcx, r15
mov rdx, r12
call fcn.1400cf320
mov bl, byte [rbp - 1]
mov r12, qword [rbp - 0x10]
lea rax, [r12 + 8]
cmp rax, r14
je 0x1400d2d68
mov rax, qword [rbp - 0x10]
mov rcx, rax
add rcx, 0x30
lea rdx, [r14 + 0x28]
cmp byte [rax + 0x47], 0
movzx eax, byte [r14 + 0x3f]
js 0x1400d2d42
test al, al
js 0x1400d2d50
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
jmp 0x1400d2d68
test al, al
jns 0x1400d2d5f
mov r8, qword [r14 + 0x30]
mov rdx, qword [r14 + 0x28]
jmp 0x1400d2d63
mov rdx, qword [r14 + 0x28]
mov r8, qword [r14 + 0x30]
call fcn.1400483c0
jmp 0x1400d2d68
movzx r8d, al
call fcn.1400482a0
mov rax, qword [r14 + 0x60]
mov rcx, qword [rbp - 0x10]
mov qword [rcx + 0x68], rax
movups xmm0, xmmword [r14 + 0x40]
movups xmm1, xmmword [r14 + 0x50]
movups xmmword [rcx + 0x58], xmm1
movups xmmword [rcx + 0x48], xmm0
mov rdx, r15
mov r8, rdi
call fcn.1400f5030
test al, al
je 0x1400d2dbe
mov byte [r12 + 0xb0], bl
mov rcx, qword [rsi]
mov qword [rsi], r12
xor r15d, r15d
test rcx, rcx
je 0x1400d2c80
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x1400d2c80
mov rcx, r12
mov rax, qword [r12]
mov edx, 1
call qword [rax]
mov r15d, 2
jmp 0x1400d2c80
Function at 0x1400d2ea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r9
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
cmp byte [rdx + 0xb0], 0
je 0x1400d2eda
mov ecx, r14d
call fcn.1400130c0
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.1400d0c50
mov r12, qword [rbp - 0x18]
test r12, r12
je 0x1400d2f56
mov qword [rbp - 0x10], rbx
movups xmm0, xmmword [rdi + 8]
movaps xmmword [rbp - 0x40], xmm0
mov r15, qword [r12 + 0x40]
mov rbx, qword [r12 + 0x48]
mov r13d, 1
cmp r15, rbx
je 0x1400d2f5c
mov byte [rbp - 1], r14b
lea r14, [rbp - 0x40]
nop dword [rax + rax]
mov rcx, r15
mov rdx, r14
call fcn.1400f80e0
test al, al
jne 0x1400d2f3b
add r15, 0x70
cmp r15, rbx
jne 0x1400d2f20
mov r15, rbx
cmp r15, qword [r12 + 0x48]
je 0x1400d2f5c
cmp dword [r15 + 0x68], 1
jne 0x1400d2f5c
cmp byte [r15 + 0x27], 0
jns 0x1400d2f79
mov rcx, qword [r15 + 0x10]
jmp 0x1400d2f7d
mov r13d, 3
lea rcx, [rbp - 0x18]
call fcn.1400d1ab0
mov eax, r13d
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [r15 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d2f5c
shr eax, 3
and eax, 2
mov r13d, eax
jne 0x1400d2f5c
mov byte [r12 + 0x38], 1
xor ecx, ecx
call fcn.14012b3e4
mov r13, rax
movzx eax, byte [rbp - 1]
mov byte [r15 + 0x48], al
lea rcx, [r15 + 0x28]
cmp rcx, qword [rbp - 0x10]
je 0x1400d300c
cmp byte [r15 + 0x3f], 0
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax + 0x17]
js 0x1400d2fdc
test al, al
js 0x1400d2fed
mov rdx, qword [rbp - 0x10]
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
jmp 0x1400d300c
test al, al
jns 0x1400d2fff
mov rdx, qword [rbp - 0x10]
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
jmp 0x1400d3007
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
call fcn.1400483c0
jmp 0x1400d300c
movzx r8d, al
mov rdx, qword [rbp - 0x10]
call fcn.1400482a0
mov qword [r15 + 0x50], r13
inc dword [r15 + 0x58]
xor eax, eax
cmp byte [rbp - 1], 0
je 0x1400d3025
mov eax, 2
xor ecx, ecx
jmp 0x1400d3029
movzx ecx, byte [rdi + 0x64]
mov dword [r15 + 0x68], eax
mov byte [r15 + 0x5c], cl
mov qword [rbp - 0x20], rsi
mov rax, qword [rsi + 0x40]
cmp rax, 0xffffffffffffffff
je 0x1400d305f
lea rcx, [rsi + 0x40]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x28], r14
lea r8, [0x1400d4540]
lea rdx, [rbp - 0x28]
call fcn.14009e430
add rsi, 0x20
mov rcx, rsi
mov rdx, r13
call fcn.1400d5570
xor al, 1
movzx eax, al
lea r13d, [rax + rax*2]
jmp 0x1400d2f5c
Function at 0x1400d34c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov ecx, r8d
call fcn.1400130c0
lea rdx, [rbp - 8]
mov rcx, rdi
call fcn.1400d0c50
mov r14, qword [rbp - 8]
test r14, r14
je 0x1400d3557
movups xmm0, xmmword [rsi]
movaps xmmword [rbp - 0x20], xmm0
mov rdi, qword [r14 + 0x40]
mov r15, qword [r14 + 0x48]
mov esi, 1
cmp rdi, r15
je 0x1400d355c
lea rbx, [rbp - 0x20]
nop dword [rax]
mov rcx, rdi
mov rdx, rbx
call fcn.1400f80e0
test al, al
jne 0x1400d353b
add rdi, 0x70
cmp rdi, r15
jne 0x1400d3520
mov rdi, r15
cmp rdi, qword [r14 + 0x48]
je 0x1400d355c
mov eax, dword [rdi + 0x68]
test eax, eax
je 0x1400d3574
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
jmp 0x1400d355c
mov esi, 3
lea rcx, [rbp - 8]
call fcn.1400d1ab0
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
cmp byte [rdi + 0x27], 0
jns 0x1400d3580
mov rcx, qword [rdi + 0x10]
jmp 0x1400d3584
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d355c
shr eax, 3
and eax, 2
mov esi, eax
jne 0x1400d355c
mov byte [r14 + 0x38], 1
mov dword [rdi + 0x68], 2
mov byte [rdi + 0x5c], 0
xor esi, esi
jmp 0x1400d355c
Function at 0x1400d3700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
lea rdx, [rbp - 8]
call fcn.1400d0c50
mov r14, qword [rbp - 8]
test r14, r14
je 0x1400d3794
movups xmm0, xmmword [rbx]
movaps xmmword [rbp - 0x20], xmm0
mov rsi, qword [r14 + 0x40]
mov r15, qword [r14 + 0x48]
cmp rsi, r15
je 0x1400d37a1
lea rdi, [rbp - 0x20]
nop word cs:[rax + rax]
mov rcx, rsi
mov rdx, rdi
call fcn.1400f80e0
test al, al
jne 0x1400d376b
add rsi, 0x70
cmp rsi, r15
jne 0x1400d3750
mov rsi, r15
mov r15, qword [r14 + 0x48]
cmp rsi, r15
je 0x1400d379e
mov eax, dword [rsi + 0x68]
cmp eax, 1
je 0x1400d37fb
cmp eax, 2
jne 0x1400d37a1
cmp byte [rsi + 0x27], 0
jns 0x1400d3812
mov rcx, qword [rsi + 0x10]
jmp 0x1400d3816
mov edi, 3
jmp 0x1400d3858
mov r15, rsi
movups xmm0, xmmword [rbx]
movaps xmmword [rbp - 0x20], xmm0
mov rsi, qword [r14 + 0x40]
mov edi, 1
cmp rsi, r15
je 0x1400d37f5
lea rbx, [rbp - 0x20]
nop word [rax + rax]
mov rcx, rsi
mov rdx, rbx
call fcn.1400f80e0
test al, al
jne 0x1400d37db
add rsi, 0x70
cmp rsi, r15
jne 0x1400d37c0
mov rsi, r15
cmp rsi, qword [r14 + 0x48]
je 0x1400d37f5
mov eax, dword [rsi + 0x68]
test eax, eax
je 0x1400d3806
xor ecx, ecx
cmp eax, 1
sete cl
lea edi, [rcx + rcx*2]
inc edi
test edi, edi
jne 0x1400d3858
jmp 0x1400d3836
mov edi, 4
test edi, edi
jne 0x1400d3858
jmp 0x1400d3836
cmp byte [rsi + 0x27], 0
jns 0x1400d3870
mov rcx, qword [rsi + 0x10]
jmp 0x1400d3874
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d388f
mov edi, eax
shr edi, 3
and edi, 2
jne 0x1400d3832
mov byte [r14 + 0x38], 1
xor edi, edi
test edi, edi
jne 0x1400d3858
mov edi, 5
cmp byte [rsi + 0x48], 0
jne 0x1400d3858
mov byte [rsi + 0x5c], 1
mov dword [rsi + 0x68], 0
xor edi, edi
mov ecx, 1
call fcn.1400130c0
lea rcx, [rbp - 8]
call fcn.1400d1ab0
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d37f5
shr eax, 3
and eax, 2
mov edi, eax
jne 0x1400d3832
jmp 0x1400d382b
mov r15, qword [r14 + 0x48]
jmp 0x1400d37a1
Function at 0x1400ddda0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov eax, dword [0x140201f68]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rsi, [rax + 0x160]
mov qword [rax + 0x160], rsi
mov eax, dword [0x1401fcb3c]
cmp eax, 0xffffffff
jne 0x1400dddf3
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400dde08
mov ecx, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x1401fcb3c], ecx
je 0x1400dddf3
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [0x1401fcb3c]
mov rdx, rsi
add rsp, 0x30
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rax, [0x14015158e]
mov qword [rsp + 0x28], rax
lea rax, str.key___TLS_OUT_OF_INDEXES
mov qword [rsp + 0x20], rax
lea rdx, [0x14018db91]
lea r9, str.Check__s_failed:__s
mov ecx, 3
mov r8d, 0xc1
call fcn.140041620
int3
invalid
xchg ebp, eax
jb 0x140366c04
outsb dx, byte [rsi]
add eax, 0x482ee072
mov ch, 0x94
scasd eax, dword [rdi]
sub dword [rbx - 0x12], ebx
out dx, al
out dx, al
mov ss, word [rbx - 0x138c739f]
pmaxsw mm3, qword [rdi - 0x21]
adc dh, dh
xor al, 0x45
imul ebp, dword [rdx - 0x1056601d], 0xffffff9b
out dx, eax
wait
out dx, eax
wait
push 0xffffffffc6816079
sal ecx, 1
fist dword [rsi - 1]
wait
clc
fdiv st(3)
or cl, byte [rbx]
cmp eax, 0xdec9ca49
xchg esi, eax
cmp eax, 0xf5a81cdf
sbb al, 0xfd
mov bl, 0x9a
mov ch, 0x2b
pushfq
rcr byte [rsi], 1
movsd dword [rdi], dword [rsi]
sub eax, dword [rdi]
invalid
in al, dx
invalid
invalid
idiv dword [rbp + 0x65aa050c]
add bh, byte [rcx - 0x52150d61]
invalid
lodsd eax, dword [rsi]
test eax, 0xae818a28
or al, 0xc2
loope 0x140366ba0
invalid
invalid
cwde
int3
pop rdx
and ecx, dword [rbx + 0x20]
push rdi
pop rdx
clc
add dl, byte [rsi]
fdivr qword [rdi - 0x5f]
movabs dword [0x9a0f902089957982], eax
dec byte [rdi + rdi*2 - 0x1dfcc8c3]
cmp eax, 0xeee20337
cmp eax, 0xeee20337
sbb edi, edx
invalid
invalid
xchg ebp, eax
movsb byte [rdi], byte [rsi]
invalid
ret 0xfd8c
outsd dx, dword [rsi]
leave
loopne 0x140366cfb
invalid
std
push rdi
insd dword [rdi], dx
hlt
loope 0x140366ced
invalid
push rsi
pop rcx
mov esp, 0x380ab73d
clc
invalid
sbb eax, 0xcd5431d7
invalid
Function at 0x1400f2bf0
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
test dl, dl
je 0x1400f2c4c
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
mov edi, 0x80003
cmp eax, 6
jb 0x1400f2c51
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0x18
xor ecx, ecx
call fcn.1400f2ca0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x40]
cmp byte [rsi + 0x17], 0
js 0x1400f2c59
jmp 0x1400f2c5c
mov edi, 3
xor eax, eax
cmp byte [rsi + 0x17], 0
jns 0x1400f2c5c
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
nop
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1400f30f0
Capabilities:
Check os version

Disassembly:
push rbp
push rsi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x1400f31c5
and eax, 0xfeff
cmp eax, 6
je 0x1400f31c5
mov eax, dword [0x1402132d8]
mov ecx, dword [0x140201f68]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f31da
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x1402132d0]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x1400f31d0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::CrashpadInitializeCriticalSectionEx_CRITICAL_SECTION___DWORD__DWORD_
lea r8, str.third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rbp - 0x48]
mov rcx, rsi
mov r9d, 0x21
call fcn.1400f3e50
lea rdx, [0x14019f04b]
mov r8d, 0x1b
mov rcx, rsi
call fcn.140013430
lea rcx, [rbp - 0x48]
call fcn.1400f3e80
xor eax, eax
jmp 0x1400f31d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
add rsp, 0x168
pop rsi
pop rbp
ret
lea rcx, [0x1402132d8]
call fcn.14010e918
cmp dword [0x1402132d8], 0xffffffff
jne 0x1400f3159
lea rcx, str.kernel32.dll
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call int.1400f4180
mov qword [0x1402132d0], rax
lea rcx, [0x1402132d8]
call fcn.14010e9b0
jmp 0x1400f3159
Function at 0x1400f3c40
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
movsxd rcx, dword [rax + 4]
add rcx, rsi
lea rdx, [rbp - 0x18]
call fcn.14004db70
lea rdx, [0x1402008b0]
lea rcx, [rbp - 0x18]
call fcn.140050de0
mov r8, qword [rax]
mov rcx, rax
mov dl, 0xa
call qword [r8 + 0x38]
mov bl, al
lea rcx, [rbp - 0x18]
call fcn.140050c60
mov rcx, rsi
mov edx, ebx
call fcn.14004cb70
mov rcx, rsi
call fcn.14004b330
lea rdi, [rsi + 8]
lea rbx, [rbp - 0x18]
mov rcx, rdi
mov rdx, rbx
call fcn.14004cf70
mov rax, qword [0x1402132e0]
test rax, rax
je 0x1400f3ced
mov rdx, qword [rsi + 0x108]
mov r9, qword [rsi + 0x110]
mov r8d, dword [rsi + 0x118]
mov ecx, dword [rsi + 0x11c]
mov qword [rsp + 0x20], rbx
call rax
test al, al
jne 0x1400f3d89
mov eax, dword [0x1401fcb40]
test al, 4
je 0x1400f3d2e
cmp byte [rbp - 1], 0
jns 0x1400f3d01
mov rbx, qword [rbp - 0x18]
mov ecx, 2
call fcn.140112864
mov rcx, rbx
mov rdx, rax
call fcn.14012ed00
mov ecx, 2
call fcn.140112864
mov rcx, rax
call fcn.14012e910
mov eax, dword [0x1401fcb40]
test al, 2
je 0x1400f3d80
movzx eax, byte [rbp - 1]
test al, al
lea rcx, [rbp - 0x18]
cmovs rcx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
cmovs rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1400f25d0
cmp byte [rbp - 0x19], 0
jns 0x1400f3d68
mov rbx, qword [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [rbp - 0x19], 0
jns 0x1400f3d80
mov rcx, qword [rbp - 0x30]
call fcn.14010e7fc
cmp dword [rsi + 0x11c], 4
je 0x1400f3dea
cmp byte [rbp - 1], 0
jns 0x1400f3d98
mov rcx, qword [rbp - 0x18]
call fcn.14010e7fc
mov rax, qword [rsi]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::__u::basic_ostringstream_char__struct_std::__u::char_traits_char___class_std::__u::allocator_char__.0
mov qword [rsi + rax], rcx
lea rax, vtable.std::__u::basic_stringbuf_char__struct_std::__u::char_traits_char___class_std::__u::allocator_char__.0
mov qword [rsi + 8], rax
cmp byte [rsi + 0x5f], 0
jns 0x1400f3dc4
mov rcx, qword [rsi + 0x48]
call fcn.14010e7fc
add rsi, 0x70
mov rcx, rdi
call fcn.14004b2b0
mov rcx, rdi
call fcn.1400130c0
mov rcx, rsi
call fcn.14004b2a0
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
int3