joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b4a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1400bf630
sub rsp, rax
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1401bd758]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x14006b554
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006b592
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400f6360
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400be36c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400f5cc0
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400bf690
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.140078e90
test al, al
je 0x14006b595
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x14006b598
mov eax, 0xffffffff
lock cmpxchg dword [0x1401bd758], ecx
je 0x14006b4d8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401bd758]
mov dword [rsp + 0x2c], ecx
jmp 0x14006b4d8
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.140078e90
test al, al
je 0x14006b5bd
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14006b5bd
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x14006b56b
int3

Function at 0x14006b5d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1401bd758]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x14006b61b
and rax, 0xfffffffffffffffc
je 0x14006b64e
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x14006b64e
add rax, rcx
mov rsi, qword [rax]
jmp 0x14006b650
lea rdx, [0x14019893c]
lea r8, str....._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r9d, 0x1f6
call fcn.14009ac50
movabs rdx, 0x141dd76000
mov rcx, rsi
call fcn.1401161d0
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bf690
mov rax, rsi
add rsp, 0x50
pop rsi
ret

Function at 0x14006b670
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401bd758]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x14006b698
test rdi, rdi
je 0x14006b6b1
call fcn.14006b4a0
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14006bd40
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14006bd50
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14006bd71
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14006bd91
cmp byte [r14 + 0x50], 0
jne 0x14006be1c
or edi, 0x20000000
test dil, 8
jne 0x14006be27
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14006bdaf
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14006bdc0
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
jne 0x14006be4e
cmp byte [r14 + 0x18], 0
jne 0x14006be5f
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x14006be6f
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x14006be44
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x14006bd91
cmp byte [r14 + 0x68], 0
je 0x14006be39
or edi, 0x40000000
jmp 0x14006bd9b
or edi, 0x10000000
jmp 0x14006bd9b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006be07
lea rcx, [r14 + 0x20]
call fcn.14003e140
mov r15, rax
jmp 0x14006bdcb
mov rcx, r14
call fcn.14003e140
mov r9, rax
jmp 0x14006bdd9
cmp ebx, 4
jne 0x14006be7e
mov edx, 6
jmp 0x14006bde6
lea eax, [rbx - 2]
cmp eax, 2
jae 0x14006be90
mov edx, 7
jmp 0x14006bde6
cmp ebx, 1
jne 0x14006be9f
mov edx, 4
jmp 0x14006bde6
xor edx, edx
jmp 0x14006bde6
Function at 0x14006bd50
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14006bd50
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14006bd71
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14006bd91
cmp byte [r14 + 0x50], 0
jne 0x14006be1c
or edi, 0x20000000
test dil, 8
jne 0x14006be27
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14006bdaf
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14006bdc0
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
jne 0x14006be4e
cmp byte [r14 + 0x18], 0
jne 0x14006be5f
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x14006be6f
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x14006be44
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x14006bd91
cmp byte [r14 + 0x68], 0
je 0x14006be39
or edi, 0x40000000
jmp 0x14006bd9b
or edi, 0x10000000
jmp 0x14006bd9b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006be07
lea rcx, [r14 + 0x20]
call fcn.14003e140
mov r15, rax
jmp 0x14006bdcb
mov rcx, r14
call fcn.14003e140
mov r9, rax
jmp 0x14006bdd9
cmp ebx, 4
jne 0x14006be7e
mov edx, 6
jmp 0x14006bde6
lea eax, [rbx - 2]
cmp eax, 2
jae 0x14006be90
mov edx, 7
jmp 0x14006bde6
cmp ebx, 1
jne 0x14006be9f
mov edx, 4
jmp 0x14006bde6
xor edx, edx
jmp 0x14006bde6

Function at 0x14006beb0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14006bee8
cmp byte [r15 + 0x50], 0
jne 0x14006bf7f
or edi, 0x20000000
test dil, 8
jne 0x14006bf8a
xor r14d, r14d
cmp byte [r15 + 0x60], 0
mov r12d, 0
je 0x14006bf06
mov r12, qword [r15 + 0x58]
cmp byte [r15 + 0x48], 0
mov r13d, 0
je 0x14006bf17
mov r13, qword [r15 + 0x40]
cmp byte [r15 + 0x38], 0
jne 0x14006bfb1
cmp byte [r15 + 0x18], 0
jne 0x14006bfc2
xor r9d, r9d
cmp ebx, 4
jne 0x14006bf70
mov edx, 6
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x14006bfa7
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [rbx - 2]
cmp eax, 2
jae 0x14006bfd2
mov edx, 7
jmp 0x14006bf3a
or edi, 0x80000000
jmp 0x14006bee8
cmp byte [r15 + 0x68], 0
je 0x14006bf9c
or edi, 0x40000000
jmp 0x14006bef2
or edi, 0x10000000
jmp 0x14006bef2
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006bf5b
lea rcx, [r15 + 0x20]
call fcn.14003e140
mov r14, rax
jmp 0x14006bf22
mov rcx, r15
call fcn.14003e140
mov r9, rax
jmp 0x14006bf30
mov edx, 1
test ebx, ebx
je 0x14006bf3a
cmp ebx, 1
jne 0x14006bfee
mov edx, 4
jmp 0x14006bf3a
xor edx, edx
jmp 0x14006bf3a
Function at 0x14006f020
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1401ca7e8], 0
jne 0x14006f05d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14006f050
mov dword [rdi], eax
mov dword [0x1401ca7f0], eax
mov qword [0x1401ca7e8], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x14006ff40
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14006ff67
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14006ffa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14006ffc0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400bf690
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400700c0
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400bf690
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14009a9a0
test al, al
je 0x140070085
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x265
mov r9d, 2
call fcn.140114ea0
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400823f0
mov rdi, rax
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x140070023
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
test rax, rax
js 0x14007008c
je 0x140070039
test rsi, rsi
je 0x14007009f
lea rsi, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140094780
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x14007005f
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400823f0
cmp byte [rsp + 0x4f], 0
jns 0x14007007b
mov rcx, qword [rsp + 0x38]
call fcn.1400be338
lea rcx, [rsp + 0x50]
call fcn.140114f20
xor esi, esi
jmp 0x14006ffa4
lea rcx, [0x14018083d]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.1400f81f0
lea rcx, [0x14018083d]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.1400f81f0
int3
Function at 0x1400700c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1400700e7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007018d
mov dil, 1
test al, 0x10
je 0x140070119
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400bf690
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14009a9a0
test al, al
je 0x140070186
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.1400479f0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400823f0
mov rcx, rax
mov rdx, rsi
call fcn.140115ce0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400823f0
mov rcx, rdi
call fcn.140047fe0
xor edi, edi
jmp 0x1400700fd
mov ecx, 2
call fcn.14009a9a0
test al, al
je 0x140070186
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.140114ea0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400823f0
mov rcx, rax
mov rdx, rsi
call fcn.140115ce0
mov rcx, rdi
call fcn.140114f20
jmp 0x140070186
Function at 0x1400715c0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140070280
mov rax, qword [rsi]
test rax, rax
je 0x140071637
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14007163e
lea rcx, [rsp + 0x28]
call fcn.140070d40
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bf690
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140071610
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
jne 0x140071662
cmp byte [rbx + 0x27], 0
js 0x140071657
lea rcx, [rbx + 0x10]
jmp 0x14007165b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14007166d
add rbx, 0x70
cmp rbx, r15
je 0x140071610
jmp 0x140071645
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14007168c
mov rcx, r14
mov rdx, rbx
call fcn.14012e5b0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140071662
mov rcx, rdi
mov rdx, rbx
call fcn.14012e450
mov r14, rax
jmp 0x140071686

Function at 0x1400716a0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140070280
mov rax, qword [rsi]
test rax, rax
je 0x140071717
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14007171e
lea rcx, [rsp + 0x28]
call fcn.140070d40
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bf690
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x1400716f0
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x140071742
cmp byte [rbx + 0x27], 0
js 0x140071737
lea rcx, [rbx + 0x10]
jmp 0x14007173b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14007174d
add rbx, 0x70
cmp rbx, r15
je 0x1400716f0
jmp 0x140071725
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14007176c
mov rcx, r14
mov rdx, rbx
call fcn.14012e5b0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140071742
mov rcx, rdi
mov rdx, rbx
call fcn.14012e450
mov r14, rax
jmp 0x140071766
Function at 0x140074fc0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x238
movaps xmmword [rsp + 0x220], xmm6
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rdx
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x218], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x200]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [0x14017b970]
movaps xmmword [r13], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str..pipecrashpad__lu_
mov rcx, r13
mov r8d, eax
call fcn.140094f10
mov edi, 0xfffffffc
lea r14, [rsp + 0x1b0]
movabs rbp, 0x7fffffffffffffff
xorps xmm6, xmm6
mov qword [rsp + 0x48], rsi
jmp 0x140075194
Function at 0x140078bc0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor eax, eax
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x140078cdc
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x140078d18
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr edi, 5
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x140078d20
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
and dil, al
mov byte [r8 + 0x16], dil
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x140078d12
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x140078d24
pop rdi
pop rsi
ret
mov dl, byte [r8 + 0x19]
jmp 0x140078d0b
xor r10d, r10d
jmp 0x140078c1f
xor eax, eax
jmp 0x140078cb4
cmp byte [r8 + 0x1a], 0
je 0x140078d0f
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x140078d0f
cmp ecx, 0x666f736f
jne 0x140078d0f
cmp edx, 0x76482074
jne 0x140078d0f
mov byte [r8 + 0x19], 1
jmp 0x140078d0f

Function at 0x140078e90
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140078ea5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x14007b9b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14007ba10
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14007ba19
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bf690
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14007b9f9
int3
mov rcx, qword [rcx + 8]
jmp 0x14007b9b0
Function at 0x14007ba20
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x14007bac6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14007bab2
cmp eax, 0xffffffff
je 0x14007bac3
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bf690
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x14007ba61
mov eax, dword [rsp + 0x2c]
jmp 0x14007ba92
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14007ba94

Function at 0x14007bfd0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14007bed0
test rax, rax
jne 0x14007c00f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14007c02b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400bf690
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14009a9a0
test al, al
je 0x14007c081
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.140114ea0
lea rcx, [rsp + 0x40]
lea rdx, [0x14019acab]
mov r8d, 0xc
call fcn.1400823f0
mov rcx, rsi
call fcn.140114f20
xor esi, esi
jmp 0x14007c00f

Function at 0x14007c520
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14007ba10
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14007ba19
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bf690
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14007b9f9
int3
mov rcx, qword [rcx + 8]
jmp 0x14007b9b0
Function at 0x14007cab0
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x14017b970]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x14007cb9c
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.1400f6360
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x14007cba3
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.14007cc00
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x14007cba3
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x14007cbac
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400bf690
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14007cec0
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0xe0
mov rdx, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0xd8], rax
cmp byte [rcx + 0x17], 0
js 0x14007cfa6
je 0x14007cf8c
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
xor eax, eax
mov qword [rsp + 0xd0], rax
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0xb0], rax
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x50], 0x68
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14007cf8c
mov rcx, qword [rsp + 0xc8]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0xc0]
call rsi
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400bf690
nop
add rsp, 0xe0
pop rsi
ret
cmp qword [rdx + 8], 0
je 0x14007cf8c
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
xor eax, eax
mov qword [rsp + 0xd0], rax
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0xb0], rax
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x50], 0x68
mov rdx, qword [rdx]
jmp 0x14007cf39
Function at 0x14007d090
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401af040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14007d140]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14007d0eb
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400bf690
nop
add rsp, 0x68
pop rdi
pop rsi
ret
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r9d, 0x1b
call fcn.14009ac50
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
call fcn.140116e70
lea rdx, [0x1401993e0]
mov rcx, rdi
call fcn.140131880
mov rcx, rdi
call fcn.140116f20
jmp 0x14007d0d6