joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002300
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400ad100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400ad0e0]
test rbx, rbx
je 0x140002354
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000234b
test r12, r12
je 0x14000234b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002330
lea rcx, [0x1400ad100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002580
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x140002590
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x1400025a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400025e5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x1400025dc
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x1400025e7
add rax, 0x28
cmp rax, r9
jne 0x1400025c8
xor eax, eax
ret

Function at 0x140002690
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1400aa7e0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140002709
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140002709
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140002706
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400026fd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140002709
add r8, 0x28
cmp r8, r9
jne 0x1400026e8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x1400027f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400aa7e0]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000285f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14000285f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x14000285d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002854
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002868
add rax, 0x28
cmp rax, r9
jne 0x140002840
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x140002880
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400aa7e0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400028f8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400028f8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400028f8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400028f8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x1400028ec
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140002900
add rdx, 0x28
cmp rdx, r10
jne 0x1400028d8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x140002910
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x14000291e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400028f5
test r8d, r8d
jg 0x140002908
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret

Function at 0x140007d80
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
call dbg.__main
mov rax, qword [0x1400aa860]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x1400aa850]
mov r8, qword [rax]
mov rax, qword [0x1400aa840]
mov rcx, qword [rax]
add rsp, 0x28
jmp sym.WinMain
Function at 0x14000cbb0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14023e108]
mov ecx, dword [0x14023adf0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000cc17
lea rax, [0x14023e100]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x14000cc0d
call fcn.1401363f0
int3
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14023e108]
call fcn.140133c60
cmp dword [0x14023e108], 0xffffffff
jne 0x14000cbec
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14016a6d0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.140133b54
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14023e150]
mov ecx, dword [0x14023adf0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000ccd7
lea r8, [0x14023e120]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.1400389c0
mov qword [0x14023e100], rsi
lea rcx, [0x14023e108]
call fcn.140133eb0
jmp 0x14000cbec
lea rcx, [0x14023e150]
call fcn.140133c60
cmp dword [0x14023e150], 0xffffffff
jne 0x14000cca8
xorps xmm0, xmm0
movups xmmword [0x14023e140], xmm0
movups xmmword [0x14023e130], xmm0
movups xmmword [0x14023e120], xmm0
lea rcx, [0x14023e120]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14023e150]
call fcn.140133eb0
jmp 0x14000cca8
Function at 0x140011750
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x14001179c
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400117a7
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14001178a
mov qword [rdi], rsi
call fcn.1400a7ad0
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400a7ad0
mov r14, qword [rdi]
cmp qword [0x14023e3e8], 0
je 0x1400117d8
mov rcx, qword [0x14023e3e8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x14021e390]
mov qword [rdi], 0
jmp 0x140011778
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140211538]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140011819
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140011813
call qword [0x14021e390]
mov rcx, rax
xor edx, edx
call fcn.14001e8b0
jmp 0x1400117b9
xor ecx, ecx
mov dl, 1
jmp 0x14001180c
xor ecx, ecx
jmp 0x14001180a

Function at 0x140012300
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1028
call fcn.140136390
sub rsp, rax
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, dword [0x14023a76c]
cmp esi, 0xffffffff
je 0x1400123bd
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400123ef
lea rbx, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call fcn.14016a6d0
lea rdx, [rsp + 0x23]
mov r14, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call r14
mov ecx, 0x1000
call fcn.140133f84
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rbx
call fcn.14016a030
mov rdx, rdi
or rdx, 3
mov ecx, esi
call r14
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x1400123ad
call fcn.1401363f0
int3
mov rax, rdi
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400123f2
mov esi, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x14023a76c], esi
je 0x140012333
mov ecx, esi
call sub.KERNEL32.dll_TlsFree
mov esi, dword [0x14023a76c]
jmp 0x140012333
int3
int3
Function at 0x1400135c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
cmp r9, 2
jb 0x1400136ff
cmp word [r8 + 2], 0x3a
jne 0x1400136ff
movzx eax, word [r8]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x1400136ff
mov ebx, 2
xor eax, eax
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, 2
jb 0x140013708
cmp word [rcx + 2], 0x3a
jne 0x140013708
movzx r10d, word [rcx]
and r10d, 0xffffffdf
add r10d, 0xffffffa5
cmp r10w, 0xffe6
setae r10b
not al
test al, r10b
je 0x140013708
cmp r9, rbx
cmovae r9, rbx
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
mov qword [rdx + 8], 2
lea rcx, [rsp + 0x28]
mov qword [rcx], r8
mov qword [rcx + 8], r9
mov r8d, 1
call fcn.140103020
test al, al
je 0x1400136a9
mov rax, qword [rdi + 8]
mov rcx, rax
sub rcx, rbx
jb 0x14001373d
mov rdx, qword [rsi + 8]
cmp rdx, 1
jbe 0x14001373d
add rdx, 0xfffffffffffffffe
cmp rcx, rdx
je 0x1400136ca
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x1400136c2
call fcn.1401363f0
int3
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
test rcx, rcx
je 0x140013736
lea ecx, [rbx + rbx]
add rcx, qword [rdi]
mov rdx, qword [rsi]
not rbx
add rbx, rax
xor r8d, r8d
movzx eax, word [rcx + r8*2]
cmp ax, word [rdx + r8*2 + 4]
sete al
jne 0x1400136ab
lea r9, [r8 + 1]
cmp rbx, r8
mov r8, r9
jne 0x1400136e1
jmp 0x1400136ab
mov al, 1
xor ebx, ebx
jmp 0x140013614
cmp r9, rdx
jne 0x1400136a9
test r9, r9
je 0x140013736
dec r9
xor edx, edx
movzx eax, word [r8 + rdx*2]
cmp ax, word [rcx + rdx*2]
sete al
jne 0x1400136ab
lea r10, [rdx + 1]
cmp r9, rdx
mov rdx, r10
jne 0x140013717
jmp 0x1400136ab
mov al, 1
jmp 0x1400136ab
lea rcx, str.string_view::substr
call fcn.14016eb30
int3
Function at 0x140014430
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r13d, dword [rsp + 0xd0]
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xfffffffc00000000
shl ebp, 0x10
mov ecx, 0x18
call fcn.140133b54
mov rsi, rax
mov rax, r15
and rax, r12
cmp rax, qword [0x14022e648]
jne 0x14001449d
mov rcx, r15
call fcn.1400037d0
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r13d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x14001c270]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140014519
test r14, r14
je 0x14001450e
mov qword [r14], rdi
test rdi, rdi
setne al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x1400144fd
call fcn.1401363f0
int3
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400144e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x27a
jle 0x140014566
cmp ebp, 0x5af
je 0x140014538
cmp ebp, 0x27b
jne 0x140014570
mov rcx, rbx
call fcn.140095710
test rsi, rsi
je 0x1400144e0
mov rcx, qword [rsi]
and r12, rcx
cmp r12, qword [0x14022e648]
jne 0x140014559
call fcn.140003910
mov rcx, rsi
call fcn.140133b2c
jmp 0x1400144e0
cmp ebp, 8
je 0x140014538
cmp ebp, 0xe
je 0x140014538
mov eax, dword [0x14023e1a0]
mov ecx, dword [0x14023adf0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400145fd
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov edx, ebp
call fcn.140094200
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x1400145b4
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
test rax, rax
js 0x1400145fb
sete al
test rbx, rbx
setne cl
or cl, al
je 0x1400145fb
mov rcx, qword [0x14023e198]
lea rdx, [rsp + 0x50]
call fcn.14000fe90
cmp byte [rsp + 0x4f], 0
jns 0x140014540
mov rcx, qword [rsp + 0x38]
call fcn.140133b2c
jmp 0x140014540
ud2
lea rcx, [0x14023e1a0]
call fcn.140133c60
cmp dword [0x14023e1a0], 0xffffffff
jne 0x140014591
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140002d50
mov qword [0x14023e198], rax
lea rcx, [0x14023e1a0]
call fcn.140133eb0
jmp 0x140014591
Function at 0x140015970
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1401fa990]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xaf
call fcn.1400d5a00
xor edi, edi
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.1401000c0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14], rax
mov rcx, qword [rbx]
lea rbx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rdi, rdi
or rdi, qword [rbx]
mov rcx, rsi
call fcn.1401009d0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x140015a26
call fcn.1401363f0
int3
mov rax, rdi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140019140
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx + 8], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
lea rax, [0x1401fd0a8]
mov qword [rcx], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x1400191b0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x1400191bb
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400191a8
mov qword [rsi + 0x18], rdi
call fcn.1400a7ad0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400a7ad0
mov rcx, qword [rsi + 0x18]
call fcn.140110390
mov qword [rsi + 0x18], 0
jmp 0x140019195

Function at 0x14001e830
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14001e877
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14001e891
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001e86f
mov qword [rsi], rdi
call fcn.1400a7ad0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14001e8a7
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400a7ad0
mov rcx, qword [rsi]
call fcn.140110390
mov qword [rsi], 0
jmp 0x14001e85d
int3
Function at 0x14001f040
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1401fa990]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, [0x14020a966]
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x44d
call fcn.1400d5a00
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1400a5640
mov qword [rsp + 0x80], 0xb
mov al, byte [0x14023df8b]
test al, al
jne 0x14001f106
cmp byte [rsi + 0x17], 0
jns 0x14001f0c7
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
lea rcx, [rsp + 0x40]
call fcn.1401009d0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x14001f0f9
call fcn.1401363f0
int3
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
lea r9, [rsp + 0x90]
mov qword [r9], rdi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0x88]
mov qword [r8], rax
lea rdx, [rsp + 0x80]
call fcn.1401897d0
jmp 0x14001f0be

Function at 0x14001f140
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14001f16a
call fcn.1400a7ad0
cmp qword [rsi], r14
je 0x14001f199
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14001f1ef
cmp r15, 2
jb 0x14001f191
mov qword [rsi], r14
call fcn.1400a7ad0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14001f1be
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400a7ad0
mov rbx, qword [rdi]
cmp qword [0x14023e3e8], 0
je 0x14001f208
mov rcx, qword [0x14023e3e8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x14021e390]
mov qword [rdi], 0
jmp 0x14001f1af
call fcn.1400a7ad0
mov rcx, qword [rsi]
call fcn.140110390
mov qword [rsi], 0
jmp 0x14001f183
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140211538]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001f249
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14001f243
call qword [0x14021e390]
mov rcx, rax
xor edx, edx
call fcn.14001e8b0
jmp 0x14001f1d0
xor ecx, ecx
mov dl, 1
jmp 0x14001f23c
xor ecx, ecx
jmp 0x14001f23a
Function at 0x14001f250
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x14001f38b
lea rax, [rsp + 0x35]
mov byte [rax + 2], 0x15
lea rcx, str.ExitCodeWatcherThread
lea rdx, [rsp + 0x20]
cmp rdx, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14001f389
lea rcx, [rsi + 0x10]
movups xmm0, xmmword [str.ExitCodeWatcherThread]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
movabs rax, 0x6461657268547265
mov qword [rdi + 0xd], rax
mov byte [rdi + 0x15], 0
mov rdx, rdi
call fcn.14001f3a0
cmp byte [rdi + 0x17], 0
js 0x14001f38e
mov dword [rsi + 0x90], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x98], 0
test rax, rax
je 0x14001f349
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x98]
inc rax
cmp rax, 2
jae 0x14001f36b
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001f341
mov qword [rsi + 0x98], rdi
call fcn.1400a7ad0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x14001f360
call fcn.1401363f0
int3
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.1400a7ad0
mov rcx, qword [rsi + 0x98]
call fcn.140110390
mov qword [rsi + 0x98], 0
jmp 0x14001f32b
ud2
int3
mov rcx, qword [rsp + 0x20]
call fcn.140133b2c
jmp 0x14001f2e3
Function at 0x140028700
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x178], rax
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
lea rax, [0x1401fcfe8]
mov qword [rcx], rax
lea rax, [0x1401fbed8]
mov qword [rcx + 0x18], rax
xor ecx, ecx
mov qword [rsi + 0x20], rcx
mov byte [rsi + 0x28], cl
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rcx
mov byte [rsi + 0x40], cl
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [rsi + 0x20]
test rcx, rcx
setne al
cmp rcx, rdi
sete dl
and dl, al
cmp dl, 1
je 0x14002885b
test rcx, rcx
jne 0x140028860
mov qword [rsi + 0x20], rdi
cmp dword [0x14023e2a0], 3
setl al
test rdi, rdi
sete cl
and cl, al
cmp cl, 1
je 0x140028874
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [rsi + 0x38]
test rcx, rcx
setne al
cmp rcx, rdi
sete dl
and dl, al
cmp dl, 1
je 0x14002885b
test rcx, rcx
jne 0x14002886a
mov qword [rsi + 0x38], rdi
cmp dword [0x14023e2a0], 3
setl al
test rdi, rdi
sete cl
and cl, al
cmp cl, 1
je 0x1400288c1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400a39d0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14002890e
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x14002884d
call fcn.1401363f0
int3
mov rax, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
call fcn.14014c634
call fcn.1400a1450
jmp 0x140028789
call fcn.1400a1450
jmp 0x1400287e2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwin_session_end_watcher.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x5b
mov r9d, 2
call fcn.14018c510
lea rcx, [rsp + 0x48]
lea rdx, str.CreateEvent
mov r8d, 0xb
call fcn.140122650
mov rcx, rdi
call fcn.14018c580
jmp 0x1400287a8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwin_session_end_watcher.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x5e
mov r9d, 2
call fcn.14018c510
lea rcx, [rsp + 0x48]
lea rdx, str.CreateEvent
mov r8d, 0xb
call fcn.140122650
mov rcx, rdi
call fcn.14018c580
jmp 0x140028801
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r9d, 0x1b
call fcn.1400d5a00
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov rdx, rdi
call fcn.14018da30
lea rdx, [0x140216770]
mov rcx, rbx
call fcn.1401a80b0
mov rcx, rbx
call fcn.14016b8e0
jmp 0x140028833
Function at 0x14002ab60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x140245660]
mov ecx, dword [0x14023adf0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002ac95
mov ecx, dword [0x14023a76c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14002abc1
mov rcx, qword [0x140245650]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140245658]
jne 0x14002abc1
add rax, rcx
cmp qword [rax], 0
jne 0x14002ac54
mov ecx, 4
call fcn.140133b54
mov rsi, rax
mov dword [rax], 0
mov ecx, dword [0x14023a76c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14002ac8e
mov rcx, qword [0x140245650]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140245658]
jne 0x14002ac8e
add rax, rcx
mov rdi, qword [rax]
mov ecx, dword [0x14023a76c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x14002ac27
test rsi, rsi
je 0x14002ac4b
call fcn.140012300
mov rcx, qword [0x140245650]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x140245658]
mov rdx, qword [0x140245650]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
test rdi, rdi
jne 0x14002ace8
mov ecx, dword [0x14023a76c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14002ac8a
mov rcx, qword [0x140245650]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140245658]
jne 0x14002ac8a
add rax, rcx
mov rax, qword [rax]
add rsp, 0x28
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14002ac83
xor edi, edi
jmp 0x14002ac0b
lea rcx, [0x140245660]
call fcn.140133c60
cmp dword [0x140245660], 0xffffffff
jne 0x14002ab8b
mov qword [0x140245658], 0
lea rcx, [0x140245650]
mov qword [0x140245650], 0xffffffffffffffff
lea rdx, [0x1400685a0]
call fcn.140032420
lea rcx, [0x140245660]
call fcn.140133eb0
jmp 0x14002ab8b
mov rcx, rdi
call fcn.140133b2c
jmp 0x14002ac54