joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bd928
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov ebx, 8
inc rax
cmp rax, 1
ja 0x1400bda9e
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x1400bda9e
lea rbx, [rdi + 8]
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rcx, rbx
mov rdx, rax
call fcn.140028a00
mov r15, qword [rbx]
mov ebx, 0x3b
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400bda9e
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.140150d68
mov rbx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.140150d68
mov r14, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [r14], r15
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rbx
mov qword [rsp + 0x38], r14
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x1401c8588]
jne 0x1400bda09
call fcn.1400845e0
mov rax, rbx
and rax, r12
cmp rax, qword [0x1401c8588]
jne 0x1400bda20
mov rcx, rbx
call fcn.1400844a0
mov qword [rdi + 0x18], rbx
lea r15, [rdi + 0x10]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400bdae0]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, r15
mov rdx, rax
call fcn.140028a00
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 1
ja 0x1400bda8b
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x1401c8588]
jne 0x1400bda7c
call fcn.1400845e0
mov qword [rdi + 0x18], 0
mov ebx, 0x3b
jmp 0x1400bda94
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
call fcn.1400be08a
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x1400bdabf
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x1401b8a50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140152280
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400bf700
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
mov rdx, qword [r14 + 8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea rdi, [rsp + 0x20]
mov r8, rdi
call fcn.140064fe0
cmp byte [rsp + 0x37], 0
jns 0x1400bf74f
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x37], 0
js 0x1400bf770
test rsi, rsi
jne 0x1400bf783
jmp 0x1400bf843
mov rcx, qword [rsp + 0x20]
call fcn.140150da4
test rsi, rsi
je 0x1400bf843
test edi, edi
je 0x1400bf843
mov ecx, edi
add rcx, rcx
call fcn.140150ddc
mov rbx, rax
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r14, [rsp + 0x20]
mov r8, r14
call fcn.140064fe0
cmp byte [rsp + 0x37], 0
jns 0x1400bf7c9
mov r14, qword [rsp + 0x20]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x37], 0
jns 0x1400bf7e9
mov rcx, qword [rsp + 0x20]
call fcn.140150da4
test rbx, rbx
je 0x1400bf861
mov rcx, rbx
call fcn.140171c94
test rax, rax
js 0x1400bf864
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x20]
mov rcx, rbx
mov rdx, rax
call fcn.140064a30
cmp byte [rsi + 0x17], 0
jns 0x1400bf82a
mov rcx, qword [rsi]
call fcn.140150da4
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.140150de4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140152280
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
int3
Function at 0x1400c8040
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401d466c]
cmp ecx, 0xffffffff
je 0x1400c8064
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400c8069
call fcn.1400c81d0
mov eax, dword [0x1401dc600]
mov ecx, dword [0x1401d52c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400c8181
mov rbx, qword [0x1401dc5f8]
movabs r14, 0xfffffffc00000000
and r14, rbx
cmp r14, qword [0x1401c8588]
jne 0x1400c80b3
mov rcx, rbx
call fcn.1400844a0
test rbx, rbx
je 0x1400c81c3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x1400c80d2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rcx, qword [0x1401dade8]
inc rcx
mov edx, 0x100
lea rax, [0x1401dadf0]
nop dword [rax + rax]
movzx r8d, cl
lea r9, [r8 + r8*2]
cmp dword [rax + r9*8], 0
je 0x1400c811e
lea r8d, [rcx + 1]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rax + r9*8], 0
je 0x1400c811e
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x1400c80f0
jmp 0x1400c8154
lea rcx, [rax + r9*8]
mov dword [rcx], 1
lea rcx, [r8 + r8*2]
mov qword [rax + rcx*8 + 8], rdi
mov edx, dword [0x1401dc5f0]
inc edx
mov dword [0x1401dc5f0], edx
mov dword [rax + rcx*8 + 0x14], edx
mov qword [0x1401dade8], r8
mov qword [rsi], r8
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp r14, qword [0x1401c8588]
jne 0x1400c816e
mov rcx, rbx
call fcn.1400845e0
cmp qword [rsi], 0x100
jae 0x1400c81c6
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1401dc600]
call fcn.140150ec0
cmp dword [0x1401dc600], 0xffffffff
jne 0x1400c808e
mov ecx, 8
call fcn.140150d68
mov qword [rax], 0
mov qword [0x1401dc5f8], rax
lea rcx, [0x1401dc600]
call fcn.140150f58
jmp 0x1400c808e
int3
int3

Function at 0x1400c81d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1028
call fcn.140152220
sub rsp, rax
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, dword [0x1401d466c]
cmp esi, 0xffffffff
jne 0x1400c822d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400c82ac
mov esi, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x1401d466c], esi
je 0x1400c822d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov esi, dword [0x1401d466c]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400c82a9
lea rdi, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.1401543c0
lea rdx, [rsp + 0x23]
mov r14, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call r14
mov ecx, 0x1000
call fcn.140150ddc
mov rbx, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rdi
call fcn.140153d10
mov rdx, rbx
or rdx, 3
mov ecx, esi
call r14
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140152280
mov rax, rbx
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
int3
Function at 0x1400e4e70
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov ebx, r9d
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
test r8b, r8b
je 0x1400e4ed3
lea r8, [rsp + 0x38]
mov rcx, rdx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400e4f06
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1400e4f12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp rdi, 0xffffffffffffffff
je 0x1400e4f16
call fcn.140075ef0
jmp 0x1400e4f18
or ebx, 8
lea r8, [rsp + 0x38]
mov rcx, rdx
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400e4f06
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x40], 0
test rbx, rbx
jne 0x1400e4f87
jmp 0x1400e4fab
mov byte [rsi], 0
mov byte [rsi + 8], 0
jmp 0x1400e4fec
xor edi, edi
jmp 0x1400e4f20
xor edi, edi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
or ebx, 8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
xor r14d, r14d
mov rcx, rdi
mov edx, ebx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
mov rbx, qword [rsp + 0x40]
cmovne r14, rbx
mov qword [rsp + 0x38], r14
test r14, r14
je 0x1400e4fdb
lea rax, [rdi + 1]
cmp rax, 2
jae 0x1400e5007
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400e4fa3
mov qword [rsp + 0x40], rbx
call fcn.140075ef0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400334b0
mov byte [rsi + 8], 1
mov rax, qword [rsp + 0x40]
inc rax
cmp rax, 2
jb 0x1400e4fec
call fcn.140075ef0
mov rcx, qword [rsp + 0x40]
call fcn.140053e50
jmp 0x1400e4fec
mov byte [rsi], 0
mov byte [rsi + 8], 0
lea rax, [rdi + 1]
cmp rax, 2
jae 0x1400e5019
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140075ef0
mov rcx, rdi
call fcn.140053e50
jmp 0x1400e4eea
call fcn.140075ef0
mov rcx, rdi
jmp 0x1400e4fd4
Function at 0x1400e5e50
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
or r8d, 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400e5f0b
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400e5f0b
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400e5ed3
mov qword [rsp + 0x30], rbx
call fcn.140075ef0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400334b0
mov byte [rsi + 8], 1
mov rax, qword [rsp + 0x30]
inc rax
cmp rax, 2
jb 0x1400e5f12
call fcn.140075ef0
mov rcx, qword [rsp + 0x30]
call fcn.140053e50
jmp 0x1400e5f12
mov byte [rsi], 0
mov byte [rsi + 8], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400e5f30
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov rdx, qword [0x1401c6028]
xor rdx, rsp
mov qword [rsp + 0x38], rdx
mov rcx, qword [rcx]
movabs rdx, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rdx
or r9d, 8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 2
mov edx, r9d
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400e5fee
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400e5fee
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400e5fb6
mov qword [rsp + 0x30], rbx
call fcn.140075ef0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400334b0
mov byte [rsi + 8], 1
mov rax, qword [rsp + 0x30]
inc rax
cmp rax, 2
jb 0x1400e5ff5
call fcn.140075ef0
mov rcx, qword [rsp + 0x30]
call fcn.140053e50
jmp 0x1400e5ff5
mov byte [rsi], 0
mov byte [rsi + 8], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400e72dc
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400e7303
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1400e7405
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400e7344
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140152280
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400e7428
cmp dword [0x1401d8070], 2
jg 0x1400e7403
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x265
mov r9d, 2
call fcn.140073ae0
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140027c01
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400e73a1
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
test rax, rax
js 0x1400e7421
je 0x1400e73b7
test rsi, rsi
je 0x1400e7424
lea rsi, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140065640
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400e73dd
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140027c01
cmp byte [rsp + 0x4f], 0
jns 0x1400e73f9
mov rcx, qword [rsp + 0x38]
call fcn.140150da4
lea rcx, [rsp + 0x50]
call fcn.140073c70
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140152280
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
int3
int3

Function at 0x1400e7428
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1400e744f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e74d3
mov dil, 1
test al, 0x10
jne 0x1400e7532
cmp dword [0x1401d8070], 2
jg 0x1400e7530
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.140072910
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140027c01
mov rcx, rax
mov rdx, rsi
call fcn.140065d30
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.140027c01
mov rcx, rdi
call fcn.140072e50
jmp 0x1400e7530
cmp dword [0x1401d8070], 2
jg 0x1400e7530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.140073ae0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140027c01
mov rcx, rax
mov rdx, rsi
call fcn.140065d30
mov rcx, rdi
call fcn.140073c70
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140152280
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
Function at 0x1400e8dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x38], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov rbx, qword [rcx + 0x50]
mov rax, qword [rcx + 0x58]
mov edi, 1
cmp rbx, rax
je 0x1400e8e7b
mov rsi, r8
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1400e8e44
add rbx, 0x70
cmp rbx, rax
jne 0x1400e8e23
jmp 0x1400e8e7b
cmp rbx, rax
je 0x1400e8e7b
cmp byte [rbx + 0x27], 0
jns 0x1400e8e55
mov rcx, qword [rbx + 0x10]
jmp 0x1400e8e59
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov edi, 1
cmovne edi, ecx
test edi, edi
jne 0x1400e8e7b
mov qword [rsi], rbx
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140152280
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400ea6c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x68]
cmp eax, edx
jne 0x1400ea6df
cmp byte [rcx + 0x27], 0
jns 0x1400ea6ee
mov rcx, qword [rcx + 0x10]
jmp 0x1400ea6f2
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
jmp 0x1400ea70b
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x1400f2a00
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401de140]
test rax, rax
jne 0x1400f2a44
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1401de140]
test rax, rax
je 0x1400f2a31
cmp eax, 2
jne 0x1400f2a8d
cmp dword [0x1401d8070], 2
jg 0x1400f2b24
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x90
mov r9d, 2
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1400f2b17
mov eax, 1
lock xadd qword [0x1401de178], rax
inc rax
cmp rax, 2
jl 0x1400f2ab1
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1401de100], eax
mov qword [0x1401de0f8], rsi
mov rcx, qword [0x1401d4678]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1401d8070], 2
jg 0x1400f2b24
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 2
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.140027c01
mov rcx, rsi
call fcn.140072e50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140152280
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x140100d00
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rax, qword [rcx]
jne 0x140100d2e
test rax, rax
jne 0x140100d2e
cmp dword [rsi + 0x14], 0
jne 0x140100d2e
cmp qword [rsi + 8], 0
je 0x140100e32
lea rcx, [rax + 1]
cmp rcx, 2
jb 0x140100d4e
call fcn.140075ef0
mov rcx, qword [rsi]
call fcn.140053e50
mov qword [rsi], 0
xor eax, eax
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 1]
cmp rdx, 2
jb 0x140100d77
call fcn.140075ef0
mov rcx, qword [rsi + 8]
call fcn.140053e50
mov qword [rsi + 8], 0
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rsi + 0x10], 0
mov r14, qword [rdi]
cmp rax, r14
je 0x140100dcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x140100daf
call fcn.140075ef0
mov rcx, qword [rsi]
call fcn.140053e50
mov qword [rsi], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140100dc1
mov qword [rsi], r14
call fcn.140075ef0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsi + 8]
mov r14, qword [rdi + 8]
cmp rcx, r14
je 0x140100e1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jb 0x140100e01
call fcn.140075ef0
mov rcx, qword [rsi + 8]
call fcn.140053e50
mov qword [rsi + 8], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140100e14
mov qword [rsi + 8], r14
call fcn.140075ef0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ecx, ecx
xor eax, eax
jmp 0x140100d7f

Function at 0x140100f30
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x140100fe9
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], 0
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r14
mov rbx, rax
call r14
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne bl
je 0x140100fed
mov r14, qword [rsp + 0x38]
cmp qword [rsi], r14
je 0x140100ffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x140100fd5
call fcn.140075ef0
mov rcx, qword [rsi]
call fcn.140053e50
mov qword [rsi], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140100ff5
mov qword [rsi], r14
call fcn.140075ef0
jmp 0x140100ff5
mov bl, 1
jmp 0x140100ffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140152280
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140101114
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rcx, qword [rcx]
jne 0x140101138
test rcx, rcx
jne 0x140101138
cmp dword [rsi + 0x14], 0
jne 0x140101138
cmp qword [rsi + 8], 0
je 0x140101151
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdi, [rsi + 0x30]
mov rcx, rdi
xor edx, edx
call fcn.1401011da
mov rdx, qword [rsi + 0x48]
mov qword [rsi + 0x48], 0
test rdx, rdx
je 0x14010117f
lea rcx, fcn.1400b5400
xor r8d, r8d
call fcn.1400b8f60
mov rcx, qword [rsi + 0x38]
movabs rax, 0xfffffffc00000000
and rax, rcx
cmp rax, qword [0x1401c8588]
jne 0x14010119e
call fcn.1400845e0
mov qword [rsi + 0x38], 0
mov rcx, rdi
xor edx, edx
call fcn.1401011da
lea rcx, [rsi + 0x28]
call fcn.140028a50
lea rcx, [rsi + 0x20]
call fcn.140028a50
lea rcx, [rsi + 0x18]
call fcn.140028a50
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140100e40
Function at 0x1401077a0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
push rbx
mov r8, rcx
xor ebx, ebx
xor eax, eax
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x1401078c5
mov edi, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov esi, eax
mov r9d, ecx
mov r11d, edx
mov r10d, 0
cmp edi, 7
jb 0x140107800
mov eax, 7
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
mov r10d, ecx
and ebx, 0x20
shr ebx, 5
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x140107897
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
jmp 0x140107899
xor eax, eax
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
and al, bl
mov byte [r8 + 0x16], al
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x1401078fa
xor ecx, ecx
mov eax, 0x80000007
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
jne 0x140107937
jmp 0x140107903
movzx edx, byte [r8 + 0x19]
test dl, dl
jne 0x140107937
cmp byte [r8 + 0x1a], 0
je 0x140107937
xor ecx, ecx
mov eax, 0x40000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x140107937
cmp ecx, 0x666f736f
jne 0x140107937
cmp edx, 0x76482074
jne 0x140107937
mov byte [r8 + 0x19], 1
pop rbx
pop rdi
pop rsi
ret