joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bec0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140272140]
mov ecx, dword [0x14026ee18]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000bf20
lea rsi, [0x140272138]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140149190
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140272140]
call fcn.1401467a0
cmp dword [0x140272140], 0xffffffff
jne 0x14000befc
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14014b2c0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.140146648
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140272188]
mov ecx, dword [0x14026ee18]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000bfe0
lea r8, [0x140272158]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14003b5e0
mov qword [0x140272138], rsi
lea rcx, [0x140272140]
call fcn.140146740
jmp 0x14000befc
lea rcx, [0x140272188]
call fcn.1401467a0
cmp dword [0x140272188], 0xffffffff
jne 0x14000bfb1
xorps xmm0, xmm0
movups xmmword [0x140272178], xmm0
movups xmmword [0x140272168], xmm0
movups xmmword [0x140272158], xmm0
lea rcx, [0x140272158]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140272188]
call fcn.140146740
jmp 0x14000bfb1
Function at 0x14000ede0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1028
call fcn.140149130
sub rsp, rax
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, dword [0x14026e7a0]
cmp esi, 0xffffffff
je 0x14000ee93
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14000eec5
lea rdi, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.14014b2c0
lea rdx, [rsp + 0x23]
mov r14, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call r14
mov ecx, 0x1000
call fcn.140146738
mov rbx, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rdi
call fcn.14014ac10
mov rdx, rbx
or rdx, 3
mov ecx, esi
call r14
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140149190
mov rax, rbx
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14000eec8
mov esi, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x14026e7a0], esi
je 0x14000ee13
mov ecx, esi
call sub.KERNEL32.dll_TlsFree
mov esi, dword [0x14026e7a0]
jmp 0x14000ee13
int3
int3
Function at 0x140013d80
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x140013dc6
mov r15, rbx
test r15, r15
je 0x140013ea1
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x140013e22
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x140013e11
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.14014ac10
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x140013da2
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x140013ebd
lea rcx, [r13*8]
call fcn.140146648
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x140013e83
xor r15d, r15d
mov r8, rcx
add r8, r15
je 0x140013ea1
mov r9, qword [r14 + r15]
mov qword [r8], r9
add r15, 8
cmp rdx, r15
jne 0x140013e68
add r15, rcx
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x140013ea3
add rbx, 0xfffffffffffffff8
jne 0x140013e96
ud2
test r12, r12
je 0x140013da2
mov rcx, r12
call fcn.140146640
mov r15, qword [rsi + 0x10]
jmp 0x140013da2
call fcn.140187a10
int3
Function at 0x1400157f0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r13d, dword [rsp + 0xd0]
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xfffffffc00000000
shl ebp, 0x10
mov ecx, 0x18
call fcn.140146648
mov rsi, rax
mov rax, r15
and rax, r12
cmp rax, qword [0x140262688]
jne 0x14001585d
mov rcx, r15
call fcn.140004ab0
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r13d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x14001ec40]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400158d1
test r14, r14
je 0x1400158c6
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140149190
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400158a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x27a
jle 0x14001591b
cmp ebp, 0x5af
je 0x1400158f0
cmp ebp, 0x27b
jne 0x140015925
mov rcx, rbx
call fcn.140001040
test rsi, rsi
je 0x1400158a0
mov rcx, qword [rsi]
and r12, rcx
cmp r12, qword [0x140262688]
jne 0x140015911
call fcn.140004bf0
mov rcx, rsi
call fcn.140146640
jmp 0x1400158a0
cmp ebp, 8
je 0x1400158f0
cmp ebp, 0xe
je 0x1400158f0
mov eax, dword [0x1402721d8]
mov ecx, dword [0x14026ee18]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400159b2
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov edx, ebp
call fcn.1400a7ae0
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x140015969
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
test rax, rax
js 0x1400159b0
sete al
test rbx, rbx
setne cl
or cl, al
je 0x1400159b0
mov rcx, qword [0x1402721d0]
lea rdx, [rsp + 0x50]
call fcn.140010c70
cmp byte [rsp + 0x4f], 0
jns 0x1400158f8
mov rcx, qword [rsp + 0x38]
call fcn.140146640
jmp 0x1400158f8
ud2
lea rcx, [0x1402721d8]
call fcn.1401467a0
cmp dword [0x1402721d8], 0xffffffff
jne 0x140015946
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140050b00
mov qword [0x1402721d0], rax
lea rcx, [0x1402721d8]
call fcn.140146740
jmp 0x140015946
Function at 0x140017c70
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x14022cb50]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xac
call fcn.1400d3160
xor edi, edi
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.14010c930
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14], rax
mov rcx, qword [rbx]
lea rbx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rdi, rdi
or rdi, qword [rbx]
mov rcx, rsi
call fcn.14010c450
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140149190
mov rax, rdi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140018610
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x14001868d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14001865c
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14001864a
mov qword [rdi], rsi
call fcn.1400bbc10
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.1400bbc10
mov r14, qword [rdi]
cmp qword [0x1402723f8], 0
je 0x140018697
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402529a0]
mov qword [rdi], 0
jmp 0x140018638
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400186d8
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400186d2
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x14001866e
xor ecx, ecx
mov dl, 1
jmp 0x1400186cb
xor ecx, ecx
jmp 0x1400186c9
Function at 0x14001b810
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov byte [rcx + 8], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
lea rax, [0x14022f430]
mov qword [rcx], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x14001b882
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14001b88f
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14001b87a
mov qword [rsi + 0x18], rdi
call fcn.1400bbc10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400bbc10
mov r14, qword [rsi + 0x18]
cmp qword [0x1402723f8], 0
je 0x14001b8c2
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402529a0]
mov qword [rsi + 0x18], 0
jmp 0x14001b867
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b903
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14001b8fd
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x14001b8a2
xor ecx, ecx
mov dl, 1
jmp 0x14001b8f6
xor ecx, ecx
jmp 0x14001b8f4
Function at 0x140020730
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x140279790]
mov ecx, dword [0x14026ee18]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140020865
mov ecx, dword [0x14026e7a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140020791
mov rcx, qword [0x140279780]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140279788]
jne 0x140020791
add rax, rcx
cmp qword [rax], 0
jne 0x140020824
mov ecx, 4
call fcn.140146648
mov rsi, rax
mov dword [rax], 0
mov ecx, dword [0x14026e7a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14002085e
mov rcx, qword [0x140279780]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140279788]
jne 0x14002085e
add rax, rcx
mov rdi, qword [rax]
mov ecx, dword [0x14026e7a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x1400207f7
test rsi, rsi
je 0x14002081b
call fcn.14000ede0
mov rcx, qword [0x140279780]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x140279788]
mov rdx, qword [0x140279780]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
test rdi, rdi
jne 0x1400208b8
mov ecx, dword [0x14026e7a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14002085a
mov rcx, qword [0x140279780]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140279788]
jne 0x14002085a
add rax, rcx
mov rax, qword [rax]
add rsp, 0x28
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140020853
xor edi, edi
jmp 0x1400207db
lea rcx, [0x140279790]
call fcn.1401467a0
cmp dword [0x140279790], 0xffffffff
jne 0x14002075b
mov qword [0x140279788], 0
lea rcx, [0x140279780]
mov qword [0x140279780], 0xffffffffffffffff
lea rdx, [0x140066c30]
call fcn.1400367a0
lea rcx, [0x140279790]
call fcn.140146740
jmp 0x14002075b
mov rcx, rdi
call fcn.140146640
jmp 0x140020824
Function at 0x140025b80
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140025bc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140025be5
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140025bc1
mov qword [rsi], rdi
call fcn.1400bbc10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140025c57
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400bbc10
mov r14, qword [rsi]
cmp qword [0x1402723f8], 0
je 0x140025c16
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402529a0]
mov qword [rsi], 0
jmp 0x140025baf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140025c5a
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140025c51
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x140025bf7
xor ecx, ecx
mov dl, 1
jmp 0x140025c4a
int3
xor ecx, ecx
jmp 0x140025c48

Function at 0x140025d40
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x14022cb50]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, [0x14023d0a7]
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x44a
call fcn.1400d3160
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1400bc840
mov qword [rsp + 0x80], 0xb
mov al, byte [0x140271fcb]
test al, al
jne 0x140025dfc
cmp byte [rsi + 0x17], 0
jns 0x140025dc7
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
lea rcx, [rsp + 0x40]
call fcn.14010c450
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140149190
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
lea r9, [rsp + 0x90]
mov qword [r9], rdi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0x88]
mov qword [r8], rax
lea rdx, [rsp + 0x80]
call fcn.1401a2ec0
jmp 0x140025dbe
Function at 0x140025e30
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x140025e5c
call fcn.1400bbc10
cmp qword [rsi], r15
je 0x140025e8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140025eb6
cmp r12, 2
jb 0x140025e83
mov qword [rsi], r15
call fcn.1400bbc10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140025f28
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400bbc10
mov r14, qword [rsi]
cmp qword [0x1402723f8], 0
je 0x140025ee7
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402529a0]
mov qword [rsi], 0
jmp 0x140025e75
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140025f35
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140025f22
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x140025ec8
xor ecx, ecx
mov dl, 1
jmp 0x140025f1b
mov rcx, rdi
call fcn.14013bbf0
jmp 0x140025ea5
xor ecx, ecx
jmp 0x140025f19

Function at 0x140025f40
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140026071
lea rax, [rsp + 0x35]
mov byte [rax + 2], 0x15
lea rcx, str.ExitCodeWatcherThread
lea rdx, [rsp + 0x20]
cmp rdx, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14002606f
lea rcx, [rsi + 0x10]
movups xmm0, xmmword [str.ExitCodeWatcherThread]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
movabs rax, 0x6461657268547265
mov qword [rdi + 0xd], rax
mov byte [rdi + 0x15], 0
mov rdx, rdi
call fcn.140026090
cmp byte [rdi + 0x17], 0
js 0x140026074
mov dword [rsi + 0x90], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x98], 0
test rax, rax
je 0x140026039
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x98]
inc rax
cmp rax, 2
jae 0x140026051
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140026031
mov qword [rsi + 0x98], rdi
call fcn.1400bbc10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140149190
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.1400bbc10
mov rcx, qword [rsi + 0x98]
call fcn.1401365c0
mov qword [rsi + 0x98], 0
jmp 0x14002601b
ud2
int3
mov rcx, qword [rsp + 0x20]
call fcn.140146640
jmp 0x140025fd3
Function at 0x14002eb40
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x178], rax
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
lea rax, [0x14022f350]
mov qword [rcx], rax
lea rax, [0x14022e138]
mov qword [rcx + 0x18], rax
xor ecx, ecx
mov qword [rsi + 0x20], rcx
mov byte [rsi + 0x28], cl
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rcx
mov byte [rsi + 0x40], cl
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [rsi + 0x20]
test rcx, rcx
setne al
cmp rcx, rdi
sete dl
and dl, al
cmp dl, 1
je 0x14002ec89
test rcx, rcx
jne 0x14002ec8e
mov qword [rsi + 0x20], rdi
cmp dword [0x1402722f8], 3
setl al
test rdi, rdi
sete cl
and cl, al
cmp cl, 1
je 0x14002eca2
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [rsi + 0x38]
test rcx, rcx
setne al
cmp rcx, rdi
sete dl
and dl, al
cmp dl, 1
je 0x14002ec89
test rcx, rcx
jne 0x14002ec98
mov qword [rsi + 0x38], rdi
cmp dword [0x1402722f8], 3
setl al
test rdi, rdi
sete cl
and cl, al
cmp cl, 1
je 0x14002ecef
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400b8f40]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14002ed3c
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140149190
mov rax, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
call fcn.1401466c0
call fcn.1400b8e60
jmp 0x14002ebc9
call fcn.1400b8e60
jmp 0x14002ec1a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwin_session_end_watcher.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x5b
mov r9d, 2
call fcn.1401a58f0
lea rcx, [rsp + 0x48]
lea rdx, str.CreateEvent
mov r8d, 0xb
call fcn.14012f860
mov rcx, rdi
call fcn.1401a5960
jmp 0x14002ebe8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwin_session_end_watcher.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x5e
mov r9d, 2
call fcn.1401a58f0
lea rcx, [rsp + 0x48]
lea rdx, str.CreateEvent
mov r8d, 0xb
call fcn.14012f860
mov rcx, rdi
call fcn.1401a5960
jmp 0x14002ec39
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r9d, 0x1b
call fcn.1400d3160
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov rdx, rdi
call fcn.1401a7120
lea rdx, [0x140248a50]
mov rcx, rbx
call fcn.1401c05f0
mov rcx, rbx
call fcn.1401829c0
jmp 0x14002ec6b
Function at 0x140032300
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14003232f
test r8d, r8d
jne 0x140032328
lea rcx, [0x1402752c8]
lea rdx, [0x1400b02b0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.14012fc20

Function at 0x140036320
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x14003634c
call fcn.1400bbc10
mov qword [rsi], 0
test r15, r15
je 0x140036382
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400363ad
cmp r12, 2
jb 0x14003637a
mov qword [rsi], r15
call fcn.1400bbc10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14003641f
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400bbc10
mov r14, qword [rsi]
cmp qword [0x1402723f8], 0
je 0x1400363de
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402529a0]
mov qword [rsi], 0
jmp 0x14003636c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003642c
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140036419
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x1400363bf
xor ecx, ecx
mov dl, 1
jmp 0x140036412
mov rcx, rdi
call fcn.14013bbf0
jmp 0x14003639c
xor ecx, ecx
jmp 0x140036410
Function at 0x1400367a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14026e7a0]
cmp ecx, 0xffffffff
je 0x14003687a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14003687a
mov eax, dword [0x140278b00]
mov ecx, dword [0x14026ee18]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140036884
mov rbx, qword [0x140278af8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400368c9
mov rax, qword [0x1402772e8]
inc rax
xor ecx, ecx
lea rdx, [0x1402772f0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x1400368d6
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x140278af0]
inc ecx
mov dword [0x140278af0], ecx
mov dword [rax + 0x14], ecx
mov qword [0x1402772e8], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x1400368c6
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14000ede0
jmp 0x1400367ca
lea rcx, [0x140278b00]
call fcn.1401467a0
cmp dword [0x140278b00], 0xffffffff
jne 0x1400367ef
mov ecx, 8
call fcn.140146648
mov qword [rax], 0
mov qword [0x140278af8], rax
lea rcx, [0x140278b00]
call fcn.140146740
jmp 0x1400367ef
int3
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x140036807
inc rcx
cmp rcx, 0x100
jne 0x14003681a
jmp 0x140036860