joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063830
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov r14d, 4
lea rdx, str.Processing_I_O_redirection_inheritance_from_environment_n
mov ecx, r14d
call fcn.14007a9a0
xor edi, edi
xor ebx, ebx
lea r15, [0x1400cb1c0]
mov rcx, qword [rbx + r15 + 8]
call fcn.14009f438
mov rbp, rax
test rax, rax
je 0x1400638e8
mov r8, qword [rbx + r15 + 8]
lea rdx, str.getenv__s______s_n
mov r9, rax
mov ecx, r14d
call fcn.14007a9a0
mov r9d, dword [rbx + r15 + 0x14]
mov r8d, dword [rbx + r15 + 0x10]
lea rcx, [rsi + 0xe0]
mov rdx, rbp
call fcn.140066560
lea rdx, str._NaClResourceOpen_returned__I64x_n
mov ecx, r14d
mov r8, rax
mov rbp, rax
call fcn.14007a9a0
test rbp, rbp
je 0x1400638e8
lea rdx, str.Setting_descriptor__d_n
mov r8d, edi
mov ecx, r14d
call fcn.14007a9a0
mov r8, rbp
mov edx, edi
mov rcx, rsi
call fcn.140063ac8
jmp 0x140063903
mov ecx, dword [rbx + r15]
call fcn.14009f4a4
mov r8d, dword [rbx + r15 + 0x10]
mov r9d, edi
mov edx, eax
mov rcx, rsi
call fcn.140063670
add rbx, 0x18
inc rdi
cmp rbx, 0x48
jb 0x14006386b
lea rdx, str...._done._n
mov ecx, r14d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.14007a9a0

Function at 0x140063c34
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov r9d, edx
mov rsi, rcx
mov r8, rcx
lea rdx, str.NaClAppShutdown:_nap_0x_I64x__exit_status__d_n
mov ecx, 4
call fcn.14007a9a0
lea rbx, [rsi + 0xb0]
mov rcx, rbx
call fcn.14007a950
mov rcx, rbx
mov dword [rsi + 0x188], edi
call fcn.14007a978
mov rax, qword [rsi + 0x260]
test rax, rax
je 0x140063c8b
call qword [rax + reloc.WS2_32.dll_recv]
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007a884
Function at 0x140064d94
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.NACL_CRASH_TEST
call fcn.14009f438
test rax, rax
je 0x140064dc0
lea rcx, str._CRASH_TEST__Causing_crash_in_NaCl_trusted_code..._n
call fcn.140064c48
mov dword [1], 0
add rsp, 0x28
ret

Function at 0x1400684c4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rdi, qword [rcx + 0xc8]
mov esi, r8d
mov ebx, edx
mov r9d, edx
mov r8, rcx
lea rdx, str.Entered_NaClSysSysconf__08I64xx___d__0x_08I32x__n
mov ecx, 3
mov dword [rsp + 0x20], esi
call fcn.14007a9a0
dec ebx
je 0x14006853b
dec ebx
je 0x140068531
sub ebx, 0x3e6
je 0x140068529
dec ebx
je 0x140068521
dec ebx
je 0x140068519
mov eax, 0xffffffea
jmp 0x14006857d
mov eax, dword [rdi + 0x1b8]
jmp 0x14006855a
mov eax, dword [rdi + 0x1b4]
jmp 0x14006855a
mov eax, dword [0x14020cd98]
jmp 0x14006855a
mov dword [rsp + 0x78], 0x10000
jmp 0x14006855e
mov eax, dword [0x14020cd9c]
test eax, eax
jne 0x14006855a
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov dword [0x14020cd9c], eax
mov dword [rsp + 0x78], eax
lea r8, [rsp + 0x78]
mov rdx, rsi
mov r9d, 4
mov rcx, rdi
call fcn.14006f020
neg eax
sbb eax, eax
not eax
and eax, 0xfffffff2
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14006eb84
Capabilities:
Get system information on windows

Disassembly:
and qword [rcx], 0
jmp fcn.14006eb90
Function at 0x14006eb90
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbx, qword [rcx]
mov rsi, rdx
mov r8, rdx
mov r14, rcx
lea rdx, str.NaClPageAlloc___0x_I64x__n
mov ecx, 3
call fcn.14007a9a0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rsp + 0x24]
mov r9d, 0x1000
cmp r8d, r9d
je 0x14006ebf6
lea rdx, str.page_size_is_0x_x__expected_0x_x_n
mov ecx, 2
call fcn.14007a9a0
mov r8d, dword [rsp + 0x48]
mov r12d, 0x10000
cmp r8d, r12d
je 0x14006ec1a
lea rdx, str.allocation_granularity_is_0x_x__expected_0x_x_n
mov r9d, r12d
mov ecx, 0xfffffffd
call fcn.14007a9a0
add rsi, 0xffff
and rsi, 0xffffffffffff0000
xor ebp, ebp
mov r9d, 1
mov r8d, 0x2000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rsi
mov rbx, rax
test rax, rax
je 0x14006ed1a
lea rdx, str.NaClPageAlloc:__VirtualAlloc__0x_I64x__succeeded__0x_016I64x__releasing_and_re_allocating_in_64K_chunks...._n
mov r9, rax
mov ecx, 3
call fcn.14007a9a0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r15, [rbx + rsi]
mov rdi, rbx
cmp rdi, r15
jae 0x14006ecff
mov r9d, 1
mov r8d, 0x2000
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14006eca4
add rdi, r12
jmp 0x14006ec7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClPageAlloc:_re_allocation_failed_at_0x_016I64x__error__d_n
mov r8, rdi
mov r9d, eax
mov ecx, 0xfffffffd
call fcn.14007a9a0
jmp 0x14006ecd7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rbx, r12
cmp rbx, rdi
jb 0x14006ecc3
lea rdx, str.NaClPageAllocAtAddr:_retrying_w_o_hint_n
mov ecx, 2
call fcn.14007a9a0
inc ebp
xor ebx, ebx
cmp ebp, 0x100
jl 0x14006ec2a
jmp 0x14006ed2b
lea rdx, str.NaClPageAlloc:_p__0x_016I64x__returning_success._n
mov r8, rbx
mov ecx, 2
call fcn.14007a9a0
mov qword [r14], rbx
xor eax, eax
jmp 0x14006ed30
lea rdx, str.NaClPageAlloc:_VirtualAlloc__0x_I64x__failed_n
mov ecx, 0xfffffffd
call fcn.14007a9a0
mov eax, 0xfffffff4
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14007333c
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x100]
mov r8, rcx
test eax, eax
je 0x1400733d4
mov dword [rdx], eax
and dword [rcx + 0x100], 0
mov rcx, qword [rcx + 0xc8]
or eax, 0xffffffff
lock xadd dword [rcx + 0x2ac], eax
mov rcx, r8
call fcn.140073210
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140073397
lea rdx, str.NaClAppThreadUnblockIfFaulted:_ResumeThread___call_failed_n
mov ecx, 0xfffffffc
call fcn.14007a9a0
cmp dword [0x14020ce90], 0
je 0x1400733cf
cmp ebx, 2
jae 0x1400733cf
lea rax, str.previous_suspend_count___2
lea r8, str.c:core_no_admin_src_native_client_src_trusted_service_runtimewin_thread_suspension.c
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
mov r9d, 0x93
mov ecx, 0xfffffffc
mov qword [rsp + 0x20], rax
call fcn.14007a9a0
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x140073424
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x1401f05f0]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbx, rcx
add rcx, 0xe0
mov edi, edx
call fcn.14007a950
cmp dword [rbx + 0xf0], 1
jne 0x1400734fc
mov rcx, rbx
call fcn.140073210
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x140073490
lea rdx, str.NaClUntrustedThreadSuspend:_SuspendThread___call_failed_n
mov ecx, 0xfffffffc
call fcn.14007a9a0
test edi, edi
je 0x1400734d3
cmp qword [rbx + 0xf8], 0
jne 0x1400734c3
mov ecx, 0x4d0
call fcn.14009ea04
mov qword [rbx + 0xf8], rax
test rax, rax
jne 0x1400734c3
lea rdx, str.NaClUntrustedThreadSuspend:_malloc___failed_n
lea ecx, [rax - 4]
call fcn.14007a9a0
mov rdx, qword [rbx + 0xf8]
mov dword [rdx + 0x30], 0x100003
jmp 0x1400734e0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100001
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1400734fc
lea rdx, str.NaClUntrustedThreadSuspend:_GetThreadContext___failed_n
lea ecx, [rax - 4]
call fcn.14007a9a0
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1400991d0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140073c84
Capabilities:
Query environment variable

Disassembly:
mov dword [0x14020cda0], 0x10000
jmp 0x140074140
sub rsp, 0x28
lea rcx, [0x14020cda8]
call fcn.14007a92c
lea rcx, str.NACL_SRPC_DEBUG
call fcn.14009f438
and dword [0x14020cdb8], 0
test rax, rax
je 0x140074186
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a016c
mov ecx, dword [0x14020cdb8]
test eax, eax
cmovns ecx, eax
mov dword [0x14020cdb8], ecx
mov eax, 1
add rsp, 0x28
ret

Function at 0x140074140
Capabilities:
Query environment variable

Disassembly:
mov dword [0x14020cda0], 0x10000
jmp 0x140074140
sub rsp, 0x28
lea rcx, [0x14020cda8]
call fcn.14007a92c
lea rcx, str.NACL_SRPC_DEBUG
call fcn.14009f438
and dword [0x14020cdb8], 0
test rax, rax
je 0x140074186
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a016c
mov ecx, dword [0x14020cdb8]
test eax, eax
cmovns ecx, eax
mov dword [0x14020cdb8], ecx
mov eax, 1
add rsp, 0x28
ret
Function at 0x14007479c
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x14007876c
sub rsp, 0x1d8
mov rax, qword [0x1401f05f0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400787be
movzx eax, word [rsp + 0x20]
shr ax, 8
cmp al, 2
jne 0x1400787db
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400991d0
add rsp, 0x1d8
ret
lea rdx, str.WSAStartup_failed_with_error:__d_n
mov r8d, eax
mov ecx, 0xfffffffd
call fcn.14007a9a0
or ecx, 0xffffffff
call fcn.140098bb4
int3
lea rdx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
mov ecx, 0xfffffffd
call fcn.14007a9a0
call qword [sym.imp.WS2_32.dll_WSACleanup]
or ecx, 0xffffffff
call fcn.140098bb4
int3

Function at 0x1400748d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14007494d
mov r8d, 1
lea r9, [rsp + 0x40]
mov rcx, rax
lea edx, [r8 + 5]
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
xor ebx, ebx
test eax, eax
je 0x14007492b
lea rdx, str.Failed_to_set_TCP_NODELAY_option._n
lea ecx, [rbx - 2]
call fcn.14007a9a0
mov ecx, 0x28
call fcn.140098304
test rax, rax
je 0x140074948
mov rdx, rdi
mov rcx, rax
call fcn.1400747a4
mov rbx, rax
mov rax, rbx
jmp 0x14007494f
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007495c
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401f05f0]
xor rax, rsp
mov qword [rbp - 8], rax
mov edx, 1
mov rsi, rcx
lea r12d, [rdx + 1]
lea r8d, [rdx + 5]
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
or rbx, 0xffffffffffffffff
mov rdi, rax
cmp rax, rbx
jne 0x1400749d8
lea rdx, str.Failed_to_create_socket._n
mov ecx, 0xfffffffd
call fcn.14007a9a0
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400991d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
xor eax, eax
mov ecx, 0x7f000001
mov qword [rbp - 0x38], rax
mov word [rbp - 0x38], r12w
mov qword [rbp - 0x30], rax
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, 0xfae
mov dword [rbp - 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x36], ax
test rsi, rsi
je 0x140074a61
and qword [rbp - 0x18], 0
cmp byte [rsi], 0
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], 0
jne 0x140074a23
xor ebx, ebx
jmp 0x140074a2c
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140074a23
lea rcx, [rbp - 0x28]
mov r8, rbx
mov rdx, rsi
call fcn.14000172c
lea r8, [rbp - 0x36]
lea rdx, [rbp - 0x34]
lea rcx, [rbp - 0x28]
mov word [rbp - 0x38], r12w
call fcn.140074d54
cmp qword [rbp - 0x10], 0x10
jb 0x140074a61
mov rcx, qword [rbp - 0x28]
call fcn.14006bd10
lea r9, [rbp - 0x40]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov rcx, rdi
mov dword [rbp - 0x40], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140074a9d
lea rdx, str.Failed_to_set_SO_EXCLUSIVEADDRUSE_option._n
mov ecx, 0xfffffffe
call fcn.14007a9a0
lea rdx, [rbp - 0x38]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x140074ac0
lea rdx, str.Failed_to_bind_server._n
jmp 0x1400749ab
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x140074ade
lea rdx, str.Failed_to_listen._n
jmp 0x1400749ab
mov ecx, 8
call fcn.140098304
test rax, rax
je 0x1400749b5
mov qword [rax], rdi
jmp 0x1400749b7

Function at 0x140074b0c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
mov rax, qword [0x1401f05f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
xor eax, eax
lea r8, [r11 - 0x28]
lea rdx, [r11 - 0x20]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
xor ebx, ebx
test eax, eax
je 0x140074b60
lea rdx, str.Failed_to_retrieve_bound_address._n
lea ecx, [rbx - 3]
call fcn.14007a9a0
movzx eax, bx
jmp 0x140074b6b
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400991d0
add rsp, 0x40
pop rbx
ret
Function at 0x140074c9c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
movsxd rdx, dword [rcx + 0x14]
mov r8d, 0x1000
mov rbx, rcx
sub r8d, dword [rcx + 0x14]
add rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x18]
jmp 0x140074d33
je 0x140074d4f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140074d12
mov rcx, qword [rbx + 0x20]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x140074cf3
lea rdx, str.Transport::ReadSomeData:_Failed_to_wait_on_socket_event_n
mov ecx, 0xfffffffc
call fcn.14007a9a0
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x140074d1d
lea rdx, str.Transport::ReadSomeData:_Failed_to_reset_socket_event_n
lea ecx, [rax - 4]
call fcn.14007a9a0
jmp 0x140074d1d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
jne 0x140074d4f
movsxd rdx, dword [rbx + 0x14]
mov rcx, qword [rbx + 0x18]
mov r8d, 0x1000
sub r8d, dword [rbx + 0x14]
add rdx, qword [rbx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140074cbd
add dword [rbx + 0x14], eax
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
jmp 0x140074d49

Function at 0x14007876c
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x14007876c
sub rsp, 0x1d8
mov rax, qword [0x1401f05f0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400787be
movzx eax, word [rsp + 0x20]
shr ax, 8
cmp al, 2
jne 0x1400787db
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400991d0
add rsp, 0x1d8
ret
lea rdx, str.WSAStartup_failed_with_error:__d_n
mov r8d, eax
mov ecx, 0xfffffffd
call fcn.14007a9a0
or ecx, 0xffffffff
call fcn.140098bb4
int3
lea rdx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
mov ecx, 0xfffffffd
call fcn.14007a9a0
call qword [sym.imp.WS2_32.dll_WSACleanup]
or ecx, 0xffffffff
call fcn.140098bb4
int3
Function at 0x14007a9f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.NACLLOG
call fcn.14009f438
test rax, rax
jne 0x14007aa15
call fcn.140099a28
lea rcx, [rax + 0x60]
call fcn.14007ac5c
jmp 0x14007aa1d
mov rcx, rax
call fcn.14007acac
mov rcx, rax
add rsp, 0x28
jmp 0x14007ae1c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.14009ea04
mov rbx, rax
test rax, rax
jne 0x14007ae61
lea rcx, str.NaClLogSetFile
call fcn.1400a0640
call fcn.140099a28
lea rdx, str.No_memory_for_log_buffers_n
lea rcx, [rax + 0x60]
call fcn.14009f26c
call fcn.14007a87c
mov rdx, rdi
mov rcx, rbx
call fcn.1400bd88c
test eax, eax
jne 0x14007ae8a
call fcn.140099a28
lea rdx, str.NaClLog_module_internal_error:_GioFileRefCtor_failed_n
lea rcx, [rax + 0x60]
call fcn.14009f26c
call fcn.14007a87c
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14007aa2c
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.NACLVERBOSITY
call fcn.14009f438
test rax, rax
je 0x14007aa52
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a016c
test eax, eax
jns 0x14007aa54
xor eax, eax
add rsp, 0x28
ret

Function at 0x14007ae98
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14007a9f0
mov rbx, rax
call fcn.14007aa2c
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp 0x14007aebc
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, str.NACLVERBOSITY
mov rbx, rdx
call fcn.14009f438
mov r8, rbx
mov ecx, edi
mov rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14007aef0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14020ce08], 0
mov rbx, r8
mov rdi, rdx
mov esi, ecx
jne 0x14007af26
lea rcx, [0x14020ce10]
call fcn.14007a92c
mov dword [0x14020ce08], 1
mov ecx, esi
call fcn.14007b250
mov rcx, rdi
call fcn.14007af4c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007b124

Function at 0x14007aebc
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14007a9f0
mov rbx, rax
call fcn.14007aa2c
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp 0x14007aebc
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, str.NACLVERBOSITY
mov rbx, rdx
call fcn.14009f438
mov r8, rbx
mov ecx, edi
mov rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14007aef0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14020ce08], 0
mov rbx, r8
mov rdi, rdx
mov esi, ecx
jne 0x14007af26
lea rcx, [0x14020ce10]
call fcn.14007a92c
mov dword [0x14020ce08], 1
mov ecx, esi
call fcn.14007b250
mov rcx, rdi
call fcn.14007af4c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007b124
Function at 0x14007b820
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, rcx
xor edi, edi
lea rdx, str.Entered_NaClCalibrateWindowsClockQpc_n
lea ecx, [rdi + 5]
call fcn.14007a9a0
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rbp + 0x3c]
mov rbx, qword [rbp + 0x38]
mov dword [rbp + 0x44], eax
movabs r12, 0x346dc5d63886594b
mov dword [rbp + 0x40], ebx
mov rax, r12
mov qword [rbp - 0x20], rbx
mul qword [rbp + 0x40]
mov rsi, rdx
shr rsi, 0xb
add rsi, 0x3e8
lea rcx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14007b962
lea rcx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14007b962
mov r8, qword [rbp - 0x10]
mov r10d, dword [rbp + 0x4c]
mov rcx, qword [rbp + 0x48]
mov r9, r8
sub r9, qword [rbp - 0x18]
imul rax, r9, 0x3e8
cqo
idiv qword [r14 + 0x48]
mov r11, rax
cmp r10d, dword [rbp - 0x1c]
jne 0x14007b8de
mov eax, edi
cmp ecx, ebx
je 0x14007b8e3
mov eax, 1
test r9, r9
js 0x14007b8f2
cmp r11, 4
jg 0x14007b8f2
test eax, eax
jne 0x14007b918
test eax, eax
mov rax, r12
mov dword [rbp + 0x44], r10d
cmovne rbx, rcx
mov dword [rbp + 0x40], ecx
mov qword [rbp - 0x20], rbx
mul qword [rbp + 0x40]
shr rdx, 0xb
cmp rdx, rsi
jae 0x14007b91d
jmp 0x14007b881
mov edi, 1
mov dword [rbp + 0x40], ecx
mov dword [rbp + 0x44], r10d
mov qword [r14 + 0x58], r8
mov rax, r12
mov r8d, edi
mov ecx, 5
mul qword [rbp + 0x40]
mov rax, r9
shr rdx, 0xb
mov qword [r14 + 0x28], rdx
cqo
sub rax, rdx
lea rdx, str.Leaving_NaClCalibrateWindowsClockQpc_:__d_n
sar rax, 1
add rax, qword [rbp - 0x18]
mov qword [r14 + 0x50], rax
call fcn.14007a9a0
mov eax, edi
jmp 0x14007b964
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14007c558
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call fcn.1400a0ec4
test eax, eax
je 0x14007c575
call fcn.14009d10c
mov ecx, dword [rax]
call fcn.14007c05c
neg eax
jmp 0x14007c577
xor eax, eax
add rsp, 0x28
ret
Function at 0x14007cde0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov ebx, r9d
mov edi, r8d
mov r13, rcx
test rcx, rcx
jne 0x14007ce22
lea rdx, str.NaClHostDescOpen:_this_is_NULL_n
lea ecx, [r13 - 4]
call fcn.14007a9a0
mov rdx, qword [rsp + 0x88]
test edi, 0xfffff9bc
je 0x14007ce34
mov eax, 0xffffffea
jmp 0x14007cfe9
mov esi, edi
and esi, 3
mov ecx, esi
je 0x14007ce75
dec ecx
je 0x14007ce68
dec ecx
je 0x14007ce5b
lea rdx, str.NaClHostDescOpen:_bad_access_flags_0x_x._n
mov r8d, edi
mov ecx, 0xfffffffd
call fcn.14007a9a0
jmp 0x14007ce2a
mov ebp, 0xe0000000
mov r14d, 0x8002
jmp 0x14007ce80
mov ebp, 0xe0000000
mov r14d, 0x8001
jmp 0x14007ce80
mov ebp, 0xa0000000
mov r14d, 0x8000
mov eax, 0x1000001
test bl, 0x80
mov ecx, edi
lea r12d, [rax + 0x7f]
cmove r12d, eax
mov eax, 4
lea r10d, [rax - 3]
and ecx, 0x240
je 0x14007ced0
sub ecx, 0x40
je 0x14007cecc
sub ecx, 0x1c0
je 0x14007cec2
cmp ecx, 0x40
jne 0x14007ceb9
mov ebx, eax
jmp 0x14007cec7
mov ebx, dword [rsp + 0x90]
jmp 0x14007ced5
mov ebx, 5
mov r15d, r10d
jmp 0x14007ced5
mov ebx, eax
jmp 0x14007ced5
mov ebx, 3
bt edi, 0xa
jae 0x14007cedf
or r14d, 8
mov r8, rdx
lea rdx, str.NaClHostDescOpen:_CreateFileA_path_s__desired_access0x_x__share_modeALL__security_attributesNULL__creation_disposition_d__flags_and_attributes_d__template_fileNULL__n
mov r9d, ebp
mov ecx, r10d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebx
call fcn.14007a9a0
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x88]
xor r9d, r9d
mov edx, ebp
mov dword [rsp + 0x28], r12d
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14007cf54
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescOpen:_CreateFile_failed__d_n
lea ecx, [rbp + 4]
mov r8d, eax
mov ebx, eax
call fcn.14007a9a0
mov ecx, ebx
call fcn.14007e000
neg eax
jmp 0x14007cfe9
test r15d, r15d
je 0x14007cfb0
test esi, esi
je 0x14007cfb0
lea rdx, str.NaClHostDescOpen:_Truncating_file_n
mov ecx, 4
call fcn.14007a9a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14007cfb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescOpen:_could_not_truncate_file:_last_error__d._n
mov ecx, 0xfffffffd
mov r8d, eax
mov ebx, eax
call fcn.14007a9a0
cmp ebx, 0x4c8
jne 0x14007cfb0
lea rdx, str.NaClHostDescOpen:_this_is_due_to_an_existing_mapping_of_the_same_file._n
mov ecx, 0xfffffffd
call fcn.14007a9a0
mov edx, r14d
mov rcx, rbp
call fcn.14009b3b8
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14007cfda
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClHostDescOpen_failed:_err__d_n
lea ecx, [rbx - 3]
mov r8d, eax
call fcn.14007a9a0
mov r8d, edi
mov edx, ebx
mov rcx, r13
call fcn.14007c618
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret