joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c66130
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor eax, eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x1c6622d
xor eax, eax
inc eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov edi, eax
cmp dword [ebp - 0x10], 7
jb 0x1c66258
mov eax, 7
xor ecx, ecx
cpuid
and ebx, 0x20
shr cl, 3
and cl, 1
mov dword [ebp - 0x10], ecx
mov dword [esi], edi
mov eax, edi
and eax, 0xf
mov dword [esi + 8], eax
shr edi, 0xc
and edi, 3
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0xc], al
mov eax, ecx
shr eax, 0x19
and al, 1
mov byte [esi + 0xd], al
shr ecx, 0x1a
and cl, 1
mov byte [esi + 0xe], cl
mov ecx, dword [ebp - 0x14]
mov eax, ecx
and al, 1
mov byte [esi + 0xf], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [esi + 0x10], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [esi + 0x11], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [esi + 0x12], al
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0x13], al
mov eax, ecx
shr eax, 0x1f
mov byte [esi + 0x1a], al
mov eax, ecx
not eax
test eax, 0x1c000000
jne 0x1c66266
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [esi + 0x14], al
mov edx, dword [ebp - 0x14]
mov ecx, edx
shr ecx, 0x19
and cl, 1
mov byte [esi + 0x17], cl
shr edx, 0xc
and dl, 1
mov byte [esi + 0x15], dl
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [esi + 0x16], cl
mov eax, dword [ebp - 0x10]
mov byte [esi + 0x18], al
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000006
jle 0x1c6626a
mov eax, 0x80000007
xor ecx, ecx
cpuid
and dh, 1
mov byte [esi + 0x19], dh
test dh, dh
je 0x1c6626f
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
xor ebx, ebx
jmp 0x1c6617a
xor eax, eax
jmp 0x1c661fe
mov dh, byte [esi + 0x19]
jmp 0x1c6624c
cmp byte [esi + 0x1a], 0
je 0x1c66250
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp ebx, 0x7263694d
jne 0x1c66250
cmp ecx, 0x666f736f
jne 0x1c66250
cmp edx, 0x76482074
jne 0x1c66250
mov byte [esi + 0x19], 1
jmp 0x1c66250
Function at 0x1c67ae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1d12014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x1c67b10
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c67c10
push 0
push eax
push 0x1c67ac0
push 0x1d40260
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c67c0b
cmp dword [0x1d40264], 0
jne 0x1c67afc
push dword [0x1d40268]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c67afc
mov esi, eax
mov eax, 0x1d4026c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x1d40270]
mov ebx, dword [0x1d40274]
mov eax, dword [0x1d40278]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1d4027c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1d40280]
mov dword [ebp - 0x24], eax
mov eax, 0x1d4026c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x1c67ba4
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x1c67bb9
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1c67bcf
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x1c67be8
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x1c67bfd
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.01c8f300
add esp, 4
jmp 0x1c67afc
call fcn.01ca5ba0
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1d40268], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x1d40264], ecx
pop ebp
ret
Function at 0x1c67c30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c67c10
push 0
push eax
push 0x1c67ac0
push 0x1d40260
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c67d03
mov esi, dword [ebp + 0xc]
cmp dword [0x1d40264], 0
jne 0x1c67d11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1d40268]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1c67cc6
push 0x14
call fcn.01c8f2d0
add esp, 4
test eax, eax
je 0x1c67d11
mov edi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
push eax
push dword [0x1d40268]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1c67d08
mov ebx, dword [ebp + 8]
mov esi, 0x1d4026c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x1d40270], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01ca5ba0
push edi
call fcn.01c8f300
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x1c67cef

Function at 0x1c6d710
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x1c6d727
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x1c6d72a
and edx, 0x7f
mov ecx, edx
cmp edx, 4
jb 0x1c6d766
nop word cs:[eax + eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c6d740
cmp edx, 1
je 0x1c6d787
cmp edx, 2
je 0x1c6d77e
cmp edx, 3
jne 0x1c6d792
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x1c714c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d309c8]
mov ecx, dword [0x1d2e0e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7150d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, 0x1d309c4
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d309c8
call fcn.01c92097
add esp, 4
cmp dword [0x1d309c8], 0xffffffff
jne 0x1c714f3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c95850
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.01c91ff7
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d309f8]
mov ecx, dword [0x1d2e0e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c715b6
mov ecx, esi
push ebx
push 0x1d309d4
push edi
call fcn.01c43210
mov dword [0x1d309c4], esi
push 0x1d309c8
call fcn.01c9210d
add esp, 4
jmp 0x1c714f3
push 0x1d309f8
call fcn.01c92097
add esp, 4
cmp dword [0x1d309f8], 0xffffffff
jne 0x1c71590
xorps xmm0, xmm0
movups xmmword [0x1d309e4], xmm0
movups xmmword [0x1d309d4], xmm0
mov dword [0x1d309f4], 0
push 0x1d309d4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d309f8
call fcn.01c9210d
add esp, 4
jmp 0x1c71590
Function at 0x1c71610
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d309c8]
mov ecx, dword [0x1d2e0e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c71660
mov esi, dword [0x1d309c4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d309c8
call fcn.01c92097
add esp, 4
cmp dword [0x1d309c8], 0xffffffff
jne 0x1c71643
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c95850
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.01c91ff7
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d309f8]
mov ecx, dword [0x1d2e0e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c71709
mov ecx, esi
push ebx
push 0x1d309d4
push edi
call fcn.01c43210
mov dword [0x1d309c4], esi
push 0x1d309c8
call fcn.01c9210d
add esp, 4
jmp 0x1c71643
push 0x1d309f8
call fcn.01c92097
add esp, 4
cmp dword [0x1d309f8], 0xffffffff
jne 0x1c716e3
xorps xmm0, xmm0
movups xmmword [0x1d309e4], xmm0
movups xmmword [0x1d309d4], xmm0
mov dword [0x1d309f4], 0
push 0x1d309d4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d309f8
call fcn.01c9210d
add esp, 4
jmp 0x1c716e3
Function at 0x1c72040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x1c7211a
mov esi, ecx
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x3c]
cmp dword [edx + eax + 0x74], 0
je 0x1c7211a
add edx, eax
xor eax, eax
cmp word [edx + 0x14], 0x68
jb 0x1c72141
add edx, 0x78
je 0x1c72141
mov ecx, esi
push dword [edx]
call fcn.01c72020
test eax, eax
je 0x1c7211a
mov ecx, dword [ebp + 8]
cmp ecx, 0xffff
jbe 0x1c72139
mov edi, eax
mov dword [ebp - 0x10], esi
mov ecx, esi
push dword [eax + 0x20]
call fcn.01c72020
mov esi, eax
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1c7211a
lea ebx, [esi + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
mov edi, ebx
sub edi, esi
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
push dword [esi + edi*2]
call fcn.01c72020
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x1c720fa
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x1c720fc
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1c720ee
xor ecx, ecx
lea edi, [esi + edi*2]
movzx eax, byte [eax]
cmp cl, al
je 0x1c7211e
movzx ecx, cl
sub ecx, eax
cmovs ebx, edi
add edi, 4
test ecx, ecx
cmovg esi, edi
cmp esi, ebx
jne 0x1c720c6
xor eax, eax
jmp 0x1c72141
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call fcn.01c72020
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx ecx, word [eax + edi]
add cx, word [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
mov al, 1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c7a970
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.01c93400
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d2ce5c]
cmp eax, 0xffffffff
je 0x1c7aac3
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x1c7aac3
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.01c952d0
add esp, 0xc
mov ecx, dword [0x1d2ce5c]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.01c5dc90
add esp, 8
test ebx, ebx
je 0x1c7a9eb
push ebx
call fcn.01c9205c
add esp, 4
mov eax, dword [0x1d342c4]
mov ecx, dword [0x1d2e0e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7aad8
mov esi, dword [0x1d342c0]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c7ab1d
lea eax, [ebp - 0x1410]
push 0xc00
push 0x1d336c0
push eax
call fcn.01c952d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x101
test al, 1
je 0x1c7aab3
mov dword [ebp - 0x1418], ecx
xor ebx, ebx
lea edi, [ebp - 0x1408]
xor eax, eax
jmp 0x1c7aa6c
inc ebx
add edi, 0xc
cmp ebx, 0x100
je 0x1c7aaaa
mov esi, dword [ebp + ebx*8 - 0x810]
test esi, esi
je 0x1c7aa60
cmp dword [edi - 8], 0
je 0x1c7aa60
mov ecx, dword [ebp + ebx*8 - 0x80c]
cmp ecx, dword [edi]
jne 0x1c7aa60
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x1c7aa60
mov dword [ebp + ebx*8 - 0x810], 0
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x1c7aa60
mov ecx, dword [ebp - 0x1418]
dec ecx
jne 0x1c7aa48
push 2
push dword [ebp - 0x1414]
call fcn.01c5dc90
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d342c4
call fcn.01c92097
add esp, 4
cmp dword [0x1d342c4], 0xffffffff
jne 0x1c7aa0c
push 4
call fcn.01c91ff7
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.01c79a60
mov dword [0x1d342c0], esi
push 0x1d342c4
call fcn.01c9210d
add esp, 4
jmp 0x1c7aa0c
mov ecx, esi
call fcn.01c79a70
jmp 0x1c7aa21
Function at 0x1c812b0
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [0x1d3ec5c]
test dl, 1
je 0x1c812cf
call fcn.01c869e0
pop ebp
jmp fcn.01c86a00
test ecx, ecx
je 0x1c812de
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1c812e0
pop ebp
ret
int3

Function at 0x1c814c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 8], ecx
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x3e
push str....._base_files_file_win.cc
push str.Read
push esi
call fcn.01c73620
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.01c7b8d0
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x1c8159a
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x1c8159a
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c82b70
test al, al
jne 0x1c815cc
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c815ba
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1c815e6
lea ecx, [esp + 0x28]
call fcn.01c82c10
lea ecx, [esp + 0x30]
call fcn.01c7b950
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1c81591
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.01ce69f0
jmp 0x1c8154c
int3
Function at 0x1c815f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5b
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.01c73620
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.01c7b8d0
test ebx, ebx
js 0x1c816b6
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01c82b70
test al, al
jne 0x1c816bb
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c816cf
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1c816e1
lea ecx, [esp + 0x10]
call fcn.01c82c10
lea ecx, [esp + 0x20]
call fcn.01c7b950
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x1c81696
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::ReadAtCurrentPos
call fcn.01ce69f0
jmp 0x1c8166a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1c8168d
int3

Function at 0x1c816f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x7b
push str....._base_files_file_win.cc
push str.Write
push ebx
call fcn.01c73620
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.01c7b8d0
xor edi, edi
dec edi
cmp dword [ebp + 0xc], 0
js 0x1c817c0
cmp dword [ebp + 0x14], 0
js 0x1c817c0
mov edi, esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c82b70
test al, al
jne 0x1c817e0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
lea esi, [esp + 0xc]
mov dword [esi], 0xffffffff
push ebx
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
cmp eax, 1
sbb edi, edi
or edi, dword [esi]
lea ecx, [esp + 0x28]
call fcn.01c82c10
lea ecx, [esp + 0x30]
call fcn.01c7b950
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01c92fe3
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
lea ecx, [esp + 0x28]
push 0
push dword [ebp + 0x14]
push edi
push str.File::Write
call fcn.01ce69f0
jmp 0x1c81777
Function at 0x1c83de0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d40110]
mov ecx, dword [0x1d2e0e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c83e0b
mov ecx, 0x1d40108
pop ebp
jmp fcn.01c7ab30
push 0x1d40110
call fcn.01c92097
add esp, 4
cmp dword [0x1d40110], 0xffffffff
jne 0x1c83e00
xor eax, eax
mov dword [0x1d4010c], eax
mov dword [0x1d40108], eax
mov ecx, 0x1d40108
push eax
call fcn.01c57980
push 0x1d40110
call fcn.01c9210d
add esp, 4
jmp 0x1c83e00

Function at 0x1c85ab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x1c85b2e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x1c85b17
lea eax, [edi + 1]
cmp eax, 2
jb 0x1c85afb
mov dword [esi], edi
call fcn.01c73650
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x1c85b32
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.01c73650
push dword [esi]
call fcn.01c74d00
add esp, 4
mov dword [esi], 0
jmp 0x1c85aec
mov byte [esi + 4], 1
int3
Function at 0x1c87380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [esp + 0x48], eax
cmp ebx, 0x30
ja 0x1c874bd
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x30]
movdqa xmmword [eax], xmm0
movdqa xmmword [eax - 0x10], xmm0
movdqa xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [esp + 0xc], eax
call dword [section..00cfg]
lea eax, [esp + 0x10]
push esi
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
test ebx, ebx
je 0x1c8745d
xor eax, eax
mov cl, byte [edi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp ebx, eax
jne 0x1c87451
lea edi, [esi + 0xf4]
mov eax, dword [0x1d401a8]
bt eax, 0x19
jae 0x1c874c1
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.01c23500
add esp, 0xc
mov ecx, 0x1c21180
mov eax, 0x1c21d10
test edi, edi
je 0x1c87491
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
lea eax, [esp + 0x30]
movups xmm0, xmmword [eax]
mov eax, dword [esp + 0xc]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c92fe3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x1c874a8
bt eax, 9
jae 0x1c874e3
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.01c24020
add esp, 0xc
xor eax, eax
mov ecx, 0x1c240d0
jmp 0x1c8748b
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.01cecc40
add esp, 0xc
mov ecx, 0x1cecb40
mov eax, 0x1ced3d0
jmp 0x1c8748b