joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c40640
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c4074d
mov ebx, eax
xor eax, eax
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp ebx, 0x7ffffff0
jae 0x1c4075a
cmp ebx, 5
jae 0x1c40713
lea edi, [ebp - 0x1c]
mov byte [edi + 0xb], bl
mov eax, ebx
add eax, ebx
push eax
push 0
push edi
call fcn.01c9afc0
add esp, 0xc
mov word [edi + ebx*2], 0
cmp byte [ebp - 0x11], 0
jns 0x1c406b3
mov eax, dword [ebp - 0x1c]
jmp 0x1c406b6
lea eax, [ebp - 0x1c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
mov ebx, dword [ebp + 8]
je 0x1c40741
movzx ecx, byte [ebp - 0x11]
test cl, cl
jns 0x1c406d1
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jae 0x1c40741
xor esi, esi
lea edi, [ebp - 0x1c]
mov ecx, edi
push esi
push eax
call fcn.01c75710
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
movsd xmm0, qword [edi]
movsd qword [ebx], xmm0
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
cmp byte [ebp - 0x11], 0
js 0x1c4075f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, ebx
or eax, 7
inc eax
js 0x1c4076c
mov dword [ebp - 0x20], eax
add eax, eax
push eax
call fcn.01c97121
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
or eax, 0x80000000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
jmp 0x1c40692
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 8], eax
jmp 0x1c406f9
mov ebx, dword [ebp + 8]
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov dword [ebx + 8], edi
jmp 0x1c406ff
call fcn.01cab250
push dword [ebp - 0x1c]
call fcn.01c97151
add esp, 4
jmp 0x1c406ff
call fcn.01cc3780
int3
Function at 0x1c40b10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov edi, esi
jns 0x1c40b30
mov edi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c40b5e
test al, 0x10
jne 0x1c40bdb
push edi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.01c40cb0
add esp, 0xc
xor ebx, ebx
jmp 0x1c40bf0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
movzx eax, byte [esi + 0xb]
mov ecx, esi
test al, al
jns 0x1c40b78
mov ecx, dword [esi]
mov eax, dword [esi + 4]
add eax, eax
test eax, eax
je 0x1c40b95
movzx edx, word [ecx + eax - 2]
add eax, 0xfffffffe
cmp edx, 0x5c
je 0x1c40b90
cmp edx, 0x2f
jne 0x1c40b7a
cmp eax, 0xfffffffe
jne 0x1c40c04
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c40bc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0xb7
je 0x1c40c5c
push esi
push edi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.01c40cb0
add esp, 0xc
xor ebx, ebx
cmp byte [ebp - 0x15], 0
jns 0x1c40bf0
push dword [ebp - 0x20]
call fcn.01c97151
add esp, 4
jmp 0x1c40bf0
push edi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_exists___n
call fcn.01c40cb0
add esp, 0xc
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
sar eax, 1
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push edx
push eax
push 0
push esi
call fcn.01c3dc40
cmp byte [ebp - 0x15], 0
jns 0x1c40c27
push dword [ebp - 0x20]
call fcn.01c97151
add esp, 4
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
mov dword [ecx + 8], eax
movsd xmm0, qword [ebp - 0x2c]
movsd qword [ecx], xmm0
push ecx
call fcn.01c40b10
add esp, 4
test al, al
jne 0x1c40b95
push str.Failed_to_create_one_of_the_parent_directories
call fcn.01c40cb0
add esp, 4
jmp 0x1c40bc6
lea ecx, [ebp - 0x2c]
push edi
call fcn.01cc3870
lea eax, [ebp - 0x2c]
cmp byte [eax + 0xb], 0
jns 0x1c40c71
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
cmp byte [ebp - 0x21], 0
jns 0x1c40c9d
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.01c97151
mov eax, dword [ebp - 0x30]
add esp, 4
test al, al
je 0x1c40bb7
jmp 0x1c40bc8
Function at 0x1c40cb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01c6f550
mov ebx, 0x1d34fd4
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01c9bfab
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c41440
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, dword [ebp + 8]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x216]
push 0x206
push 0xff
push edi
call fcn.01c9afc0
add esp, 0xc
mov word [edi - 2], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c414d3
inc eax
cmp eax, 1
je 0x1c414d3
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c4149b
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c414ba
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01cad733
add esp, 0xc
test eax, eax
je 0x1c415b0
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c41537
inc eax
cmp eax, 1
je 0x1c41537
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c414ff
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c4151e
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01cad733
add esp, 0xc
test eax, eax
je 0x1c415d5
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c41597
inc eax
cmp eax, 1
je 0x1c41597
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c41563
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c41582
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01cad733
add esp, 0xc
test eax, eax
je 0x1c415fa
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c415bb
mov eax, dword [esi + 4]
mov bl, 1
cmp eax, edi
je 0x1c41599
mov ecx, esi
push edi
call fcn.01cd2b00
cmp word [eax], 0x5c
jne 0x1c414d3
jmp 0x1c41599
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c415e0
mov eax, dword [esi + 4]
mov bl, 1
cmp eax, edi
je 0x1c41599
mov ecx, esi
push edi
call fcn.01cd2b00
cmp word [eax], 0x5c
jne 0x1c41537
jmp 0x1c41599
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c41605
mov eax, dword [esi + 4]
mov bl, 1
cmp eax, edi
je 0x1c41599
mov ecx, esi
push edi
call fcn.01cd2b00
cmp word [eax], 0x5c
jne 0x1c41597
jmp 0x1c41599
Function at 0x1c41c40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d357d4]
test eax, eax
jne 0x1c41d28
mov edi, 0xc
push edi
call fcn.01c97121
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1d357d4], eax
push edi
call fcn.01c97121
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1d357d8], eax
call fcn.01c3ffd0
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push str.user_data_dir
call fcn.01cc3870
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.01cc3870
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.01c401e0
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.01c41730
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x1c41cf7
push dword [ebp - 0x1c]
call fcn.01c97151
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x1c41d08
push dword [ebp - 0x34]
call fcn.01c97151
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1c41d19
push dword [ebp - 0x28]
call fcn.01c97151
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x1c41dcd
mov eax, dword [0x1d357d4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp eax, ecx
je 0x1c41d4a
cmp byte [ecx + 0xb], 0
movzx edx, byte [eax + 0xb]
js 0x1c41da7
test dl, dl
jns 0x1c41d87
push dword [eax + 4]
push dword [eax]
call fcn.01c3de40
mov bl, 1
test esi, esi
je 0x1c41d73
mov eax, dword [0x1d357d8]
cmp eax, esi
je 0x1c41d73
cmp byte [esi + 0xb], 0
movzx edx, byte [eax + 0xb]
js 0x1c41db9
test dl, dl
jns 0x1c41d97
mov ecx, esi
push dword [eax + 4]
push dword [eax]
call fcn.01c3de40
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x1c41d4a
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
movsd xmm0, qword [eax]
movsd qword [esi], xmm0
jmp 0x1c41d73
test dl, dl
jns 0x1c41db0
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
call fcn.01c3dd70
jmp 0x1c41d4a
test dl, dl
jns 0x1c41dc2
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, esi
push edx
push eax
call fcn.01c3dd70
jmp 0x1c41d73
xor ebx, ebx
jmp 0x1c41d73
Function at 0x1c42360
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1c4239b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x1c423b2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1c42394
mov dword [esi], ebx
call fcn.01c7b5a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x1c423c9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.01c7b5a0
push dword [esi]
call fcn.01c7c8a0
add esp, 4
mov dword [esi], 0
jmp 0x1c42385
int3

Function at 0x1c42440
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d357e8]
mov ecx, dword [0x1d33130]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c4248d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, 0x1d357e4
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d357e8
call fcn.01c97191
add esp, 4
cmp dword [0x1d357e8], 0xffffffff
jne 0x1c42473
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c9afc0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.01c97121
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d35818]
mov ecx, dword [0x1d33130]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c42536
mov ecx, esi
push ebx
push 0x1d357f4
push edi
call fcn.01c42630
mov dword [0x1d357e4], esi
push 0x1d357e8
call fcn.01c9720b
add esp, 4
jmp 0x1c42473
push 0x1d35818
call fcn.01c97191
add esp, 4
cmp dword [0x1d35818], 0xffffffff
jne 0x1c42510
xorps xmm0, xmm0
movups xmmword [0x1d35804], xmm0
movups xmmword [0x1d357f4], xmm0
mov dword [0x1d35814], 0
push 0x1d357f4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d35818
call fcn.01c9720b
add esp, 4
jmp 0x1c42510

Function at 0x1c42590
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d35818]
mov ecx, dword [0x1d33130]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c425c1
movzx eax, word [0x1d357f4]
cmp eax, 9
jne 0x1c4260c
xor eax, eax
inc eax
pop ebp
ret
push 0x1d35818
call fcn.01c97191
add esp, 4
cmp dword [0x1d35818], 0xffffffff
jne 0x1c425b0
xorps xmm0, xmm0
movups xmmword [0x1d35804], xmm0
movups xmmword [0x1d357f4], xmm0
mov dword [0x1d35814], 0
push 0x1d357f4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d35818
call fcn.01c9720b
add esp, 4
jmp 0x1c425b0
test eax, eax
je 0x1c425bf
cmp eax, 6
jne 0x1c4261c
mov eax, 2
jmp 0x1c425bf
cmp eax, 0xc
jne 0x1c42628
mov eax, 3
jmp 0x1c425bf
mov eax, 4
jmp 0x1c425bf
Function at 0x1c42f70
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [esp + 0x28], eax
cmp dword [ebp + 8], 0
je 0x1c43145
cmp dword [0x1d19b70], 0xe69e32f3
jne 0x1c43148
mov ecx, 0x308
mov esi, dword [ebp + 8]
add ecx, dword [esi + 0xc]
mov byte [esp + 0xf], 0xff
movzx eax, byte [esi + 2]
push eax
mov dword [esp + 8], ecx
push ecx
call fcn.01c76910
add esp, 8
movzx ebx, ax
shl ebx, 5
lea edi, [esi + ebx]
add edi, 0x48
add esi, 0x40
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c4310d
mov dword [esp + 8], esi
mov eax, dword [edi]
mov esi, dword [eax]
test esi, esi
je 0x1c430bc
mov byte [esp + 0xf], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x1c430b2
mov edi, dword [ebp + 8]
lea edx, [edi + 0x48]
mov ebx, dword [edx + ebx + 0xc]
bswap ecx
mov edx, ecx
xor edx, esi
cmp edx, 0x1fffff
ja 0x1c43119
mov edx, ecx
and edx, 0x1fc000
je 0x1c43119
prefetcht0 byte [ecx]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov eax, dword [eax + 8]
mov ecx, dword [edi + 0x117c]
add ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x1180]
mov dword [edi + 0x117c], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [edi + 0x1180], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, esi
push edi
call fcn.01c78c90
push esi
push dword [0x1d40030]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1d33130]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x90], esi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.01c97fe3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
mov edi, dword [ebp + 8]
jmp 0x1c4302d
lea eax, [esp + 0xf]
mov ecx, edi
push eax
push 0x4000
push dword [esp + 0xc]
push 2
mov edi, dword [ebp + 8]
push edi
call fcn.01c80bd0
test eax, eax
je 0x1c4314b
mov esi, eax
mov ecx, eax
and ecx, 0xffe00000
mov edx, eax
shr edx, 9
and edx, 0xfe0
lea eax, [edx + ecx]
movzx ecx, byte [edx + ecx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
add eax, 0x1000
jmp 0x1c43046
mov ecx, esi
call fcn.01c788e0
jmp 0x1c42fe1
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi], xmm0
mov ecx, edi
push 0
push dword [esi]
push str.first
call fcn.01cc36c0
push edi
call fcn.01c30600
add esp, 4
mov ecx, ebx
call fcn.01cda450
int3
int3
xor esi, esi
jmp 0x1c43069
Function at 0x1c47f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push str.LOCALAPPDATA
push esi
call fcn.01c40640
add esp, 8
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c47faa
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1c48021
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1c47fe1
cmp byte [ebp - 0x11], 0
jns 0x1c47fcd
push dword [ebp - 0x1c]
call fcn.01c97151
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, eax
inc edi
mov ecx, esi
push 0
push edi
call fcn.01c75710
cmp byte [ebp - 0x11], 0
jns 0x1c47ff7
mov esi, dword [ebp - 0x1c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1c48012
movzx ecx, byte [ebp - 0x11]
test cl, cl
jns 0x1c4800e
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x1c48016
xor ebx, ebx
jmp 0x1c47fbc
lea ecx, [ebp - 0x1c]
push 0
push eax
call fcn.01c75710
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov edi, dword [ebp - 0x14]
mov dword [esi + 8], edi
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c48057
mov eax, dword [esi + 4]
test eax, eax
je 0x1c480a5
mov ecx, dword [esi]
jmp 0x1c4805d
mov ecx, esi
test eax, eax
je 0x1c480a5
mov edi, dword [ebp + 0xc]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x1c48071
mov ecx, esi
push 0x5c
call fcn.01c75430
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c4807e
mov eax, dword [edi + 4]
mov edi, dword [edi]
mov ecx, esi
push eax
push edi
call fcn.01c3dad0
mov ecx, esi
push 0x5c
call fcn.01c75430
mov ecx, esi
push 9
push 0x1d090d0
call fcn.01c3dad0
mov bl, 1
jmp 0x1c47fbc
push str.string_index_out_of_bounds
push str.__pos___size__
push 0x464
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.01cc47f0
int3
Function at 0x1c4c7e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x1c4c817
mov eax, dword [0x1d31e1c]
cmp eax, 0xffffffff
je 0x1c4c8a4
mov ebx, 0x100000
test eax, eax
jne 0x1c4c817
mov ebx, 0x80000
push 0x10
call fcn.01c97121
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x1d37824]
bt ecx, eax
jb 0x1c4c899
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x1d3f824], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x1c4cc90
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1c4c8c8
test edi, edi
je 0x1c4c926
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.01c6f740
add esp, 4
jmp 0x1c4c845
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x1d31e1c
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1c4c995
mov eax, dword [0x1d31e1c]
jmp 0x1c4c809
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1c4c8e4
mov edi, eax
cmp eax, 0x5af
je 0x1c4c8e4
cmp edi, 0xe
jne 0x1c4c936
push ebx
call fcn.01ce0140
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x20]
je 0x1c4c880
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x1d37824]
bt edx, ecx
jae 0x1c4c915
push eax
call fcn.01c6f860
add esp, 4
push esi
call fcn.01c97151
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x1c4c880
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1c4c880
mov eax, dword [0x1d40194]
mov ecx, dword [0x1d33130]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c4c9a4
lea ebx, [ebp - 0x1c]
push edi
push ebx
call fcn.01c53470
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c4c96e
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push eax
push ebx
push dword [0x1d40190]
call fcn.01c84370
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x1c4c8ed
push dword [ebp - 0x1c]
call fcn.01c97151
jmp 0x1c4c8ea
mov dword [0x1d31e1c], 0
jmp 0x1c4c812
push 0x1d40194
call fcn.01c97191
add esp, 4
cmp dword [0x1d40194], 0xffffffff
jne 0x1c4c953
push 0x20
push str.create_thread_last_error
call fcn.01c59f80
add esp, 8
mov dword [0x1d40190], eax
push 0x1d40194
call fcn.01c9720b
add esp, 4
jmp 0x1c4c953
Function at 0x1c4d110
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov dword [ecx], 0x1d03184
add ecx, 4
call fcn.01c82950
lea ecx, [esi + 8]
call fcn.01c82950
xor ebx, ebx
mov byte [esi + 0xc], bl
lea ecx, [esi + 0x24]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], ebx
call fcn.01c82950
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea eax, [esi + 0x3c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], eax
xorps xmm0, xmm0
movups xmmword [esi + 0x44], xmm0
movups xmmword [esi + 0x54], xmm0
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
mov edi, 0x3f800000
mov dword [esi + 0x6c], edi
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], edi
movups xmmword [esi + 0x88], xmm0
mov dword [esi + 0x98], edi
movups xmmword [esi + 0x9c], xmm0
mov dword [esi + 0xac], edi
movups xmmword [esi + 0xb0], xmm0
mov dword [esi + 0xc0], edi
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xd8], ebx
movups xmmword [esi + 0xc8], xmm0
mov eax, dword [0x1d0be94]
mov dword [esi + 0xe8], eax
lea ecx, [esi + 0xec]
call fcn.01c5b570
lea ecx, [esi + 0x188]
push ebx
call fcn.01c598f0
lea ecx, [esi + 0x190]
push ebx
call fcn.01c598f0
lea ecx, [esi + 0x198]
push ebx
call fcn.01c598f0
xorps xmm0, xmm0
movups xmmword [esi + 0x1a0], xmm0
mov dword [esi + 0x1b0], edi
movups xmmword [esi + 0x1b4], xmm0
movups xmmword [esi + 0x1bd], xmm0
mov eax, dword [ebp + 8]
mov dword [esi + 0x1d0], eax
mov byte [esi + 0x1d4], bl
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e0], ebx
call fcn.01c30600
call fcn.01c4c380
mov ecx, eax
mov dword [esi + 0xd8], eax
xor ecx, 0x84222325
mov edx, 0x1b3
mov eax, ecx
mul edx
shl ecx, 8
add ecx, edx
add ecx, 0x8d40976c
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], ecx
mov edx, dword [esi + 0xe8]
mov ecx, dword [esi + 0xf0]
mov eax, ecx
shr eax, 6
test dword [0x1d039bc], edx
je 0x1c4d2d1
cmp ecx, 0x40
mov ecx, 0x3e8
cmovb eax, ecx
push eax
call fcn.01c84aa0
add esp, 4
mov edi, dword [esi + 0x14]
mov dword [esi + 0x14], eax
test edi, edi
jne 0x1c4d2f4
call fcn.01c5b1b0
mov ecx, eax
push 0
push str.TraceLog
push esi
call fcn.01c5b240
mov dword [0x1d40394], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
test dword [0x1d093cc], edx
jne 0x1c4d308
test dword [0x1d0be98], edx
jne 0x1c4d312
cmp ecx, 0x40
mov ecx, 0xfa0
cmovb eax, ecx
push eax
call fcn.01c5b390
jmp 0x1c4d2a1
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
jmp 0x1c4d2ae
cmp ecx, 0x40
mov ecx, 0x100
jmp 0x1c4d298
cmp ecx, 0x40
mov ecx, 0x7a1200
jmp 0x1c4d2e9