joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c6af70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov esi, esp
push 0x264
push str..._.._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push esi
call fcn.01c56aa0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push esi
call fcn.01c76110
cmp byte [edi + 0xb], 0
mov ebx, edi
jns 0x1c6afd6
mov ebx, dword [edi]
mov esi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c6b008
mov bl, 1
test al, 0x10
jne 0x1c6b0f3
test esi, esi
je 0x1c6aff9
mov dword [esi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1c6b0f3
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov ecx, edi
mov eax, esp
push eax
call fcn.01c628e0
movzx edx, byte [esp + 0xb]
mov eax, edx
test dl, dl
jns 0x1c6b038
mov eax, dword [esp + 4]
movzx ecx, byte [edi + 0xb]
test cl, cl
js 0x1c6b04e
mov esi, edx
mov edx, edi
cmp eax, ecx
jne 0x1c6b092
test eax, eax
jne 0x1c6b05e
jmp 0x1c6b07f
cmp eax, dword [edi + 4]
jne 0x1c6b092
mov esi, edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
test eax, eax
je 0x1c6b07f
mov edi, esp
mov ecx, esi
test cl, cl
jns 0x1c6b069
mov edi, dword [esp]
xor ecx, ecx
nop dword [eax + eax]
movzx esi, word [edi + ecx*2]
cmp si, word [edx + ecx*2]
jne 0x1c6b092
inc ecx
cmp eax, ecx
jne 0x1c6b070
mov eax, 0xfffffffc
mov edi, 2
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x1c6b0e1
jmp 0x1c6b0e3
mov esi, dword [ebp + 0xc]
push esi
lea eax, [esp + 4]
push eax
call fcn.01c6af70
add esp, 8
test al, al
je 0x1c6b0ea
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c6b0ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xb7
jne 0x1c6b0d4
push dword [ebp + 8]
call fcn.01c6ab40
add esp, 4
test al, al
jne 0x1c6b0ec
test esi, esi
je 0x1c6b0e3
push edi
call fcn.01c7f090
add esp, 4
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov ecx, esp
call fcn.01c62200
lea ecx, [esp + 0x10]
call fcn.01c76170
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c6bf3c
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x1cf151c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x1c6c017
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.01caf0d0
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x1cd5080]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x1c6c01e
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.01c6c067
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x1c6c01e
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x1c6c026
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x1cdd170]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c6c51c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret
Function at 0x1c702b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.01cab360
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d0b288]
cmp eax, 0xffffffff
je 0x1c7041a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x1c7041a
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.01cae5d0
add esp, 0xc
mov ecx, dword [0x1d0b288]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.01c82080
add esp, 8
test ebx, ebx
je 0x1c7032b
push ebx
call fcn.01caaebc
add esp, 4
mov eax, dword [0x1d1af94]
mov ecx, dword [0x1d0dc5c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7043b
mov esi, dword [0x1d1af90]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c7042f
lea eax, [ebp - 0x1410]
push 0xc00
push 0x1d1a390
push eax
call fcn.01cae5d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x100
jmp 0x1c7039e
mov edx, dword [ebp - 0x1418]
lea ecx, [edx - 1]
cmp edx, 2
jb 0x1c7040a
test al, 1
je 0x1c7040a
mov dword [ebp - 0x1418], ecx
xor edi, edi
lea esi, [ebp - 0x1408]
xor eax, eax
jmp 0x1c703cc
inc edi
add esi, 0xc
cmp edi, 0x100
je 0x1c70390
mov ebx, dword [ebp + edi*8 - 0x810]
test ebx, ebx
je 0x1c703c0
cmp dword [esi - 8], 0
je 0x1c703c0
mov ecx, dword [ebp + edi*8 - 0x80c]
cmp ecx, dword [esi]
jne 0x1c703c0
mov ecx, dword [esi - 4]
test ecx, ecx
je 0x1c703c0
mov dword [ebp + edi*8 - 0x810], 0
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov al, 1
jmp 0x1c703c0
push 2
push dword [ebp - 0x1414]
call fcn.01c82080
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.01c6c4c0
jmp 0x1c70361
push 0x1d1af94
call fcn.01caaf07
add esp, 4
cmp dword [0x1d1af94], 0xffffffff
jne 0x1c7034c
push 4
call fcn.01caae50
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.01c6c4b0
mov dword [0x1d1af90], esi
push 0x1d1af94
call fcn.01caaf7d
add esp, 4
jmp 0x1c7034c

Function at 0x1c70480
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d0b288]
cmp eax, 0xffffffff
je 0x1c704a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1c704b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x1d0b288]
cmp eax, 0xffffffff
je 0x1c704cd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1c704d2
call fcn.01c705f0
mov eax, dword [0x1d1af94]
mov ecx, dword [0x1d0dc5c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c705a5
mov edi, dword [0x1d1af90]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c70599
mov ecx, dword [0x1d1a38c]
inc ecx
mov edx, 0x100
nop word cs:[eax + eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x1d1a390], 0
je 0x1c7054d
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x1d1a390], 0
je 0x1c7054d
add ecx, 2
add edx, 0xfffffffe
jne 0x1c70520
jmp 0x1c7057d
lea ecx, [eax*4 + 0x1d1a390]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x1d1a394], ecx
mov dword [0x1d1a38c], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x1d1a398]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1c705ea
cmp eax, 0x100
jge 0x1c705ed
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.01c6c4c0
jmp 0x1c70508
push 0x1d1af94
call fcn.01caaf07
add esp, 4
cmp dword [0x1d1af94], 0xffffffff
jne 0x1c704f3
push 4
call fcn.01caae50
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.01c6c4b0
mov dword [0x1d1af90], edi
push 0x1d1af94
call fcn.01caaf7d
add esp, 4
jmp 0x1c704f3
int3
int3

Function at 0x1c705f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov ecx, dword [0x1d0b288]
mov dword [ebp - 0x810], ecx
cmp ecx, 0xffffffff
jne 0x1c70694
lea esi, [ebp - 0x810]
push esi
call fcn.01c82050
add esp, 4
test al, al
je 0x1c70715
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x1c70670
push esi
call fcn.01c82050
add esp, 4
test al, al
je 0x1c70718
cmp dword [ebp - 0x810], 0xffffffff
je 0x1c70718
push 0xffffffffffffffff
call fcn.01c82070
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x1d0b288], ecx
je 0x1c70694
push ecx
call fcn.01c82070
add esp, 4
mov ecx, dword [0x1d0b288]
mov dword [ebp - 0x810], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1c70712
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.01caf0d0
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.01c82080
add esp, 8
push 0x800
call fcn.01caaeb3
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.01cae5d0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.01c82080
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01caaec1
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x1c752e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x10], ecx
lea edx, [eax + ecx]
mov dword [ebp - 0x18], ebx
lea edi, [esi + ebx]
cmovs edi, edx
cmovs esi, eax
sub edi, esi
cmp edi, 4
jb 0x1c7534d
mov edx, esi
mov eax, edi
nop word [eax + eax]
imul ecx, dword [edx], 0x5bd1e995
mov ebx, ecx
shr ebx, 0x18
xor ebx, ecx
imul ecx, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, ecx
add edx, 4
add edi, 0xfffffffc
cmp edi, 3
ja 0x1c75320
cmp edi, 1
jne 0x1c75356
jmp 0x1c75372
mov eax, edi
mov edx, esi
cmp edi, 1
je 0x1c75372
cmp edi, 2
je 0x1c75369
cmp edi, 3
jne 0x1c7537d
movzx ecx, byte [edx + 2]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [edx + 1]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [edx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
xor ecx, ecx
test edi, edi
je 0x1c754e8
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov ecx, edi
shr ecx, 1
and ecx, 0x55555555
mov eax, edi
sub eax, ecx
mov ecx, eax
and ecx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, ecx
mov ecx, eax
shr ecx, 4
add ecx, eax
and ecx, 0xf0f0f0f
imul eax, ecx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x1c753e8
mov eax, edx
lea edx, [edi - 1]
and edx, ebx
jmp 0x1c753f9
mov eax, edx
mov edx, ebx
cmp ebx, edi
jb 0x1c753f9
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1c754e6
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], edi
mov edx, dword [ebp - 0x18]
test dl, dl
mov ecx, dword [ebp - 0x10]
cmovns ecx, edx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax]
test ebx, ebx
mov ecx, 0
je 0x1c754e8
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x18], eax
jmp 0x1c75458
and eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jne 0x1c754e6
mov ebx, dword [ebx]
test ebx, ebx
je 0x1c754e6
mov eax, dword [ebx + 4]
cmp dword [ebp - 0x14], eax
jne 0x1c754b0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x1c7546d
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x1c7544e
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x1c754c8
cmp dword [ebp - 0x10], 0
je 0x1c754e2
cmp byte [esi], dl
jne 0x1c7544e
dec eax
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x1c754e2
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x1c75490
jmp 0x1c7544e
cmp dword [ebp - 0x24], 1
jbe 0x1c75440
mov ecx, dword [ebp - 0x20]
cmp eax, ecx
jb 0x1c75443
xor edx, edx
div ecx
mov eax, edx
jmp 0x1c75443
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1c754e2
push eax
push esi
push ecx
call fcn.01cad6bd
add esp, 0xc
test eax, eax
jne 0x1c7544e
mov ecx, ebx
jmp 0x1c754e8
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c76bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ecx + 0x8f4]
mov ebx, dword [ecx + 0x8f8]
add ebx, eax
mov eax, dword [ecx + 0x8ec]
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x40000001
jb 0x1c76c06
push dword [ebp + 8]
call fcn.01c79a40
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xc]
test eax, eax
mov ecx, 0x40000000
mov edi, 0xaf000000
cmove edi, ecx
mov dword [esp + 0x54], 0x365f776f
mov dword [esp + 0x50], 0x775f7369
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x50]
push eax
call fcn.01c23c00
add esp, 4
cmp ebx, edi
jbe 0x1c76c66
push ebx
call fcn.01c79a70
mov dword [esp + 0x44], 0x657a69
mov dword [esp + 0x40], 0x735f6176
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x40]
push eax
call fcn.01c23c00
add esp, 4
mov eax, dword [esi + 0x8fc]
mov dword [esp + 0x34], 0x20200063
mov dword [esp + 0x30], 0x6f6c6c61
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
lea eax, [esp + 0x30]
push eax
call fcn.01c23c00
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [esi + 0x8ec]
mov dword [esp + 0x14], 0x20007469
mov dword [esp + 0x10], 0x6d6d6f63
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x10]
push eax
call fcn.01c23c00
add esp, 4
mov dword [esp + 0x24], 0x20202000
mov dword [esp + 0x20], 0x657a6973
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x20]
push eax
call fcn.01c23c00
add esp, 4
mov ecx, dword [0x1d1b080]
test ecx, ecx
je 0x1c76d39
call dword [section..00cfg]
push esi
call ecx
add esp, 4
push esi
call fcn.01c8c8c0
int3
Function at 0x1c7a4d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.01caf0d0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.01caae50
add esp, 4
mov esi, eax
mov ebx, dword [ebp - 0x130]
mov eax, dword [0x1d1b0b8]
mov ecx, dword [0x1d0dc5c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7a58e
mov ecx, esi
push ebx
push 0x1d1b094
push edi
call fcn.01c7a6e0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d1b0b8
call fcn.01caaf07
add esp, 4
cmp dword [0x1d1b0b8], 0xffffffff
jne 0x1c7a569
xorps xmm0, xmm0
movups xmmword [0x1d1b0a4], xmm0
movups xmmword [0x1d1b094], xmm0
mov dword [0x1d1b0b4], 0
push 0x1d1b094
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d1b0b8
call fcn.01caaf7d
add esp, 4
jmp 0x1c7a569

Function at 0x1c7a640
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d1b0b8]
mov ecx, dword [0x1d0dc5c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7a691
movzx ecx, word [0x1d1b094]
cmp ecx, 0xc
ja case.0x1c7a66e.1
xor eax, eax
jmp dword [ecx*4 + 0x1cdde14]
mov eax, 2
pop ebp
ret
mov eax, 4
pop ebp
ret
mov eax, 1
pop ebp
ret
mov eax, 3
pop ebp
ret
push 0x1d1b0b8
call fcn.01caaf07
add esp, 4
cmp dword [0x1d1b0b8], 0xffffffff
jne 0x1c7a660
xorps xmm0, xmm0
movups xmmword [0x1d1b0a4], xmm0
movups xmmword [0x1d1b094], xmm0
mov dword [0x1d1b0b4], 0
push 0x1d1b094
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d1b0b8
call fcn.01caaf7d
add esp, 4
jmp 0x1c7a660

Function at 0x1c7ad00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x1cf151c]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1c7ad68
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1c7ad68
cmp dword [ebp - 0x14], 4
jne 0x1c7ad68
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01caaec1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8
Function at 0x1c7ad80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.01cab360
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.01caf0d0
add esp, 0xc
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea eax, [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1c7ae56
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x1c7ae09
mov edi, 0x3f4
cmp eax, 1
jne 0x1c7ae56
mov ecx, esi
push ebx
jmp 0x1c7ae4f
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.01caf0d0
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x1c7ae56
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
call fcn.01c455cc
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x1c7d1b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x1cf151c]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1c7d1fd
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x1c7d200
int3
xor esi, esi
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.01caaec1
mov eax, esi
add esp, 8
pop esi
pop ebp
ret

Function at 0x1c7d212
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1cf151c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
push 0
push eax
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c7d28a
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, ebx
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1c7d29c
mov ebx, eax
push eax
mov edi, ecx
call ecx
cmp eax, 3
jne 0x1c7d2b5
mov dword [ebp - 0x14], 0xffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov ecx, edi
jne 0x1c7d257
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1c7d2a1
cmp ebx, 0xffffffff
je 0x1c7d2ba
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
jmp 0x1c7d2a1
int3
Function at 0x1c7d87a
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.01c7d78b
add esp, 0x10
or edx, eax
jne 0x1c7d8fd
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x1c7d8fd
push 2
call fcn.01c64270
add esp, 4
test al, al
je 0x1c7d8fb
call fcn.01c64b80
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfb
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.01c64d20
lea eax, [ebp - 0xac]
push 0xc
push 0x1cde2d3
push eax
call fcn.01c23dd0
add esp, 0xc
mov ecx, esi
call fcn.01c64dd0
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret

Function at 0x1c7dece
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c7def1
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c7df1d
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x1c7df12
mov eax, ebx
and eax, 0x400
jne 0x1c7dfc3
and ebx, 0x10
shr ebx, 4
jmp 0x1c7dfc5
push 2
call fcn.01c64270
add esp, 4
test al, al
je 0x1c7dfc3
call fcn.01c64b80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c64d20
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01c23dd0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c7df71
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.01c4af70
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c7df96
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.01c23dd0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c7dfb8
push dword [ebp - 0xc4]
call fcn.01caae80
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01c64dd0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret