joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c3b5f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, ecx
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c3b612
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c3b68d
mov bl, 1
test al, 0x10
je 0x1c3b63b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [ebp - 0xb8]
mov ecx, edi
push 2
push 0x255
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.01c36d60
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cbf530
add esp, 0xc
push esi
push eax
call fcn.01c39f30
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.01cbf530
add esp, 0xc
mov ecx, edi
call fcn.01c6c780
jmp 0x1c3b6d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x251
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cbf530
add esp, 0xc
push esi
push eax
call fcn.01c39f30
add esp, 8
mov ecx, edi
call fcn.01c6d150
xor ebx, ebx
jmp 0x1c3b624
Function at 0x1c3d7c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x24
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0xc], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x28], 0x1cdea00
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
xor edi, edi
mov dword [ebp - 0x10], edi
push 0x1cdf1d6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1c], eax
lea esi, [ebp - 0x2c]
mov dword [esi], edi
push esi
push 0x40
push 0x80
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1c3d880
push 0x1cdf0b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x28]
push edi
push 0x80
push section..crthunk
push 0x1c88ba0
push edi
push str.NtMapViewOfSection
push 0x1c20000
push eax
call fcn.01c3d8a0
test eax, eax
js 0x1c3d887
push esi
push 0x20
push 0x80
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebp
ret
mov esi, 0xf
jmp 0x1c3d86d
mov dword [0x1cf71b0], eax
mov esi, 0x10
jmp 0x1c3d86d

Function at 0x1c3d9e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01c3d9f0

Function at 0x1c3dc60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.01c3e850
mov eax, dword [esi]
test eax, eax
je 0x1c3dcb3
mov edi, dword [eax + 0x28]
mov ebx, dword [eax + 0x2c]
xor esi, esi
cmp edi, ebx
jne 0x1c3dcd5
lea ecx, [ebp - 0x14]
call fcn.01c3dd20
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x1c3dc95
push edi
mov dword [ebp - 0x18], edx
push edx
call fcn.01c703c0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x1c3dcdb
cmp dword [edi + 0x50], 0
je 0x1c3dce0
add edi, 0x58
jmp 0x1c3dc91
cmp byte [edi + 0x1b], 0
js 0x1c3dceb
lea eax, [edi + 0x10]
jmp 0x1c3dcee
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1c3dcdb
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jb 0x1c3dcba
mov ecx, dword [ebp + 8]
push edi
call fcn.01c701b0
mov ecx, eax
jmp 0x1c3dccd
Function at 0x1c42550
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movsd qword [esi], xmm0
mov dword [esi + 8], 0
xor edi, edi
xor ebx, ebx
dec ebx
jmp 0x1c425e4
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, ebx
and al, 0x7f
mov byte [esi + 0xb], al
jmp 0x1c425cf
push dword [esp + 8]
call fcn.01c95155
add esp, 4
mov eax, dword [ebp + 8]
mov dword [eax], edi
or esi, 0x80000000
mov dword [eax + 8], esi
mov esi, eax
mov dword [eax + 4], ebx
mov eax, dword [esp + 4]
add al, 0x41
mov byte [edi + ebx], al
inc ebx
cmp byte [esi + 0xb], 0
jns 0x1c42594
mov dword [esi + 4], ebx
mov eax, dword [esp + 0xc]
mov byte [edi + ebx], 0
inc eax
cmp eax, 0x10
mov edi, eax
mov ebx, 0xffffffff
je 0x1c4257f
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
push 8
lea eax, [esp + 0x14]
push eax
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x1c426d0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, 0xffffffef
cmp edx, eax
mov edx, ebx
sbb edx, ecx
jb 0x1c425e4
push 0
push 0x1a
push ecx
push eax
call fcn.01cb2f50
movzx ebx, byte [esi + 0xb]
test bl, bl
mov dword [esp + 0xc], edi
js 0x1c4268d
mov edi, esi
cmp ebx, 0xa
jne 0x1c425c0
mov dword [esp + 4], eax
mov ebx, 0xa
mov eax, 0xb
mov dword [esp + 8], esi
lea ecx, [ebx + ebx]
cmp eax, ecx
cmova ecx, eax
mov esi, ecx
or esi, 7
inc esi
cmp ecx, 0xb
mov eax, 0xb
cmovb esi, eax
push esi
call fcn.01c9515a
add esp, 4
mov edi, eax
test ebx, ebx
je 0x1c4259d
push ebx
push dword [esp + 0xc]
push edi
call fcn.01c994a0
add esp, 0xc
cmp ebx, 0xa
je 0x1c425a9
jmp 0x1c4259d
mov dword [esp + 4], eax
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, edx
and eax, 0x7fffffff
lea ebx, [eax - 1]
cmp ebx, ecx
jne 0x1c426c1
cmp eax, 0x7ffffff8
je 0x1c426d3
mov ecx, dword [esi]
mov dword [esp + 8], ecx
mov esi, 0x7ffffff7
cmp ebx, 0x3ffffff2
jbe 0x1c42645
jmp 0x1c4265e
mov edi, esi
test edx, edx
jns 0x1c426c9
mov edi, dword [esi]
mov ebx, ecx
jmp 0x1c425bc
int3
int3
Function at 0x1c497b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1c497ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x1c4980c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1c497e7
mov dword [esi], ebx
call fcn.01c7adc0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x1c49881
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.01c7adc0
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
cmp dword [0x1d04b90], 0
je 0x1c49845
mov eax, dword [0x1d04b90]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x1cef298]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x1c497d8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1ce6fbc
push eax
call dword [sym.imp.progwrp.dll_GetProcAddress]
test eax, eax
je 0x1c49884
mov ecx, eax
cmp eax, sym.chrome_elf.dll_GetHandleVerifier
je 0x1c4987b
call dword [0x1cef298]
call ecx
push 0
push eax
call fcn.01c32ab0
add esp, 8
jmp 0x1c4981f
push 1
push 0
jmp 0x1c49871
int3
xor eax, eax
push eax
jmp 0x1c49870

Function at 0x1c4a4c0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1cf3040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x1c4a4e4
mov ecx, dword [eax + 4]
mov eax, dword [eax]
xor edi, edi
lea esi, [ebp - 0x1c]
mov dword [esi + 8], edi
xorps xmm0, xmm0
movsd qword [esi], xmm0
push esi
push ecx
push eax
call fcn.01c84f90
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x1c4a507
mov esi, dword [ebp - 0x1c]
lea ebx, [ebp - 0x28]
mov dword [ebx + 8], edi
xorps xmm0, xmm0
movsd qword [ebx], xmm0
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01c84f90
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x1c4a52c
mov ebx, dword [ebp - 0x28]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x1d], 0
jns 0x1c4a547
push dword [ebp - 0x28]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x1c4a558
push dword [ebp - 0x1c]
call fcn.01c95155
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1c4a600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x20b
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.01c7f230
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.01c7f260
cmp byte [edi + 0xb], 0
jns 0x1c4a65c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.01c823e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c4a690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x214
push str....._base_files_file_util_win.cc
push str.PathHasAccess
push ebx
call fcn.01c7f230
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.01c7f260
cmp byte [esi + 0xb], 0
jns 0x1c4a6ed
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x1c4a7e1
test al, 0x10
mov ecx, 0x40000000
mov eax, 2
cmove eax, ecx
mov ecx, 0x80
mov edx, 0x2000000
cmove edx, ecx
push ebx
push edx
push 3
push ebx
push 7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x1c4a74b
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x1c4a7a1
call fcn.01c7adc0
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
setne al
mov dword [esp + 0xc], eax
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1c4a781
call fcn.01c7adc0
cmp dword [0x1d04b90], 0
je 0x1c4a7a5
mov esi, dword [0x1d04b90]
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [0x1cef298]
mov ecx, esi
push ebx
call edi
lea ecx, [esp + 0x20]
call fcn.01c823e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c98173
mov eax, dword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x1c4a744
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1ce6fbc
push eax
call dword [sym.imp.progwrp.dll_GetProcAddress]
test eax, eax
je 0x1c4a7eb
mov ecx, eax
cmp eax, sym.chrome_elf.dll_GetHandleVerifier
je 0x1c4a7db
call dword [0x1cef298]
call ecx
push 0
push eax
call fcn.01c32ab0
add esp, 8
jmp 0x1c4a76a
push 1
push 0
jmp 0x1c4a7d1
mov dword [esp + 0xc], 0
jmp 0x1c4a781
xor eax, eax
push eax
jmp 0x1c4a7d0
Function at 0x1c4a7f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x233
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.01c7f230
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.01c7f260
cmp byte [edi + 0xb], 0
jns 0x1c4a84c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.01c823e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c4a880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x42a
push str....._base_files_file_util_win.cc
push 0x1ce8e84
push ebx
call fcn.01c7f230
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.01c7f260
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.01c99a20
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x1c4a972
push ebx
call fcn.01c96aca
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.01c8a940
lea eax, [esp + 0x14]
mov ecx, edi
mov edi, dword [ebp + 8]
push eax
call fcn.01c37720
cmp byte [edi + 0xb], 0
jns 0x1c4a942
push dword [edi]
call fcn.01c95155
add esp, 4
mov eax, dword [esp + 0x1c]
mov dword [edi + 8], eax
movq xmm0, qword [esp + 0x14]
movq qword [edi], xmm0
mov byte [esp + 0x1f], 0
mov word [esp + 0x14], 0
cmp byte [esp + 0x13], 0
jns 0x1c4a972
push dword [esp + 8]
call fcn.01c95155
add esp, 4
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.01c823e0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c4a9a0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.01c3e850
mov eax, dword [esi]
test eax, eax
je 0x1c4a9f3
mov edi, dword [eax + 0x28]
mov ebx, dword [eax + 0x2c]
xor esi, esi
cmp edi, ebx
jne 0x1c4a9fa
lea ecx, [ebp - 0x14]
call fcn.01c3dd20
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x1c4a9d5
cmp dword [edi + 0x50], 2
jne 0x1c4aa3d
cmp byte [edi + 0x1b], 0
js 0x1c4aa0b
lea eax, [edi + 0x10]
jmp 0x1c4aa0e
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1c4aa3d
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x1c4aa42
push edi
mov dword [ebp - 0x18], edx
push edx
call fcn.01c703c0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
add edi, 0x58
jmp 0x1c4a9d1
mov ecx, dword [ebp + 8]
push edi
call fcn.01c701b0
mov ecx, eax
jmp 0x1c4aa37

Function at 0x1c4acd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x97
push str....._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.01c7f230
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.01c7f260
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x1c4ad6b
mov eax, dword [ebp + 8]
mov dword [esp], 0xffffffff
push 0
push ebx
push ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp]
lea ecx, [esp + 0x10]
call fcn.01c823e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x1c4ad4b
Function at 0x1c4b9d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov al, byte [ebp + 0x10]
mov edx, dword [0x1cf3040]
xor edx, ebp
mov dword [esp + 0x20], edx
mov dword [esi], ecx
mov dword [esi + 4], edi
mov byte [esi + 8], al
mov dword [esi + 0xc], 0
xor edi, edi
dec edi
mov ebx, esp
mov dword [ebx + 4], edi
mov dword [ebx], edi
push 8
push ebx
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x1c4bb00
movsd xmm0, qword [esp]
movsd qword [esi + 0x10], xmm0
mov dword [esp + 4], edi
mov dword [esp], edi
push 8
push ebx
call sub.progwrp.dll_SystemFunction036
test al, al
je 0x1c4bb03
movq xmm0, qword [esp]
movq qword [esi + 0x18], xmm0
mov eax, dword [0x1d060c0]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c4ba9e
mov ebx, dword [ebp + 0xc]
lea eax, [ebx*8]
xor edi, edi
mov ecx, 0x1d04c80
push edi
push eax
call fcn.01c2f330
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
test ebx, ebx
je 0x1c4bb06
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push 0x1d060c0
call fcn.01c9518a
add esp, 4
cmp dword [0x1d060c0], 0xffffffff
jne 0x1c4ba62
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 4], xmm0
mov dword [esp + 0x14], 0xffffffff
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
mov byte [esp + 0x14], al
mov dword [esp + 0x18], eax
mov dword [esp], eax
mov byte [esp + 4], al
mov ecx, 0x1d04c80
push ebx
call fcn.01c744b0
push 0x1d060c0
call fcn.01c951d9
add esp, 4
jmp 0x1c4ba62
int3
int3
int3
Function at 0x1c4bf80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1cf3040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x1c4bfb0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c75b30
push 0
push eax
push 0x1c75b10
push 0x1d06128
call dword [sym.imp.progwrp.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c4c0b2
cmp dword [0x1d0612c], 0
jne 0x1c4bf9c
push dword [0x1d06130]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c4bf9c
mov esi, eax
mov eax, 0x1d06134
push eax
call dword [sym.imp.progwrp.dll_AcquireSRWLockExclusive]
mov edi, dword [0x1d06138]
mov ebx, dword [0x1d0613c]
mov eax, dword [0x1d06140]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1d06144]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1d06148]
mov dword [ebp - 0x24], eax
mov eax, 0x1d06134
push eax
call dword [sym.imp.progwrp.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x1c4c044
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x1cef298]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x1c4c059
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x1cef298]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1c4c06f
mov edi, dword [esi + 8]
call dword [0x1cef298]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x1c4c088
mov edi, dword [esi + 0xc]
call dword [0x1cef298]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x1c4c09d
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x1cef298]
push edi
call ebx
add esp, 4
push 0
push esi
push 0x1ce4020
call fcn.01c24530
add esp, 0xc
jmp 0x1c4bf9c
call fcn.01ca87c5
int3
Function at 0x1c5dcb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x1c5dd00
mov edx, dword [ecx + 0xc]
test edx, edx
jne 0x1c5dd0e
mov edx, dword [ecx]
xor eax, eax
test edx, edx
je 0x1c5dd00
mov dword [ecx + 0xc], edx
mov esi, dword [ecx + 4]
cmp esi, 0x40
jb 0x1c5dd05
movzx edi, word [edx]
cmp edi, 0x5a4d
jne 0x1c5dd05
mov edi, dword [edx + 0x3c]
lea ebx, [edi + 0x18]
xor eax, eax
cmp ebx, esi
ja 0x1c5dd00
add edx, edi
cmp dword [edx], 0x4550
jne 0x1c5dd00
add edx, 4
mov dword [ecx + 0x10], edx
mov eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ecx + 0xc], 0
jmp 0x1c5dd00
mov esi, dword [ecx + 4]
jmp 0x1c5dce2

Function at 0x1c5dd20
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x1c5dd28
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x10]
test esi, esi
jne 0x1c5dd91
test edx, edx
jne 0x1c5de28
mov edx, dword [ecx]
xor eax, eax
test edx, edx
je 0x1c5ddee
mov dword [ecx + 0xc], edx
mov esi, dword [ecx + 4]
mov dword [ebp - 0x10], esi
cmp esi, 0x40
jb 0x1c5de0e
movzx esi, word [edx]
cmp esi, 0x5a4d
jne 0x1c5de0e
mov esi, dword [edx + 0x3c]
lea edi, [esi + 0x18]
xor eax, eax
cmp edi, dword [ebp - 0x10]
ja 0x1c5ddee
add esi, edx
cmp dword [esi], 0x4550
jne 0x1c5ddee
add esi, 4
mov dword [ecx + 0x10], esi
jne 0x1c5dd97
jmp 0x1c5ddee
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
lea edi, [esi + 0x14]
mov ebx, edi
sub ebx, edx
lea edx, [ebx + 2]
xor eax, eax
cmp edx, dword [ebp - 0x10]
ja 0x1c5ddee
movzx edx, word [edi]
cmp edx, 0x20b
mov dword [ebp - 0x18], edi
jne 0x1c5ddfa
mov dl, 1
mov dword [ebp - 0x14], edx
mov edx, 2
mov dword [ecx + 8], edx
lea edx, [ebx + 0xf0]
mov edi, dword [ebp - 0x10]
cmp edx, edi
seta dl
add ebx, 0xe0
cmp ebx, edi
ja 0x1c5ddee
and dl, byte [ebp - 0x14]
mov edx, dword [ebp - 0x18]
jne 0x1c5ddee
cmp dword [ebp - 0x10], 0xffffffff
je 0x1c5de17
mov dword [ecx + 0x14], edx
mov eax, edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1c5dd27
cmp edx, 0x10b
jne 0x1c5de1f
xor edx, edx
inc edx
mov dword [ebp - 0x14], 0
jmp 0x1c5ddc0
mov dword [ecx + 0xc], 0
jmp 0x1c5ddee
mov eax, dword [esi + 0x4c]
mov dword [ecx + 4], eax
jmp 0x1c5dde9
mov dword [ecx + 8], 0
jmp 0x1c5ddee
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
jmp 0x1c5dd70

Function at 0x1c67e80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x1cf7de4], 0
je 0x1c67edf
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
lea ebx, [ebp - 0x18]
mov dword [ebx + 4], edi
mov dword [ebx], edi
push eax
push ebx
call sub.ntdll.dll_RtlInitUnicodeString
mov eax, 4
lea ecx, [ebp + 0x10]
push eax
push ecx
push eax
push edi
push ebx
push esi
call sub.ntdll.dll_NtSetValueKey
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01c34370
test al, al
jne 0x1c67e9c
xor ebx, ebx
jmp 0x1c67ecb