joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d1f600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01cf4830
mov ebx, 0x1da26fc
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01cc83fb
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d20610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x1d20713
mov esi, ecx
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x3c]
cmp dword [edx + eax + 0x74], 0
je 0x1d20713
add edx, eax
xor eax, eax
cmp word [edx + 0x14], 0x68
jb 0x1d20709
add edx, 0x78
je 0x1d20709
mov ecx, esi
push dword [edx]
call fcn.01d20560
test eax, eax
je 0x1d20713
cmp dword [ebp + 8], 0xffff
jbe 0x1d20717
mov edi, eax
mov dword [ebp - 0x10], esi
mov ecx, esi
push dword [eax + 0x20]
call fcn.01d20560
mov esi, eax
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x18]
lea ebx, [esi + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
jmp 0x1d206ac
xor ecx, ecx
lea edi, [esi + edi*2]
movzx edx, cl
movzx eax, byte [eax]
cmp edx, eax
lea edx, [edi + 4]
cmovg esi, edx
cmovs ebx, edi
cmp cl, al
je 0x1d206e6
cmp esi, ebx
je 0x1d20713
mov edi, ebx
sub edi, esi
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
push dword [esi + edi*2]
call fcn.01d20560
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x1d20692
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x1d20694
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1d206d8
jmp 0x1d20692
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call fcn.01d20560
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx ecx, word [eax + edi]
add cx, word [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
mov al, 1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor eax, eax
jmp 0x1d20709
mov ecx, dword [ebp + 8]
jmp 0x1d20701

Function at 0x1d27000
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1da3134]
mov ecx, dword [0x1d93658]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d27022
pop ebp
ret
push 0x1da3134
call fcn.01cc31f7
add esp, 4
cmp dword [0x1da3134], 0xffffffff
jne 0x1d27020
xorps xmm0, xmm0
movups xmmword [0x1da3120], xmm0
movups xmmword [0x1da3110], xmm0
mov dword [0x1da3130], 0
push 0x1da3110
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1da3134
call fcn.01cc326d
add esp, 4
jmp 0x1d27020
Function at 0x1d278d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1d27943
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1d2792d
cmp dword [ebp - 0x18], 4
jne 0x1d2792d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x1d2792d

Function at 0x1d27950
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.01cc4600
mov esi, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0xff
push ebx
call fcn.01cc71b0
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], edi
push ecx
push ebx
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1d279e9
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x1d279ed
push ebx
call fcn.01cdd136
add esp, 4
mov ecx, esi
push eax
push ebx
call fcn.01d1b7e0
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, eax
jmp 0x1d279d0
mov edi, 0x3f4
cmp eax, 2
jne 0x1d279d0
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.01cc71b0
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x1d279d0
lea eax, [ebp - 0x1010]
push eax
call fcn.01cdd136
add esp, 4
mov ecx, esi
push eax
lea eax, [ebp - 0x1010]
push eax
jmp 0x1d279c9

Function at 0x1d27a60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.01cdd136
add esp, 4
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1d27e90
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm0, qword [0x1da3140]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x1d27ebb
jnp 0x1d27ee0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.01cc3f9d
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1da3150]
mov ecx, dword [0x1d93658]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d28015
mov eax, dword [0x1da3160]
mov ecx, dword [0x1d93658]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d2804e
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub ebx, dword [0x1da3158]
sbb edi, dword [0x1da315c]
movd xmm0, edi
movd xmm1, ebx
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm1, qword [esp + 0x30]
pxor xmm0, xmm0
movsd xmm2, qword [0x1d81c28]
ucomisd xmm2, xmm1
ja 0x1d27ebb
mov eax, dword [esp + 8]
sub eax, dword [0x1da3148]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x1da314c]
movd xmm2, ecx
movd xmm0, eax
punpckldq xmm0, xmm2
punpckldq xmm0, xmmword [0x1d81c00]
subpd xmm0, xmmword [0x1d81c10]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x1da3140], xmm0
jmp 0x1d27ebb
push 0x1da3150
call fcn.01cc31f7
add esp, 4
cmp dword [0x1da3150], 0xffffffff
jne 0x1d27f1f
rdtsc
mov dword [0x1da3148], eax
mov dword [0x1da314c], edx
push 0x1da3150
call fcn.01cc326d
add esp, 4
jmp 0x1d27f1f
push 0x1da3160
call fcn.01cc31f7
add esp, 4
cmp dword [0x1da3160], 0xffffffff
jne 0x1d27f40
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [0x1da315c], ecx
mov dword [0x1da3158], eax
push 0x1da3160
call fcn.01cc326d
add esp, 4
jmp 0x1d27f40
Function at 0x1d28dd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, edx
mov esi, ecx
cmp byte [ebp + 8], 0
jne 0x1d28dec
mov al, byte [0x1da3194]
test al, 1
jne 0x1d28e70
mov eax, dword [0x1da319c]
mov ecx, dword [0x1d93658]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d28e25
mov ecx, dword [0x1da3198]
test ecx, ecx
je 0x1d28e6a
call dword [section..00cfg]
push edi
push esi
call ecx
test eax, eax
je 0x1d28e81
pop esi
pop edi
pop ebp
ret
push 0x1da319c
call fcn.01cc31f7
add esp, 4
cmp dword [0x1da319c], 0xffffffff
jne 0x1d28e09
push 0x1d7af48
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x1d28e84
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1da3198], eax
push 0x1da319c
call fcn.01cc326d
add esp, 4
jmp 0x1d28e09
test edi, edi
je 0x1d28e21
jmp 0x1d28e87
call fcn.01d46350
push edi
push esi
call fcn.01d46ed0
add esp, 8
jmp 0x1d28e21
int3
int3
push edi
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1d28e21
int3

Function at 0x1d28f90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x234
mov eax, dword [ebp + 8]
mov ecx, dword [0x1d8f008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor esi, esi
mov edi, 0
test eax, eax
je 0x1d28fd6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
test eax, eax
jne 0x1d28fd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0
cmp eax, 6
je 0x1d2907d
lea ebx, [ebp - 0x238]
push 0x228
push 0xff
push ebx
call fcn.01cc71b0
add esp, 0xc
mov dword [ebx - 4], 0x22c
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ebx, [ebp - 0x240]
mov dword [ebx], esi
mov ecx, ebx
push eax
call fcn.01d014f0
mov eax, dword [ebx]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x1d2904e
mov eax, dword [ebp - 0x240]
inc eax
cmp eax, 2
jb 0x1d29037
call fcn.01d38980
push dword [ebp - 0x240]
call fcn.01d27710
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 0x234
pop esi
pop edi
pop ebx
pop ebp
ret
lea ebx, [ebp - 0x23c]
push ebx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1d29018
cmp dword [ebp - 0x234], edi
je 0x1d29075
push ebx
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
jmp 0x1d2905b
mov esi, dword [ebp - 0x224]
jmp 0x1d29018
int3
Function at 0x1d29cd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x42
push str.file_win.cc
push str.Read
push esi
call fcn.01d38950
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.01d2c930
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x1d29da2
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x1d29da2
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01d492c0
test al, al
jne 0x1d29dd9
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1d29dc2
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1d29dd4
lea ecx, [esp + 0x28]
call fcn.01d49360
lea ecx, [esp + 0x30]
call fcn.01d2c9b0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1d29d99
int3
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.01d493d0
jmp 0x1d29d54

Function at 0x1d29e00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5f
push str.file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.01d38950
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.01d2c930
test ebx, ebx
js 0x1d29ec1
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01d492c0
test al, al
jne 0x1d29edd
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1d29ecb
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1d29ec6
lea ecx, [esp + 0x10]
call fcn.01d49360
lea ecx, [esp + 0x20]
call fcn.01d2c9b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x1d29ea1
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1d29e98
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::ReadAtCurrentPos
call fcn.01d493d0
jmp 0x1d29e75
Function at 0x1d29f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x7f
push str.file_win.cc
push str.Write
push ebx
call fcn.01d38950
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.01d2c930
xor edi, edi
dec edi
cmp dword [ebp + 0xc], 0
js 0x1d29fc8
cmp dword [ebp + 0x14], 0
js 0x1d29fc8
mov edi, esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01d492c0
test al, al
jne 0x1d29fe8
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
lea esi, [esp + 0xc]
mov dword [esi], 0xffffffff
push ebx
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
cmp eax, 1
sbb edi, edi
or edi, dword [esi]
lea ecx, [esp + 0x28]
call fcn.01d49360
lea ecx, [esp + 0x30]
call fcn.01d2c9b0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
lea ecx, [esp + 0x28]
push 0
push dword [ebp + 0x14]
push edi
push str.File::Write
call fcn.01d493d0
jmp 0x1d29f7f

Function at 0x1d2a000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x97
push str.file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.01d38950
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.01d2c930
test ebx, ebx
js 0x1d2a0c0
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01d492c0
test al, al
jne 0x1d2a0c5
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
push 0
push edi
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [edi]
lea ecx, [esp + 0x10]
call fcn.01d49360
lea ecx, [esp + 0x20]
call fcn.01d2c9b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x1d2a0a0
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::WriteAtCurrentPos
call fcn.01d493d0
jmp 0x1d2a075
Function at 0x1d2a4d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x226
push str.file_util_win.cc
push str.PathExists
push ebx
call fcn.01d38950
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.01d2c930
cmp byte [edi + 0xb], 0
jns 0x1d2a52c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.01d2c9b0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d2a560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, edx
mov edi, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x10]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
mov eax, esp
push 0x22f
push str.file_util_win.cc
push str.PathHasAccess
push eax
call fcn.01d38950
add esp, 0x10
mov ecx, ebx
push 0
lea eax, [esp + 4]
push eax
call fcn.01d2c930
cmp byte [edi + 0xb], 0
jns 0x1d2a5c1
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x1d2a61d
test al, 0x10
cmove esi, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push ebx
push ecx
push 3
push ebx
push 7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, esp
mov dword [esi], ebx
mov ecx, esi
push eax
call fcn.01d014f0
mov eax, dword [esi]
inc eax
test eax, 0xfffffffe
setne bl
cmp eax, 2
jb 0x1d2a61d
call fcn.01d38980
push dword [esp]
call fcn.01d27710
add esp, 4
lea ecx, [esp + 0x10]
call fcn.01d2c9b0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d2a640
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x24e
push str.file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.01d38950
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.01d2c930
cmp byte [edi + 0xb], 0
jns 0x1d2a69c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.01d2c9b0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d2a6d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.01cc71b0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x1d2a753
push ebx
call fcn.01cdd136
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.01d397a0
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.01d3abc0
mov ecx, dword [ebp + 8]
push ebx
call fcn.01d39860
mov ecx, ebx
call fcn.01d39820
mov ecx, edi
call fcn.01d39820
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d2a780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.01cc71b0
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x1d81dc0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1d2a7fc
cmp word [ebp - 0x214], 0
je 0x1d2a7fc
push edi
call fcn.01cdd136
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.01d397a0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.01d39710
push edi
call fcn.01d2a6d0
add esp, 4
mov ecx, esi
test al, al
jne 0x1d2a831
push 3
push 0x1d81df6
call fcn.01d397a0
jmp 0x1d2a837
push edi
call fcn.01d39770
lea ecx, [ebp - 0x220]
call fcn.01d39820
jmp 0x1d2a7e6
Function at 0x1d2ace0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov ebx, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov esi, esp
push 0x369
push str.file_util_win.cc
push str.CreateDirectoryAndGetError
push esi
call fcn.01d38950
add esp, 0x10
mov ecx, edi
mov edi, ebx
push 0
push esi
call fcn.01d2c930
cmp byte [ebx + 0xb], 0
jns 0x1d2ad3e
mov ebx, dword [edi]
mov edi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1d2ad75
mov bl, 1
test al, 0x10
je 0x1d2ae28
lea ecx, [esp + 0x10]
call fcn.01d2c9b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
dec eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov edi, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.01d39e90
movzx eax, byte [edi + 0xb]
test al, al
js 0x1d2ad9b
and eax, 0x7f
jmp 0x1d2ada0
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ecx, [esp + 0x50]
push eax
push edi
call fcn.01cf1490
movzx eax, byte [esp + 0xb]
test al, al
js 0x1d2adb9
and eax, 0x7f
jmp 0x1d2adc0
mov eax, dword [esp + 4]
mov esi, dword [esp]
lea edi, [esp + 0x48]
mov ecx, edi
push eax
push esi
call fcn.01cf1490
mov eax, dword [edi + 4]
cmp eax, dword [esp + 0x54]
je 0x1d2ae43
mov eax, esp
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call fcn.01d2ace0
add esp, 8
test al, al
je 0x1d2ae80
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x1d2ae08
mov ecx, esp
call fcn.01d39820
jmp 0x1d2ad57
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xb7
jne 0x1d2ae87
push dword [ebp + 8]
call fcn.01d2a640
add esp, 4
test al, al
jne 0x1d2adfc
jmp 0x1d2ae87
test edi, edi
je 0x1d2ae34
mov eax, edi
mov dword [edi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1d2ad57
test eax, eax
je 0x1d2ae64
mov ecx, dword [esp + 0x48]
xor edx, edx
mov esi, dword [esp + 0x50]
movzx edi, word [ecx + edx*2]
cmp di, word [esi + edx*2]
jne 0x1d2add6
inc edx
cmp eax, edx
jne 0x1d2ae51
mov eax, 0xfffffffc
mov edi, 2
cmp dword [ebp + 0xc], 0
je 0x1d2ae79
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1d2adfc
cmp dword [ebp + 0xc], 0
je 0x1d2ae79
push edi
call fcn.01d2a0e0
add esp, 4
jmp 0x1d2ae74