joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c666a0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor eax, eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x1c6679d
xor eax, eax
inc eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov edi, eax
cmp dword [ebp - 0x10], 7
jb 0x1c667c8
mov eax, 7
xor ecx, ecx
cpuid
and ebx, 0x20
shr cl, 3
and cl, 1
mov dword [ebp - 0x10], ecx
mov dword [esi], edi
mov eax, edi
and eax, 0xf
mov dword [esi + 8], eax
shr edi, 0xc
and edi, 3
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0xc], al
mov eax, ecx
shr eax, 0x19
and al, 1
mov byte [esi + 0xd], al
shr ecx, 0x1a
and cl, 1
mov byte [esi + 0xe], cl
mov ecx, dword [ebp - 0x14]
mov eax, ecx
and al, 1
mov byte [esi + 0xf], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [esi + 0x10], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [esi + 0x11], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [esi + 0x12], al
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0x13], al
mov eax, ecx
shr eax, 0x1f
mov byte [esi + 0x1a], al
mov eax, ecx
not eax
test eax, 0x1c000000
jne 0x1c667d6
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [esi + 0x14], al
mov edx, dword [ebp - 0x14]
mov ecx, edx
shr ecx, 0x19
and cl, 1
mov byte [esi + 0x17], cl
shr edx, 0xc
and dl, 1
mov byte [esi + 0x15], dl
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [esi + 0x16], cl
mov eax, dword [ebp - 0x10]
mov byte [esi + 0x18], al
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000006
jle 0x1c667da
mov eax, 0x80000007
xor ecx, ecx
cpuid
and dh, 1
mov byte [esi + 0x19], dh
test dh, dh
je 0x1c667df
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
xor ebx, ebx
jmp 0x1c666ea
xor eax, eax
jmp 0x1c6676e
mov dh, byte [esi + 0x19]
jmp 0x1c667bc
cmp byte [esi + 0x1a], 0
je 0x1c667c0
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp ebx, 0x7263694d
jne 0x1c667c0
cmp ecx, 0x666f736f
jne 0x1c667c0
cmp edx, 0x76482074
jne 0x1c667c0
mov byte [esi + 0x19], 1
jmp 0x1c667c0
Function at 0x1c68510
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1d15014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x1c68540
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c68640
push 0
push eax
push 0x1c684f0
push 0x1d43270
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c6863b
cmp dword [0x1d43274], 0
jne 0x1c6852c
push dword [0x1d43278]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c6852c
mov esi, eax
mov eax, 0x1d4327c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x1d43280]
mov ebx, dword [0x1d43284]
mov eax, dword [0x1d43288]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1d4328c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1d43290]
mov dword [ebp - 0x24], eax
mov eax, 0x1d4327c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x1c685d4
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x1c685e9
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1c685ff
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x1c68618
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x1c6862d
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.01c8fe50
add esp, 4
jmp 0x1c6852c
call fcn.01ca7500
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1d43278], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x1d43274], ecx
pop ebp
ret
Function at 0x1c68660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c68640
push 0
push eax
push 0x1c684f0
push 0x1d43270
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c68733
mov esi, dword [ebp + 0xc]
cmp dword [0x1d43274], 0
jne 0x1c68741
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1d43278]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1c686f6
push 0x14
call fcn.01c8fe20
add esp, 4
test eax, eax
je 0x1c68741
mov edi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
push eax
push dword [0x1d43278]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1c68738
mov ebx, dword [ebp + 8]
mov esi, 0x1d4327c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x1d43280], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01ca7500
push edi
call fcn.01c8fe50
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x1c6871f

Function at 0x1c6df10
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x1c6df27
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x1c6df2a
and edx, 0x7f
mov ecx, edx
cmp edx, 4
jb 0x1c6df66
nop word cs:[eax + eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c6df40
cmp edx, 1
je 0x1c6df87
cmp edx, 2
je 0x1c6df7e
cmp edx, 3
jne 0x1c6df92
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x1c71cc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1c71cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x1c71d12
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1c71cf4
mov dword [esi], ebx
call fcn.01c73ec0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x1c71d29
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.01c73ec0
push dword [esi]
call fcn.01c75570
add esp, 4
mov dword [esi], 0
jmp 0x1c71ce5
int3

Function at 0x1c71d60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d339e8]
mov ecx, dword [0x1d31114]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c71dad
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, 0x1d339e4
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d339e8
call fcn.01c92cb7
add esp, 4
cmp dword [0x1d339e8], 0xffffffff
jne 0x1c71d93
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c96470
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.01c92c17
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d33a18]
mov ecx, dword [0x1d31114]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c71e56
mov ecx, esi
push ebx
push 0x1d339f4
push edi
call fcn.01c433d0
mov dword [0x1d339e4], esi
push 0x1d339e8
call fcn.01c92d2d
add esp, 4
jmp 0x1c71d93
push 0x1d33a18
call fcn.01c92cb7
add esp, 4
cmp dword [0x1d33a18], 0xffffffff
jne 0x1c71e30
xorps xmm0, xmm0
movups xmmword [0x1d33a04], xmm0
movups xmmword [0x1d339f4], xmm0
mov dword [0x1d33a14], 0
push 0x1d339f4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d33a18
call fcn.01c92d2d
add esp, 4
jmp 0x1c71e30
Function at 0x1c71eb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d339e8]
mov ecx, dword [0x1d31114]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c71f00
mov esi, dword [0x1d339e4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d339e8
call fcn.01c92cb7
add esp, 4
cmp dword [0x1d339e8], 0xffffffff
jne 0x1c71ee3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c96470
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.01c92c17
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d33a18]
mov ecx, dword [0x1d31114]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c71fa9
mov ecx, esi
push ebx
push 0x1d339f4
push edi
call fcn.01c433d0
mov dword [0x1d339e4], esi
push 0x1d339e8
call fcn.01c92d2d
add esp, 4
jmp 0x1c71ee3
push 0x1d33a18
call fcn.01c92cb7
add esp, 4
cmp dword [0x1d33a18], 0xffffffff
jne 0x1c71f83
xorps xmm0, xmm0
movups xmmword [0x1d33a04], xmm0
movups xmmword [0x1d339f4], xmm0
mov dword [0x1d33a14], 0
push 0x1d339f4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d33a18
call fcn.01c92d2d
add esp, 4
jmp 0x1c71f83
Function at 0x1c728b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x1c7298a
mov esi, ecx
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x3c]
cmp dword [edx + eax + 0x74], 0
je 0x1c7298a
add edx, eax
xor eax, eax
cmp word [edx + 0x14], 0x68
jb 0x1c729b1
add edx, 0x78
je 0x1c729b1
mov ecx, esi
push dword [edx]
call fcn.01c72890
test eax, eax
je 0x1c7298a
mov ecx, dword [ebp + 8]
cmp ecx, 0xffff
jbe 0x1c729a9
mov edi, eax
mov dword [ebp - 0x10], esi
mov ecx, esi
push dword [eax + 0x20]
call fcn.01c72890
mov esi, eax
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1c7298a
lea ebx, [esi + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
mov edi, ebx
sub edi, esi
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
push dword [esi + edi*2]
call fcn.01c72890
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x1c7296a
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x1c7296c
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1c7295e
xor ecx, ecx
lea edi, [esi + edi*2]
movzx eax, byte [eax]
cmp cl, al
je 0x1c7298e
movzx ecx, cl
sub ecx, eax
cmovs ebx, edi
add edi, 4
test ecx, ecx
cmovg esi, edi
cmp esi, ebx
jne 0x1c72936
xor eax, eax
jmp 0x1c729b1
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call fcn.01c72890
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx ecx, word [eax + edi]
add cx, word [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
mov al, 1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c7b250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.01c94020
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d2fe5c]
cmp eax, 0xffffffff
je 0x1c7b3a3
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x1c7b3a3
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.01c95ef0
add esp, 0xc
mov ecx, dword [0x1d2fe5c]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.01c5e1a0
add esp, 8
test ebx, ebx
je 0x1c7b2cb
push ebx
call fcn.01c92c7c
add esp, 4
mov eax, dword [0x1d372c4]
mov ecx, dword [0x1d31114]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7b3b8
mov esi, dword [0x1d372c0]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c7b3fd
lea eax, [ebp - 0x1410]
push 0xc00
push 0x1d366c0
push eax
call fcn.01c95ef0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x101
test al, 1
je 0x1c7b393
mov dword [ebp - 0x1418], ecx
xor ebx, ebx
lea edi, [ebp - 0x1408]
xor eax, eax
jmp 0x1c7b34c
inc ebx
add edi, 0xc
cmp ebx, 0x100
je 0x1c7b38a
mov esi, dword [ebp + ebx*8 - 0x810]
test esi, esi
je 0x1c7b340
cmp dword [edi - 8], 0
je 0x1c7b340
mov ecx, dword [ebp + ebx*8 - 0x80c]
cmp ecx, dword [edi]
jne 0x1c7b340
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x1c7b340
mov dword [ebp + ebx*8 - 0x810], 0
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x1c7b340
mov ecx, dword [ebp - 0x1418]
dec ecx
jne 0x1c7b328
push 2
push dword [ebp - 0x1414]
call fcn.01c5e1a0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d372c4
call fcn.01c92cb7
add esp, 4
cmp dword [0x1d372c4], 0xffffffff
jne 0x1c7b2ec
push 4
call fcn.01c92c17
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.01c7a330
mov dword [0x1d372c0], esi
push 0x1d372c4
call fcn.01c92d2d
add esp, 4
jmp 0x1c7b2ec
mov ecx, esi
call fcn.01c7a340
jmp 0x1c7b301
Function at 0x1c81d10
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [0x1d41c5c]
test dl, 1
je 0x1c81d2f
call fcn.01c87570
pop ebp
jmp fcn.01c87590
test ecx, ecx
je 0x1c81d3e
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1c81d40
pop ebp
ret
int3

Function at 0x1c81f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 8], ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x3e
push str....._base_files_file_win.cc
push str.Read
push esi
call fcn.01c73e90
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.01c7c170
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x1c81ffa
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x1c81ffa
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c83700
test al, al
jne 0x1c8202c
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c8201a
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1c82046
lea ecx, [esp + 0x28]
call fcn.01c837a0
lea ecx, [esp + 0x30]
call fcn.01c7c1f0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1c81ff1
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.01ce82f0
jmp 0x1c81fac
int3
Function at 0x1c82050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5b
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.01c73e90
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.01c7c170
test ebx, ebx
js 0x1c82116
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01c83700
test al, al
jne 0x1c8211b
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c8212f
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1c82141
lea ecx, [esp + 0x10]
call fcn.01c837a0
lea ecx, [esp + 0x20]
call fcn.01c7c1f0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x1c820f6
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::ReadAtCurrentPos
call fcn.01ce82f0
jmp 0x1c820ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1c820ed
int3

Function at 0x1c82150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x7b
push str....._base_files_file_win.cc
push str.Write
push ebx
call fcn.01c73e90
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.01c7c170
xor edi, edi
dec edi
cmp dword [ebp + 0xc], 0
js 0x1c82220
cmp dword [ebp + 0x14], 0
js 0x1c82220
mov edi, esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c83700
test al, al
jne 0x1c82240
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
lea esi, [esp + 0xc]
mov dword [esi], 0xffffffff
push ebx
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
cmp eax, 1
sbb edi, edi
or edi, dword [esi]
lea ecx, [esp + 0x28]
call fcn.01c837a0
lea ecx, [esp + 0x30]
call fcn.01c7c1f0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01c93c03
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
lea ecx, [esp + 0x28]
push 0
push dword [ebp + 0x14]
push edi
push str.File::Write
call fcn.01ce82f0
jmp 0x1c821d7
Function at 0x1c84970
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d43110]
mov ecx, dword [0x1d31114]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c8499b
mov ecx, 0x1d43108
pop ebp
jmp fcn.01c7b410
push 0x1d43110
call fcn.01c92cb7
add esp, 4
cmp dword [0x1d43110], 0xffffffff
jne 0x1c84990
xor eax, eax
mov dword [0x1d4310c], eax
mov dword [0x1d43108], eax
mov ecx, 0x1d43108
push eax
call fcn.01c57f90
push 0x1d43110
call fcn.01c92d2d
add esp, 4
jmp 0x1c84990

Function at 0x1c86640
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x1c866be
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x1c866a7
lea eax, [edi + 1]
cmp eax, 2
jb 0x1c8668b
mov dword [esi], edi
call fcn.01c73ec0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x1c866c2
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.01c73ec0
push dword [esi]
call fcn.01c75570
add esp, 4
mov dword [esi], 0
jmp 0x1c8667c
mov byte [esi + 4], 1
int3
Function at 0x1c87ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [esp + 0x48], eax
cmp ebx, 0x30
ja 0x1c8801d
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x30]
movdqa xmmword [eax], xmm0
movdqa xmmword [eax - 0x10], xmm0
movdqa xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [esp + 0xc], eax
call dword [section..00cfg]
lea eax, [esp + 0x10]
push esi
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x14]
call ecx
add esp, 0xc
test ebx, ebx
je 0x1c87fbd
xor eax, eax
mov cl, byte [edi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp ebx, eax
jne 0x1c87fb1
lea edi, [esi + 0xf4]
mov eax, dword [0x1d431a8]
bt eax, 0x19
jae 0x1c88021
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.01c23500
add esp, 0xc
mov ecx, 0x1c21180
mov eax, 0x1c21d10
test edi, edi
je 0x1c87ff1
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
lea eax, [esp + 0x30]
movups xmm0, xmmword [eax]
mov eax, dword [esp + 0xc]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c93c03
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x1c88008
bt eax, 9
jae 0x1c88043
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.01c24020
add esp, 0xc
xor eax, eax
mov ecx, 0x1c240d0
jmp 0x1c87feb
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.01cee6f0
add esp, 0xc
mov ecx, 0x1cee5f0
mov eax, 0x1ceee80
jmp 0x1c87feb