joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c5fe20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x97
push str....._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.01c7b570
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.01c84470
cmp dword [ebp + 0xc], 0
js 0x1c5fee7
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01c87ce0
test al, al
jne 0x1c5feec
lea ebx, [esp + 0xc]
mov dword [ebx], 0xffffffff
push 0
push ebx
push dword [ebp + 0xc]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.01c87d80
lea ecx, [esp + 0x20]
call fcn.01c844f0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c97fe3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x1c5fec7
lea ecx, [esp + 0x10]
push 0
push dword [ebp + 0xc]
push esi
push str.File::WriteAtCurrentPos
call fcn.01cef720
jmp 0x1c5fe9c
Function at 0x1c60050
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x173
push str....._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.01c7b570
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.01c84470
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x1c60276
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x1c6024b
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x1c60182
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x1c601ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x1c6025c
mov eax, edi
inc eax
cmp eax, 2
jb 0x1c601c1
mov dword [ebx], edi
call fcn.01c7b5a0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x1c60216
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x1c6022a
test cl, 0xa
je 0x1c601f2
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x1c6023e
lea ecx, [esp + 0x20]
call fcn.01c844f0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c97fe3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01c5ff10
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x1c601f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x1c601f2
push dword [ebp + 8]
call fcn.01c56620
add esp, 4
jmp 0x1c601f8
bt ebx, 0x15
jb 0x1c60293
or edx, 0x20000000
jmp 0x1c60113
call fcn.01c7b5a0
push dword [ebx]
call fcn.01c7c8a0
add esp, 4
mov dword [ebx], 0
jmp 0x1c601b2
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.01cc45a0
jmp 0x1c601f8
int3
Function at 0x1c65360
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor eax, eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x1c6545d
xor eax, eax
inc eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov edi, eax
cmp dword [ebp - 0x10], 7
jb 0x1c65488
mov eax, 7
xor ecx, ecx
cpuid
and ebx, 0x20
shr cl, 4
and cl, 1
mov dword [ebp - 0x10], ecx
mov dword [esi], edi
mov eax, edi
and eax, 0xf
mov dword [esi + 8], eax
shr edi, 0xc
and edi, 3
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0xc], al
mov eax, ecx
shr eax, 0x19
and al, 1
mov byte [esi + 0xd], al
shr ecx, 0x1a
and cl, 1
mov byte [esi + 0xe], cl
mov ecx, dword [ebp - 0x14]
mov eax, ecx
and al, 1
mov byte [esi + 0xf], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [esi + 0x10], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [esi + 0x11], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [esi + 0x12], al
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0x13], al
mov eax, ecx
shr eax, 0x1f
mov byte [esi + 0x1a], al
mov eax, ecx
not eax
test eax, 0x1c000000
jne 0x1c65496
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [esi + 0x14], al
mov edx, dword [ebp - 0x14]
mov ecx, edx
shr ecx, 0x19
and cl, 1
mov byte [esi + 0x17], cl
shr edx, 0xc
and dl, 1
mov byte [esi + 0x15], dl
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [esi + 0x16], cl
mov eax, dword [ebp - 0x10]
mov byte [esi + 0x18], al
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000006
jle 0x1c6549a
mov eax, 0x80000007
xor ecx, ecx
cpuid
and dh, 1
mov byte [esi + 0x19], dh
test dh, dh
je 0x1c6549f
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
xor ebx, ebx
jmp 0x1c653aa
xor eax, eax
jmp 0x1c6542e
mov dh, byte [esi + 0x19]
jmp 0x1c6547c
cmp byte [esi + 0x1a], 0
je 0x1c65480
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp ebx, 0x7263694d
jne 0x1c65480
cmp ecx, 0x666f736f
jne 0x1c65480
cmp edx, 0x76482074
jne 0x1c65480
mov byte [esi + 0x19], 1
jmp 0x1c65480
Function at 0x1c67650
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c6766c
mov eax, dword [ebx + 4]
mov ebx, dword [ebx]
mov esi, eax
mov ecx, ebx
mov edx, eax
mov dword [ebp - 0x18], eax
cmp eax, 4
jb 0x1c676a7
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, ebx
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c67681
cmp edx, 1
je 0x1c676c8
cmp edx, 2
je 0x1c676bf
cmp edx, 3
jne 0x1c676d3
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
xor ecx, ecx
mov dword [ebp - 0x10], edx
test edx, edx
je 0x1c677ec
mov dword [ebp - 0x1c], ebx
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov eax, dword [ebp - 0x10]
mov edx, eax
shr edx, 1
and edx, 0x55555555
sub eax, edx
mov edx, 0x33333333
mov ebx, eax
and ebx, edx
shr eax, 2
and eax, edx
add eax, ebx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
jbe 0x1c677ff
mov edx, esi
cmp esi, dword [ebp - 0x10]
jb 0x1c6774c
mov eax, esi
xor edx, edx
div dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1c677ec
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], esi
mov ebx, dword [eax]
test ebx, ebx
je 0x1c677ec
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
jne 0x1c677b3
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x1c6778b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x18]
jne 0x1c677ca
lea ecx, [ebx + 8]
test al, al
jns 0x1c67799
mov ecx, dword [ecx]
js 0x1c677d2
test eax, eax
je 0x1c677ea
xor ecx, ecx
mov dl, byte [ebx + ecx + 8]
mov edi, eax
cmp dl, byte [esi + ecx]
jne 0x1c677ca
inc ecx
cmp eax, ecx
jne 0x1c677a1
jmp 0x1c677ea
cmp dword [ebp - 0x28], 1
jbe 0x1c6780c
cmp eax, dword [ebp - 0x10]
jb 0x1c677c5
xor edx, edx
div dword [ebp - 0x10]
mov eax, edx
cmp eax, dword [ebp - 0x24]
jne 0x1c677fb
mov ebx, dword [ebx]
test ebx, ebx
jne 0x1c67776
jmp 0x1c677fb
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1c677ea
push eax
push dword [ebp - 0x1c]
push ecx
call fcn.01c993bd
add esp, 0xc
test eax, eax
jne 0x1c677ca
mov ecx, ebx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ecx, ecx
jmp 0x1c677ec
mov eax, dword [ebp - 0x10]
lea edx, [eax - 1]
and edx, esi
jmp 0x1c6774c
and eax, dword [ebp - 0x20]
jmp 0x1c677c5
Function at 0x1c69a20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1d17014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x1c69a50
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c69b50
push 0
push eax
push 0x1c69a00
push 0x1d45044
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c69b4b
cmp dword [0x1d45048], 0
jne 0x1c69a3c
push dword [0x1d4504c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c69a3c
mov esi, eax
mov eax, 0x1d45050
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x1d45054]
mov ebx, dword [0x1d45058]
mov eax, dword [0x1d4505c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1d45060]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1d45064]
mov dword [ebp - 0x24], eax
mov eax, 0x1d45050
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x1c69ae4
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x1c69af9
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1c69b0f
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x1c69b28
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x1c69b3d
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.01c8f160
add esp, 4
jmp 0x1c69a3c
call fcn.01cab250
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1d4504c], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x1d45048], ecx
pop ebp
ret
Function at 0x1c69b70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c69b50
push 0
push eax
push 0x1c69a00
push 0x1d45044
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c69c43
mov esi, dword [ebp + 0xc]
cmp dword [0x1d45048], 0
jne 0x1c69c51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1d4504c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1c69c06
push 0x14
call fcn.01c8f130
add esp, 4
test eax, eax
je 0x1c69c51
mov edi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
push eax
push dword [0x1d4504c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1c69c48
mov ebx, dword [ebp + 8]
mov esi, 0x1d45050
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x1d45054], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01cab250
push edi
call fcn.01c8f160
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x1c69c2f
Function at 0x1c72140
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x1c72155
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x1c72186
nop dword [eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c72160
cmp edx, 1
je 0x1c721a7
cmp edx, 2
je 0x1c7219e
cmp edx, 3
jne 0x1c721b2
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x1c76420
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x1c76455
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x1c7645c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1c7644e
mov dword [esi], ebx
call fcn.01c7b5a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.01c7b5a0
push dword [esi]
call fcn.01c7c8a0
add esp, 4
mov dword [esi], 0
jmp 0x1c7643f

Function at 0x1c76480
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d357e8]
mov ecx, dword [0x1d33130]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c764d0
mov esi, dword [0x1d357e4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d357e8
call fcn.01c97191
add esp, 4
cmp dword [0x1d357e8], 0xffffffff
jne 0x1c764b3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c9afc0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.01c97121
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d35818]
mov ecx, dword [0x1d33130]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c76579
mov ecx, esi
push ebx
push 0x1d357f4
push edi
call fcn.01c42630
mov dword [0x1d357e4], esi
push 0x1d357e8
call fcn.01c9720b
add esp, 4
jmp 0x1c764b3
push 0x1d35818
call fcn.01c97191
add esp, 4
cmp dword [0x1d35818], 0xffffffff
jne 0x1c76553
xorps xmm0, xmm0
movups xmmword [0x1d35804], xmm0
movups xmmword [0x1d357f4], xmm0
mov dword [0x1d35814], 0
push 0x1d357f4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d35818
call fcn.01c9720b
add esp, 4
jmp 0x1c76553
Function at 0x1c79530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [esp + 0x38], eax
mov eax, dword [0x1d33130]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x90]
mov dword [esp + 0xc], eax
cmp eax, 2
jb 0x1c796d1
mov eax, dword [esp + 0xc]
mov byte [eax + 4], 0
lea edi, [eax + 0x78]
lea esi, [eax + 0x2f8]
cmp byte [edi + 4], 0
je 0x1c796b8
mov ecx, dword [edi]
movzx eax, word [edi + 6]
push eax
call fcn.01c79720
movzx eax, byte [edi + 4]
mov dword [esp + 0x18], eax
movzx eax, word [edi + 6]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edi
mov ebx, dword [edi]
mov edi, dword [esi]
add edi, 0x40
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c796c5
mov dword [esp + 0x14], edi
test ebx, ebx
je 0x1c79691
nop word cs:[eax + eax]
mov edi, dword [ebx]
test edi, edi
je 0x1c79681
bswap edi
test edi, 0x1fc000
je 0x1c796e4
prefetcht0 byte [edi]
mov eax, ebx
and eax, 0xffe00000
mov edx, ebx
shr edx, 9
and edx, 0xfe0
lea ecx, [edx + eax]
movzx eax, byte [edx + eax + 0x101e]
mov edx, dword [esi]
and eax, 0x3f
shl eax, 5
sub ecx, eax
mov eax, dword [ecx + 0x1008]
mov eax, dword [eax + 0xc]
sub dword [edx + 0x117c], eax
mov eax, dword [ecx + 0x1000]
cmp eax, ebx
je 0x1c79712
add ecx, 0x1000
bswap eax
mov dword [ebx], eax
mov dword [ecx], ebx
mov eax, dword [ecx + 0xc]
mov edx, eax
and edx, 0xefffffff
mov dword [ecx + 0xc], edx
test eax, 0x3ffe
je 0x1c79715
lea edx, [eax + 0x3ffe]
and edx, 0x3ffe
mov ebx, eax
and ebx, 0xefffc001
or ebx, edx
mov dword [ecx + 0xc], ebx
test al, 1
jne 0x1c79688
test edx, edx
je 0x1c79688
mov ebx, edi
test edi, edi
jne 0x1c795d0
jmp 0x1c79691
xor edi, edi
jmp 0x1c795eb
push 1
call fcn.01c6e850
jmp 0x1c79675
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, dword [esp + 0x1c]
mov dword [edi], 0
mov byte [edi + 4], 0
movzx eax, word [edi + 6]
imul eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
sub dword [ecx], eax
add edi, 8
cmp edi, esi
jne 0x1c7957a
jmp 0x1c796d1
mov ecx, edi
call fcn.01c788e0
jmp 0x1c795ba
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.01c97fe3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi], xmm0
mov ecx, esi
push 0
push dword [ebx]
push str.first
call fcn.01cc36c0
push esi
call fcn.01c30600
add esp, 4
mov ecx, dword [esp + 0x10]
call fcn.01cda450
int3
int3
Function at 0x1c79db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x1c79e8a
mov esi, ecx
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x3c]
cmp dword [edx + eax + 0x74], 0
je 0x1c79e8a
add edx, eax
xor eax, eax
cmp word [edx + 0x14], 0x68
jb 0x1c79eb1
add edx, 0x78
je 0x1c79eb1
mov ecx, esi
push dword [edx]
call fcn.01c79d90
test eax, eax
je 0x1c79e8a
mov ecx, dword [ebp + 8]
cmp ecx, 0xffff
jbe 0x1c79ea9
mov edi, eax
mov dword [ebp - 0x10], esi
mov ecx, esi
push dword [eax + 0x20]
call fcn.01c79d90
mov esi, eax
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1c79e8a
lea ebx, [esi + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
mov edi, ebx
sub edi, esi
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
push dword [esi + edi*2]
call fcn.01c79d90
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x1c79e6a
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x1c79e6c
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1c79e5e
xor ecx, ecx
lea edi, [esi + edi*2]
movzx eax, byte [eax]
cmp cl, al
je 0x1c79e8e
movzx ecx, cl
sub ecx, eax
cmovs ebx, edi
add edi, 4
test ecx, ecx
cmovg esi, edi
cmp esi, ebx
jne 0x1c79e36
xor eax, eax
jmp 0x1c79eb1
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call fcn.01c79d90
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx ecx, word [eax + edi]
add cx, word [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
mov al, 1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c83a00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.01c98400
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d32eb4]
cmp eax, 0xffffffff
je 0x1c83b58
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x1c83b58
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.01c9aa40
add esp, 0xc
mov ecx, dword [0x1d32eb4]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.01c625b0
add esp, 8
test ebx, ebx
je 0x1c83a7b
push ebx
call fcn.01c9718c
add esp, 4
mov eax, dword [0x1d439fc]
mov ecx, dword [0x1d33130]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c83b6d
mov esi, dword [0x1d439f8]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c83bb2
lea eax, [ebp - 0x1410]
push 0xc00
push 0x1d42df8
push eax
call fcn.01c9aa40
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x101
test al, 1
je 0x1c83b48
mov dword [ebp - 0x1418], ecx
xor ebx, ebx
lea edi, [ebp - 0x1408]
xor eax, eax
jmp 0x1c83afc
inc ebx
add edi, 0xc
cmp ebx, 0x100
je 0x1c83b3a
mov esi, dword [ebp + ebx*8 - 0x810]
test esi, esi
je 0x1c83af0
cmp dword [edi - 8], 0
je 0x1c83af0
mov ecx, dword [ebp + ebx*8 - 0x80c]
cmp ecx, dword [edi]
jne 0x1c83af0
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x1c83af0
mov dword [ebp + ebx*8 - 0x810], 0
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x1c83af0
mov ecx, dword [ebp - 0x1418]
dec ecx
jne 0x1c83ad8
call fcn.01cc45a0
push 2
push dword [ebp - 0x1414]
call fcn.01c625b0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d439fc
call fcn.01c97191
add esp, 4
cmp dword [0x1d439fc], 0xffffffff
jne 0x1c83a9c
push 4
call fcn.01c97121
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.01c82950
mov dword [0x1d439f8], esi
push 0x1d439fc
call fcn.01c9720b
add esp, 4
jmp 0x1c83a9c
mov ecx, esi
call fcn.01c82960
jmp 0x1c83ab1

Function at 0x1c83bc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d32eb4]
cmp eax, 0xffffffff
je 0x1c83be0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1c84010
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [0x1d43a04]
test dl, 1
je 0x1c8402f
call fcn.01c87f00
pop ebp
jmp fcn.01c87f20
test ecx, ecx
je 0x1c8403e
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1c84040
pop ebp
ret
int3