joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d2afc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x4da
push str.file_util_win.cc
push 0x1d81e73
push ebx
call fcn.01d38950
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.01d2c930
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.01cc71b0
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x1d2b086
push ebx
call fcn.01cdd136
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.01d397a0
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.01d3abc0
mov ecx, dword [ebp + 8]
push ebx
call fcn.01d39860
mov ecx, ebx
call fcn.01d39820
mov ecx, edi
call fcn.01d39820
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.01d2c9b0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d2b0b0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x4ea
push str.file_util_win.cc
push 0x1d81e88
push ebx
call fcn.01d38950
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.01d2c930
cmp byte [edi + 0xb], 0
jns 0x1d2b10c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.01d2c9b0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d2df10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01d2df20

Function at 0x1d2dfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01d2dff0
Function at 0x1d44410
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x4c], eax
pcmpeqd xmm0, xmm0
mov eax, esp
movdqa xmmword [eax], xmm0
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
mov dword [eax], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1d4446e
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x4c]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call fcn.01d3ba90
xor esi, esi
xor edi, edi
jmp 0x1d44458
Function at 0x1d47e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x1d8f008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 0x30
ja 0x1d47ed4
mov ecx, dword [ebp + 0xc]
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [ebp - 0x20], xmm0
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [ecx + 0x10]
movups xmmword [ebp - 0x30], xmm1
movups xmmword [ebp - 0x40], xmm0
test eax, eax
jne 0x1d47ed8
mov esi, dword [ebp + 8]
xor eax, eax
mov cl, byte [eax + 0x1d86460]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp eax, 0x30
jne 0x1d47e73
lea eax, [esi + 0xf4]
lea edi, [ebp - 0x40]
xor ebx, ebx
push 0x20
push edi
push eax
push ebx
push esi
call fcn.01d471b0
add esp, 0x14
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0xfc], xmm0
mov dword [esi + 0x114], ebx
mov dword [esi + 0x110], 1
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x1d47ec0
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov bl, byte [ecx + edx]
xor byte [ebp + edx - 0x40], bl
inc edx
cmp eax, edx
je 0x1d47e6e
jmp 0x1d47edd

Function at 0x1d47ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x1d48007
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
lea eax, [ecx + 0xfc]
mov dword [ebp - 0x44], eax
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xf4]
mov dword [ebp - 0x48], eax
call dword [section..00cfg]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x1d47fca
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x1d47fbe
push 0x20
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x48]
push 0
push esi
call fcn.01d471b0
add esp, 0x14
mov dword [esi + 0xf8], eax
lea eax, [ebp - 0x20]
movups xmm0, xmmword [eax]
mov eax, dword [ebp - 0x44]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x1d47ff3
Function at 0x1d52e50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x1d52e7d
mov edx, dword [ebp + 0xc]
xor esi, esi
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x1d86a68]
inc esi
cmp ecx, esi
jne 0x1d52e65
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d54e10
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1d8f008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movzx edx, byte [eax + 0xb]
test dl, dl
js 0x1d54e34
and edx, 0x7f
jmp 0x1d54e39
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x24]
mov ecx, esi
push edx
push eax
call fcn.01cf1490
lea edi, [ebp - 0x1c]
push dword [esi + 4]
push dword [esi]
push edi
call fcn.01d2d410
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1d54e62
mov edi, dword [ebp - 0x1c]
lea esi, [ebp - 0x30]
push ebx
push dword [ebp + 8]
push esi
call fcn.01d2d410
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x1d54e7b
mov esi, dword [ebp - 0x30]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x25], 0
jns 0x1d54e96
push dword [ebp - 0x30]
call fcn.01cc3180
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x1d54ea7
push dword [ebp - 0x1c]
call fcn.01cc3180
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x1d54ed0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x1d8f008]
xor edx, ebp
mov dword [ebp - 0xc], edx
lea esi, [ebp - 0x18]
push ecx
push eax
push esi
call fcn.01d2d410
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x1d54f00
mov esi, dword [ebp - 0x18]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0xd], 0
jns 0x1d54f1c
push dword [ebp - 0x18]
call fcn.01cc3180
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0x10
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1d54f40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.01d2d410
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x1d54f6e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x1d54f8c
push dword [ebp - 0x1c]
call fcn.01cc3180
add esp, 4
cmp dword [ebp + 8], 0
je 0x1d54f96
test esi, esi
jne 0x1d54faf
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.01cc31b3
add esp, 4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push edi
push ebx
mov edi, eax
push eax
call fcn.01d2d410
mov eax, edi
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1d54fe1
mov eax, dword [ebp - 0x1c]
push esi
mov edi, dword [ebp - 0x20]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x1d54ffe
push dword [ebp - 0x1c]
call fcn.01cc3180
add esp, 4
test edi, edi
je 0x1d5504e
push edi
call fcn.01cdd136
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.01d2d440
add esp, 0xc
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x1d5503f
mov eax, dword [ebp - 0x14]
mov dword [ecx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ecx], xmm0
push edi
call fcn.01cc31bc
add esp, 4
jmp 0x1d54f96
push dword [ecx]
call fcn.01cc3180
mov ecx, dword [ebp + 8]
add esp, 4
jmp 0x1d55022
push str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
push str.__s___nullptr
push 0x109
push str....._third_partylibc_srcinclude_string_view
push str._s:_d:_assertion__s_failed:__s_n
call fcn.01cfd380
int3
Function at 0x1d56090
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov esi, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1d560b2
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1d560e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1d56100
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov ecx, esi
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01d561d0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d56112
xor ebx, ebx
jmp 0x1d560e9
call fcn.01d37a60
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x26f
push str.crash_report_database_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.01cfbdd0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
js 0x1d56154
and eax, 0x7f
jmp 0x1d56159
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xcc]
mov ecx, ebx
push eax
push esi
call fcn.01cf1490
lea esi, [ebp - 0xc4]
push dword [ebx + 4]
push dword [ebx]
push esi
call fcn.01d2d440
add esp, 0xc
movzx eax, byte [esi + 0xb]
test al, al
js 0x1d56189
and eax, 0x7f
jmp 0x1d56195
mov eax, dword [ebp - 0xc0]
mov esi, dword [ebp - 0xc4]
push eax
push esi
push edi
call fcn.01cfbdd0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1d561b7
push dword [ebp - 0xc4]
call fcn.01cc3180
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01d37bf0
jmp 0x1d5610e

Function at 0x1d561d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1d561f2
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1d5621b
mov bl, 1
test al, 0x10
je 0x1d5622d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d5628d
xor ebx, ebx
jmp 0x1d56204
push 2
call fcn.01d36f50
add esp, 4
test al, al
je 0x1d56229
lea edi, [ebp - 0xb8]
mov ecx, edi
push 2
push 0x25f
push str.crash_report_database_win.cc
call fcn.01d37050
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cfbdd0
add esp, 0xc
push esi
push eax
call fcn.01d39b30
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.01cfbdd0
add esp, 0xc
mov ecx, edi
call fcn.01d37400
jmp 0x1d56229
call fcn.01d37a60
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x25b
push str.crash_report_database_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cfbdd0
add esp, 0xc
push esi
push eax
call fcn.01d39b30
add esp, 8
mov ecx, edi
call fcn.01d37bf0
jmp 0x1d56229
Function at 0x1d56460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [esp + 0x78], eax
lea esi, [esp + 0x1c]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.01d56600
mov ebx, dword [esi]
mov edi, 3
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x1d565c1
mov al, byte [esi + 0x1c]
mov byte [esp + 8], al
xor eax, eax
push eax
call fcn.01cd84fe
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
lea eax, [esi + 0xc]
mov dword [esp + 0x10], eax
lea edi, [esp + 0x20]
mov ecx, edi
call fcn.01d64b20
mov dword [esp + 0xc], esi
movups xmm0, xmmword [esi + 0x38]
movaps xmmword [edi], xmm0
lea esi, [esp + 0x30]
mov ecx, esi
push dword [esp + 0x10]
call fcn.01d39840
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x40], eax
mov al, byte [esp + 8]
mov byte [esi + 0x35], al
lea ecx, [ebx + 0x28]
mov edx, edi
call fcn.01cc26c0
mov byte [ebx + 0x24], 1
cmp byte [esi + 0x17], 0
jns 0x1d5651d
push dword [esp + 0x3c]
call fcn.01cc3180
add esp, 4
mov ecx, esi
call fcn.01d39820
mov ebx, dword [esp + 0xc]
lea ecx, [ebx + 8]
push edi
call fcn.01d56ef0
mov ecx, edi
call fcn.01d39820
mov esi, dword [ebx + 0x20]
mov ebx, dword [ebx + 0x24]
jmp 0x1d5654a
mov ecx, dword [esi]
call fcn.01d66b40
add esi, 4
cmp esi, ebx
jne 0x1d56540
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x38]
mov dword [esp + 8], ecx
mov ebx, dword [eax + 0x2c]
mov esi, dword [eax + 0x30]
jmp 0x1d56573
mov ecx, ebx
push edi
call fcn.01d56ef0
mov ecx, edi
call fcn.01d39820
add ebx, 0x14
cmp ebx, esi
jne 0x1d56561
mov eax, dword [esp + 8]
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0xc]
movups xmmword [eax], xmm0
xor edi, edi
push edi
call fcn.01d66c00
add esp, 4
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea ebx, [eax + ecx + 4]
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [esp + 8], ecx
call dword [section..00cfg]
mov ecx, ebx
push 2
push edi
push edi
call dword [esp + 0x14]
push edx
push eax
call fcn.01d66c60
add esp, 8
lea ecx, [esp + 0x1c]
call fcn.01d56f50
test esi, esi
je 0x1d565de
mov ecx, esi
call fcn.01d64bf0
push esi
call fcn.01cc3180
add esp, 4
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1d57760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp esi, ebx
je 0x1d577da
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.01d55d20
test al, al
jne 0x1d5779f
add esi, 0x58
cmp esi, ebx
jne 0x1d5778a
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x2c]
je 0x1d577da
cmp byte [esi + 0x1b], 0
js 0x1d577b2
lea eax, [esi + 0x10]
jmp 0x1d577b5
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x1d577dd
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x1d577dd
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d57860
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp edi, ebx
jne 0x1d57879
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, edx
cmp dword [edi + 0x50], esi
jne 0x1d578bd
cmp byte [edi + 0x1b], 0
jns 0x1d5788b
mov eax, dword [edi + 0x10]
jmp 0x1d5788e
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1d578bd
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x1d578c6
push edi
mov dword [ebp - 0x10], edx
push edx
call fcn.01cc2b30
add esp, 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
add edi, 0x58
cmp edi, ebx
je 0x1d57871
jmp 0x1d5787b
mov ecx, dword [ebp + 8]
push edi
call fcn.01cc2980
mov ecx, eax
jmp 0x1d578b7
Function at 0x1d57a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp edi, ebx
je 0x1d57af1
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.01d55d20
test al, al
jne 0x1d57a9f
add edi, 0x58
cmp edi, ebx
jne 0x1d57a8a
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x2c]
je 0x1d57af4
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
je 0x1d57ac0
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x1d57af4
cmp byte [edi + 0x1b], 0
js 0x1d57acb
lea eax, [edi + 0x10]
jmp 0x1d57ace
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1d57af4
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x1d57af4
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x1d57af4
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d58b80
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov edi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x1d872d0]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1d58bb0
mov eax, dword [edi]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x110000
call ebx
cmp eax, 0xffffffff
je 0x1d58d03
mov esi, eax
lea eax, [ebp - 0xbc]
mov dword [eax], 2
xor edi, edi
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x1d58c42
lea eax, [ebp - 0xc0]
mov dword [eax], edi
push edi
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x1d58cc4
mov bl, 1
cmp dword [ebp - 0xc0], 0xc
jne 0x1d58c58
push esi
call fcn.01d59200
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d58d94
xor ebx, ebx
jmp 0x1d58c22
push 2
call fcn.01d36f50
add esp, 4
test al, al
je 0x1d58c54
lea edi, [ebp - 0xb8]
mov ecx, edi
push 2
push 0x8b
push str.registration_protocol_win.cc
call fcn.01d37050
lea eax, [ebp - 0xb0]
push 0x1c
push str.TransactNamedPipe:_expected
push eax
call fcn.01cfbdd0
add esp, 0xc
mov ecx, eax
push 0xc
call fcn.01cb5010
push 0xb
push str.__observed
push eax
call fcn.01cfbdd0
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xc0]
call fcn.01cb5010
mov ecx, edi
call fcn.01d37400
jmp 0x1d58c54
push 2
call fcn.01d36f50
add esp, 4
test al, al
je 0x1d58c54
call fcn.01d37a60
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x87
push str.registration_protocol_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0x11
push 0x1d8733e
jmp 0x1d58dbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x1d58d4b
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1d58d1a
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
movaps xmm0, xmmword [0x1d872d0]
jne 0x1d58ba6
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d58dd2
xor ebx, ebx
jmp 0x1d58c2b
push 2
call fcn.01d36f50
add esp, 4
test al, al
je 0x1d58d44
call fcn.01d37a60
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x6b
push str.registration_protocol_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0xa
push 0x1d8730d
push eax
call fcn.01cfbdd0
add esp, 0xc
mov ecx, esi
call fcn.01d37bf0
jmp 0x1d58d44
call fcn.01d37a60
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x79
push str.registration_protocol_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0x17
push 0x1d87326
push eax
call fcn.01cfbdd0
add esp, 0xc
mov ecx, edi
call fcn.01d37bf0
jmp 0x1d58c54
call fcn.01d37a60
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x70
push str.registration_protocol_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0xd
push str.WaitNamedPipe
jmp 0x1d58d82