joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c5b270
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1d08010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x173
push str....._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.01c76570
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.01c7f630
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x1c5b491
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x1c5b466
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x1c5b39d
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x1c5b3e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x1c5b477
mov eax, edi
inc eax
cmp eax, 2
jb 0x1c5b3dc
mov dword [ebx], edi
call fcn.01c765a0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x1c5b431
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x1c5b445
test cl, 0xa
je 0x1c5b40d
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x1c5b459
lea ecx, [esp + 0x20]
call fcn.01c7f6b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c938a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01c5b140
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x1c5b413
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x1c5b40d
push dword [ebp + 8]
call fcn.01c52930
add esp, 4
jmp 0x1c5b413
bt ebx, 0x15
jb 0x1c5b4ae
or edx, 0x20000000
jmp 0x1c5b32e
call fcn.01c765a0
push dword [ebx]
call fcn.01c79e30
add esp, 4
mov dword [ebx], 0
jmp 0x1c5b3cd
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.01cd6020
jmp 0x1c5b413
int3
Function at 0x1c5cd20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x1d08010]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1c5cd78
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x1c5cd7d
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.01c938a3
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
xor esi, esi
dec esi
jmp 0x1c5cd66
int3

Function at 0x1c5cd80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1d08010]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
call ecx
test eax, eax
je 0x1c5cdf8
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1c5cde5
cmp ebx, 0xffffffff
je 0x1c5ce0a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c938a3
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x1c5ce0d
mov ebx, dword [ebp - 0x14]
jmp 0x1c5cdd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1c5cdd1
int3
mov edx, dword [ebp + 0xc]
jmp 0x1c5cda7

Function at 0x1c5d240
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x1d08010]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.01c5d130
add esp, 0x10
or edx, eax
jne 0x1c5d277
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x1c5d28d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c938a3
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.01c7df70
add esp, 4
test al, al
jne 0x1c5d29f
xor ebx, ebx
jmp 0x1c5d277
call fcn.01cdb0c0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfb
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.01cdb1f0
lea eax, [ebp - 0xac]
push 0xc
push 0x1cfd7ea
push eax
call fcn.01cbe4b0
add esp, 0xc
mov ecx, esi
call fcn.01cdb250
jmp 0x1c5d29b
Function at 0x1c5f980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x1d08010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x1c5faad
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [section..00cfg]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x1c5fa51
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x1c5fa45
lea edi, [esi + 0xf4]
mov eax, dword [0x1d1cbd0]
bt eax, 0x19
jae 0x1c5fab1
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.01c23500
add esp, 0xc
mov ecx, 0x1c21180
mov eax, 0x1c21d10
test edi, edi
je 0x1c5fa84
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
lea eax, [ebp - 0x20]
movups xmm0, xmmword [eax]
mov eax, dword [ebp - 0x44]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c938a3
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x1c5fa99
bt eax, 9
jae 0x1c5fad2
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.01c24020
add esp, 0xc
xor eax, eax
mov ecx, 0x1c240d0
jmp 0x1c5fa7e
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.01ce2bd0
add esp, 0xc
mov ecx, 0x1ce2ad0
mov eax, 0x1ce3360
jmp 0x1c5fa7e
Function at 0x1c63be0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 0xc]
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x1c63bfc
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
mov eax, ecx
mov esi, ecx
mov ecx, ebx
mov edx, esi
mov dword [ebp - 0x14], esi
cmp esi, 4
jb 0x1c63c39
mov eax, dword [ebp - 0x14]
mov edx, eax
mov ecx, ebx
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c63c13
mov esi, dword [ebp + 8]
cmp edx, 2
je 0x1c63d9f
cmp edx, 1
je 0x1c63da8
cmp edx, 3
je 0x1c63d96
mov ecx, dword [ebp - 0x10]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x1c63d7e
mov dword [ebp - 0x18], ebx
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, edi
shr edx, 1
and edx, 0x55555555
mov eax, edi
sub eax, edx
mov edx, 0x33333333
mov ebx, eax
and ebx, edx
shr eax, 2
and eax, edx
add eax, ebx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
jbe 0x1c63d8c
mov edx, ecx
cmp ecx, edi
jb 0x1c63cca
mov eax, ecx
xor edx, edx
div edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1c63d60
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax]
test ebx, ebx
mov ecx, 0
je 0x1c63d7e
lea eax, [edi - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 0x10]
jne 0x1c63d45
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x1c63d0a
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x1c63d5a
lea ecx, [ebx + 8]
test al, al
jns 0x1c63d18
mov ecx, dword [ecx]
js 0x1c63d64
test eax, eax
je 0x1c63d7c
xor ecx, ecx
mov dword [ebp - 0x20], ebx
mov dl, byte [ebx + ecx + 8]
mov ebx, eax
mov eax, edi
mov edi, esi
mov esi, dword [ebp - 0x18]
cmp dl, byte [esi + ecx]
mov esi, edi
mov edi, eax
mov eax, ebx
mov ebx, dword [ebp - 0x20]
jne 0x1c63d5a
inc ecx
cmp eax, ecx
jne 0x1c63d23
jmp 0x1c63d7c
cmp dword [ebp - 0x28], 1
jbe 0x1c63db8
cmp eax, edi
jb 0x1c63d55
xor edx, edx
div edi
mov eax, edx
cmp eax, dword [ebp - 0x24]
jne 0x1c63d60
mov ebx, dword [ebx]
test ebx, ebx
jne 0x1c63cf5
xor ecx, ecx
jmp 0x1c63d7e
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1c63d7c
push eax
push dword [ebp - 0x18]
push ecx
call fcn.01c94c7d
add esp, 0xc
test eax, eax
jne 0x1c63d5a
mov ecx, ebx
mov dword [esi], ecx
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea edx, [edi - 1]
and edx, ecx
jmp 0x1c63cca
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x1c63c57
and eax, dword [ebp - 0x1c]
jmp 0x1c63d55
Function at 0x1c65f00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1d08010]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x1c65f30
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c938a3
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c66030
push 0
push eax
push 0x1c65ee0
push 0x1d1cc84
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c6602b
cmp dword [0x1d1cc88], 0
jne 0x1c65f1c
push dword [0x1d1cc8c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c65f1c
mov esi, eax
mov eax, 0x1d1cc90
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x1d1cc94]
mov ebx, dword [0x1d1cc98]
mov eax, dword [0x1d1cc9c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1d1cca0]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1d1cca4]
mov dword [ebp - 0x24], eax
mov eax, 0x1d1cc90
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x1c65fc4
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x1c65fd9
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1c65fef
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x1c66008
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x1c6601d
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.01c724c0
add esp, 4
jmp 0x1c65f1c
call fcn.01ca5f3a
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1d1cc8c], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x1d1cc88], ecx
pop ebp
ret
Function at 0x1c66050
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1d08010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c66030
push 0
push eax
push 0x1c65ee0
push 0x1d1cc84
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c66118
mov esi, dword [ebp + 0xc]
cmp dword [0x1d1cc88], 0
jne 0x1c66126
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1d1cc8c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1c660db
push 0x14
push 1
call fcn.01c72560
add esp, 8
test eax, eax
je 0x1c66126
mov edi, eax
push eax
push dword [0x1d1cc8c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1c6611d
mov ebx, dword [ebp + 8]
mov esi, 0x1d1cc90
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x1d1cc94], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c938a3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01ca5f3a
push edi
call fcn.01c724c0
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x1c66104

Function at 0x1c6bec0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
cmp edx, 4
jb 0x1c6bef8
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c6bed2
cmp edx, 2
je 0x1c6bf2a
cmp edx, 1
je 0x1c6bf33
cmp edx, 3
je 0x1c6bf21
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 8
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x1c6bf07
Function at 0x1c72320
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1d08010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d0e8fc]
mov ecx, dword [0x1d0c258]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c72370
mov esi, dword [0x1d0e8f8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c938a3
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d0e8fc
call fcn.01c92957
add esp, 4
cmp dword [0x1d0e8fc], 0xffffffff
jne 0x1c72353
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c96880
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.01c928b1
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d0e92c]
mov ecx, dword [0x1d0c258]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c72419
mov ecx, esi
push ebx
push 0x1d0e908
push edi
call fcn.01c43480
mov dword [0x1d0e8f8], esi
push 0x1d0e8fc
call fcn.01c929cd
add esp, 4
jmp 0x1c72353
push 0x1d0e92c
call fcn.01c92957
add esp, 4
cmp dword [0x1d0e92c], 0xffffffff
jne 0x1c723f3
xorps xmm0, xmm0
movups xmmword [0x1d0e918], xmm0
movups xmmword [0x1d0e908], xmm0
mov dword [0x1d0e928], 0
push 0x1d0e908
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d0e92c
call fcn.01c929cd
add esp, 4
jmp 0x1c723f3
Function at 0x1c76420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x1c764fa
mov esi, ecx
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x3c]
cmp dword [edx + eax + 0x74], 0
je 0x1c764fa
add edx, eax
xor eax, eax
cmp word [edx + 0x14], 0x68
jb 0x1c76521
add edx, 0x78
je 0x1c76521
mov ecx, esi
push dword [edx]
call fcn.01c76400
test eax, eax
je 0x1c764fa
mov ecx, dword [ebp + 8]
cmp ecx, 0xffff
jbe 0x1c76519
mov edi, eax
mov dword [ebp - 0x10], esi
mov ecx, esi
push dword [eax + 0x20]
call fcn.01c76400
mov esi, eax
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1c764fa
lea ebx, [esi + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
mov edi, ebx
sub edi, esi
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
push dword [esi + edi*2]
call fcn.01c76400
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x1c764da
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x1c764dc
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1c764ce
xor ecx, ecx
lea edi, [esi + edi*2]
movzx eax, byte [eax]
cmp cl, al
je 0x1c764fe
movzx ecx, cl
sub ecx, eax
cmovs ebx, edi
add edi, 4
test ecx, ecx
cmovg esi, edi
cmp esi, ebx
jne 0x1c764a6
xor eax, eax
jmp 0x1c76521
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call fcn.01c76400
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx ecx, word [eax + edi]
add cx, word [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
mov al, 1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c805f0
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [0x1d1bebc]
test dl, 1
je 0x1c8060f
call fcn.01c852e0
pop ebp
jmp fcn.01c85300
test ecx, ecx
je 0x1c8061e
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1c80620
pop ebp
ret
int3

Function at 0x1c81860
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.01c93cc0
mov eax, dword [0x1d08010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d0bfc0]
cmp eax, 0xffffffff
je 0x1c819b8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x1c819b8
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.01c96300
add esp, 0xc
mov ecx, dword [0x1d0bfc0]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.01c61af0
add esp, 8
test ebx, ebx
je 0x1c818db
push ebx
call fcn.01c9291c
add esp, 4
mov eax, dword [0x1d1cb4c]
mov ecx, dword [0x1d0c258]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c819cd
mov esi, dword [0x1d1cb48]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c81a12
lea eax, [ebp - 0x1410]
push 0xc00
push 0x1d1bf48
push eax
call fcn.01c96300
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x101
test al, 1
je 0x1c819a8
mov dword [ebp - 0x1418], ecx
xor ebx, ebx
lea edi, [ebp - 0x1408]
xor eax, eax
jmp 0x1c8195c
inc ebx
add edi, 0xc
cmp ebx, 0x100
je 0x1c8199a
mov esi, dword [ebp + ebx*8 - 0x810]
test esi, esi
je 0x1c81950
cmp dword [edi - 8], 0
je 0x1c81950
mov ecx, dword [ebp + ebx*8 - 0x80c]
cmp ecx, dword [edi]
jne 0x1c81950
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x1c81950
mov dword [ebp + ebx*8 - 0x810], 0
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x1c81950
mov ecx, dword [ebp - 0x1418]
dec ecx
jne 0x1c81938
call fcn.01cd6020
push 2
push dword [ebp - 0x1414]
call fcn.01c61af0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c938a3
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d1cb4c
call fcn.01c92957
add esp, 4
cmp dword [0x1d1cb4c], 0xffffffff
jne 0x1c818fc
push 4
call fcn.01c928b1
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.01c7e700
mov dword [0x1d1cb48], esi
push 0x1d1cb4c
call fcn.01c929cd
add esp, 4
jmp 0x1c818fc
mov ecx, esi
call fcn.01c7e710
jmp 0x1c81911
Function at 0x1c81df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x1d08010]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x42
push str....._base_files_file_win.cc
push str.Read
push esi
call fcn.01c76570
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.01c7f630
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x1c81ec2
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x1c81ec2
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c87510
test al, al
jne 0x1c81ef4
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c81ee2
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1c81f0e
lea ecx, [esp + 0x28]
call fcn.01c875b0
lea ecx, [esp + 0x30]
call fcn.01c7f6b0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c938a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1c81eb9
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.01ce4c80
jmp 0x1c81e74
int3

Function at 0x1c81f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x1d08010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5f
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.01c76570
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.01c7f630
test ebx, ebx
js 0x1c81fe1
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01c87510
test al, al
jne 0x1c81fe6
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c81ffa
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1c8200c
lea ecx, [esp + 0x10]
call fcn.01c875b0
lea ecx, [esp + 0x20]
call fcn.01c7f6b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c938a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x1c81fc1
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::ReadAtCurrentPos
call fcn.01ce4c80
jmp 0x1c81f95
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1c81fb8
int3