joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d79208
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov edi, edx
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
js 0x1d79236
mov word [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x1d79244
mov eax, dword [ecx]
mov word [eax], 0
mov dword [ecx + 4], 0
xor ebx, ebx
test esi, esi
je 0x1d7935d
lea ecx, [ebp - 0x228]
mov dword [ecx], ebx
lea eax, [ebp - 0x20]
mov dword [eax], ebx
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1d79350
mov dword [ebp - 0x234], esi
mov eax, dword [ebp - 0x228]
movzx esi, word [eax]
movzx ebx, word [eax + 2]
mov word [ebp - 0x20], si
mov word [ebp - 0x1e], bx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], bx
mov word [ebp - 0x18], si
mov si, 0x4e4
mov word [ebp - 0x16], si
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], si
mov esi, 0xfffffffe
push 0x208
push 0xff
lea eax, [ebp - 0x228]
push eax
call fcn.01e63410
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1d792db
mov eax, dword [edi]
movzx ecx, word [ebp + esi*2 - 0x1c]
movzx edx, word [ebp + esi*2 - 0x1a]
push eax
push edx
push ecx
push str.StringFileInfo_04hx_04hx_ls
mov eax, 0x104
push eax
push eax
lea ebx, [ebp - 0x228]
push ebx
call fcn.01d7a141
add esp, 0x1c
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x22c]
push eax
push ebx
push dword [ebp - 0x234]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
setne cl
mov eax, dword [ebp - 0x22c]
test eax, eax
setne bl
and bl, cl
cmp bl, 1
je 0x1d79354
add esi, 2
cmp esi, 5
jbe 0x1d792b8
jmp 0x1d7935d
xor ebx, ebx
jmp 0x1d7935d
mov ecx, dword [ebp + 8]
push eax
call fcn.01d7445e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d79374
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 6
push str.MSEdge
call fcn.01d743d6
mov ecx, edi
push 0xd
push str.0.0.0.0_devel
call fcn.01d743d6
cmp byte [esi + 0xb], 0
js 0x1d793be
mov word [esi], 0
mov byte [esi + 0xb], 0
jmp 0x1d793cc
mov eax, dword [esi]
mov word [eax], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x14], 0
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x1d793dd
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1d7952d
mov esi, eax
push eax
call fcn.01e5f3a3
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x14]
cmp byte [ebx + 0xb], 0
jns 0x1d79407
mov ebx, dword [ebx]
push edi
push esi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1d79520
lea esi, [ebp - 0x20]
mov ecx, esi
push 0x1eb9cc8
call fcn.01cd2ef8
mov ecx, edi
mov edx, esi
push dword [ebp + 0x10]
call fcn.01d79208
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x1d79447
push dword [ebp - 0x20]
call fcn.01e5f36c
add esp, 4
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
lea ebx, [ebp - 0x2c]
mov ecx, ebx
push 0x1eb9ce6
call fcn.01cd2ef8
mov ecx, edi
mov edx, ebx
push esi
call fcn.01d79208
add esp, 4
cmp byte [ebx + 0xb], 0
jns 0x1d7947f
push dword [ebp - 0x2c]
call fcn.01e5f36c
add esp, 4
movzx eax, byte [ebp - 0x15]
test al, al
cmovs eax, dword [ebp - 0x1c]
cmovs esi, dword [ebp - 0x20]
mov ecx, ebx
push eax
push esi
call fcn.01cd2c42
cmp dword [ebx + 4], 1
jne 0x1d794a5
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x31
je 0x1d794b4
mov ecx, dword [ebp + 0x10]
push 6
push str._devel
call fcn.01d74480
lea esi, [ebp - 0x2c]
mov ecx, esi
push 0x1eb9d12
call fcn.01cd2ef8
mov ecx, edi
mov edx, esi
push dword [ebp + 0xc]
call fcn.01d79208
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x1d794e3
push dword [ebp - 0x2c]
call fcn.01e5f36c
add esp, 4
mov ecx, esi
push str.SpecialBuild
call fcn.01cd2ef8
mov ecx, edi
mov edx, esi
push dword [ebp + 0x14]
call fcn.01d79208
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x1d7950f
push dword [ebp - 0x2c]
call fcn.01e5f36c
add esp, 4
cmp byte [ebp - 0x15], 0
jns 0x1d79520
push dword [ebp - 0x20]
call fcn.01e5f36c
add esp, 4
test edi, edi
je 0x1d7952d
push edi
call fcn.01e5f3ac
add esp, 4
lea eax, [ebp - 0x20]
push 1
push eax
call fcn.01d7956f
add esp, 8
mov esi, dword [ebp + 0x18]
cmp byte [esi + 0xb], 0
jns 0x1d7954e
push dword [esi]
call fcn.01e5f36c
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x20]
movsd qword [esi], xmm0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d79d46
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ebx + 0xb], 0
mov esi, ebx
jns 0x1d79d66
mov esi, dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1d79d94
test al, 0x10
jne 0x1d79e7a
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.01d79ec5
add esp, 0xc
xor ebx, ebx
jmp 0x1d79eb1
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
movzx eax, byte [ebx + 0xb]
mov ecx, ebx
test al, al
jns 0x1d79dae
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
add eax, eax
test eax, eax
je 0x1d79e01
movzx edx, word [ecx + eax - 2]
add eax, 0xfffffffe
cmp edx, 0x5c
je 0x1d79dc6
cmp edx, 0x2f
jne 0x1d79db0
cmp eax, 0xfffffffe
je 0x1d79e01
sar eax, 1
lea edx, [ebp - 0x11]
lea edi, [ebp - 0x2c]
mov ecx, edi
push edx
push eax
push 0
push ebx
call fcn.01d745c0
movsd xmm0, qword [edi]
lea eax, [ebp - 0x20]
movsd qword [eax], xmm0
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
push eax
call fcn.01d79d46
add esp, 4
test al, al
je 0x1d79e91
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1d79ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1d79e69
mov dword [ebp - 0x30], eax
lea edi, [ebp - 0x2c]
mov ecx, edi
push esi
call fcn.01cd2ef8
cmp byte [edi + 0xb], 0
jns 0x1d79e38
mov edi, dword [ebp - 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
cmp byte [ebp - 0x21], 0
jns 0x1d79e62
push dword [ebp - 0x2c]
mov edi, eax
call fcn.01e5f36c
mov eax, edi
add esp, 4
test al, al
mov eax, dword [ebp - 0x30]
jne 0x1d79ea0
push eax
push esi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.01d79ec5
add esp, 0xc
jmp 0x1d79e9e
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_exists___n
call fcn.01d79ec5
add esp, 0xc
mov bl, 1
jmp 0x1d79eb1
push str.Failed_to_create_one_of_the_parent_directories
call fcn.01d79ec5
add esp, 4
xor ebx, ebx
cmp byte [ebp - 0x15], 0
jns 0x1d79eb1
push dword [ebp - 0x20]
call fcn.01e5f36c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d79ec5
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01ce32f8
mov ebx, 0x1f0f97c
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01e643fb
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d7a9bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1d7aac6
mov edi, ecx
mov eax, dword [ecx + 4]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx + 0x74], 0
je 0x1d7aac6
add eax, ecx
xor ebx, ebx
cmp word [eax + 0x14], 0x68
jb 0x1d7aac8
add eax, 0x78
je 0x1d7aac8
mov ecx, edi
push dword [eax]
call fcn.01d7a830
test eax, eax
je 0x1d7aac6
mov ebx, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x1d7aabf
mov dword [ebp - 0x10], edi
mov ecx, edi
push dword [ebx + 0x20]
mov esi, eax
call fcn.01d7a830
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebx + 0x18]
lea ecx, [eax + ecx*4]
lea edx, [esi + 1]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], eax
xor ebx, ebx
cmp eax, ecx
je 0x1d7aac8
mov esi, eax
mov dword [ebp - 0x14], ecx
mov edi, ecx
sub edi, eax
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
push dword [esi + edi*2]
call fcn.01d7a830
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x1d7aa85
mov edx, dword [ebp - 0x20]
cmp cl, byte [eax]
jne 0x1d7aa82
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1d7aa74
xor ecx, ecx
movzx ebx, cl
mov edx, dword [ebp - 0x14]
lea edi, [esi + edi*2]
movzx eax, byte [eax]
cmp ebx, eax
lea eax, [edi + 4]
cmovle eax, esi
mov ecx, edx
cmovs ecx, edi
jne 0x1d7aa3d
cmp esi, edx
je 0x1d7aac6
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
push dword [esi + 0x24]
call fcn.01d7a830
sub edi, dword [ebp - 0x18]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov esi, dword [ebp + 0xc]
mov word [esi], ax
mov bl, 1
jmp 0x1d7aac8
xor ebx, ebx
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1d7c760
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ecx], 0x1eae364
add ecx, 4
call fcn.01d0fb80
lea ecx, [esi + 8]
call fcn.01d0fb80
mov byte [esi + 0xc], 0
lea ecx, [esi + 0x24]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], 0
call fcn.01d0fb80
mov byte [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
lea eax, [esi + 0x3c]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x38], eax
xorps xmm0, xmm0
movups xmmword [esi + 0x44], xmm0
movups xmmword [esi + 0x54], xmm0
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x6c], 0x3f800000
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0x3f800000
movups xmmword [esi + 0x88], xmm0
mov dword [esi + 0x98], 0x3f800000
movups xmmword [esi + 0x9c], xmm0
mov dword [esi + 0xac], 0x3f800000
movups xmmword [esi + 0xb0], xmm0
mov dword [esi + 0xc0], 0x3f800000
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe0], 0
movups xmmword [esi + 0xc8], xmm0
mov dword [esi + 0xd8], 0
mov eax, dword [0x1ef6ae4]
mov dword [esi + 0xe8], eax
lea ecx, [esi + 0xec]
call fcn.01dd7350
xorps xmm0, xmm0
movups xmmword [esi + 0x188], xmm0
mov dword [esi + 0x198], 0x3f800000
movups xmmword [esi + 0x19c], xmm0
movups xmmword [esi + 0x1a5], xmm0
mov dword [esi + 0x1b8], edi
mov byte [esi + 0x1bc], 0
mov dword [esi + 0x1c0], 0
mov dword [esi + 0x1c4], 0
mov dword [esi + 0x1c8], 0
call sym.msedge_elf.dll_OQS_destroy
call fcn.01d86ae0
mov ecx, eax
mov dword [esi + 0xd8], eax
xor ecx, 0x84222325
mov edx, 0x1b3
mov eax, ecx
mul edx
shl ecx, 8
add ecx, edx
add ecx, 0x8d40976c
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], ecx
mov edx, dword [esi + 0xe8]
mov ecx, dword [esi + 0xf0]
mov eax, ecx
shr eax, 6
test dword [0x1eafebc], edx
je 0x1d7c916
cmp ecx, 0x40
mov ecx, 0x3e8
jmp 0x1d7c926
test dword [0x1ef6ae8], edx
je 0x1d7c971
cmp ecx, 0x40
mov ecx, 0x100
cmovb eax, ecx
push eax
call fcn.01dd6390
add esp, 4
mov edi, dword [esi + 0x14]
mov dword [esi + 0x14], eax
test edi, edi
je 0x1d7c94e
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
call fcn.01d819f0
mov ecx, eax
push 0
push str.TraceLog
push esi
call fcn.01d81b60
mov dword [0x1f103c4], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
test dword [0x1ef6aec], edx
je 0x1d7c983
cmp ecx, 0x40
mov ecx, 0x7a1200
jmp 0x1d7c98b
cmp ecx, 0x40
mov ecx, 0xfa0
cmovb eax, ecx
push eax
call fcn.01dd6430
jmp 0x1d7c92f
Function at 0x1d80160
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x1c], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x24], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x1d801e3
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1d801a0
cmp edx, 1
je 0x1d801ec
cmp edx, 2
je 0x1d801f1
cmp edx, 3
mov ebx, dword [ebp - 0x10]
jne 0x1d80208
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
jmp 0x1d801f4
mov eax, edx
mov ecx, esi
cmp edx, 1
jne 0x1d801cb
mov ebx, dword [ebp - 0x10]
jmp 0x1d801fd
mov ebx, dword [ebp - 0x10]
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x1d8034a
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ecx
shr edx, 1
and edx, 0x55555555
mov eax, ecx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x10], eax
cmp eax, 1
mov dword [ebp - 0x18], ecx
ja 0x1d8026f
lea edx, [ecx - 1]
and edx, edi
jmp 0x1d8027c
mov edx, edi
cmp edi, ecx
jb 0x1d8027c
mov eax, edi
xor edx, edx
div dword [ebp - 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
mov ecx, 0
je 0x1d8034c
mov ebx, dword [eax]
test ebx, ebx
je 0x1d8034c
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
test cl, cl
mov eax, dword [ebp - 0x1c]
cmovns eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x1d802d4
and eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jne 0x1d8034a
mov ebx, dword [ebx]
test ebx, ebx
je 0x1d8034a
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x1d80320
movzx eax, byte [ebx + 0x13]
test al, al
mov ecx, dword [ebx + 0xc]
mov edx, eax
cmovs edx, ecx
cmp edx, dword [ebp - 0x1c]
jne 0x1d802ce
test al, al
js 0x1d80335
test eax, eax
je 0x1d80346
xor ecx, ecx
nop dword [eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x1d802ce
inc ecx
cmp eax, ecx
jne 0x1d80300
jmp 0x1d80346
cmp dword [ebp - 0x10], 1
jbe 0x1d802c0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x1d802c3
xor edx, edx
div ecx
mov eax, edx
jmp 0x1d802c3
push ecx
push esi
push dword [ebx + 8]
call fcn.01e6180d
add esp, 0xc
test eax, eax
jne 0x1d802ce
mov ecx, ebx
jmp 0x1d8034c
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1d81350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x1d81415
mov esi, ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0x9ffffff
lea edx, [esp + 0xc]
cmp edx, str.discarded
ja 0x1d813a7
lea eax, [esp + 0x15]
cmp eax, str.discarded
ja 0x1d8142c
mov dword [esp + 0x10], 0x65647261
mov dword [esp + 0xc], 0x63736964
mov word [esp + 0x14], 0x64
mov edi, esp
mov ecx, esi
push edx
push edi
call fcn.01d812c0
push 0x40
call fcn.01e5f33c
add esp, 4
mov ebx, eax
mov ecx, eax
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x14]
push eax
call fcn.01d82030
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x1d813ff
mov ecx, edi
call fcn.01d820a0
push edi
call fcn.01e5f36c
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x1d81412
push dword [esp + 0xc]
call fcn.01e5f36c
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01e60425
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.char_traits::copy:_source_and_destination_ranges_overlap
push str._std::__is_pointer_in_range___s1____s1____n____s2_
push 0xf1
push str....._third_partylibc_srcinclude__stringchar_traits.h
push str._s:_d:_assertion__s_failed:__s_n
call fcn.01ce782c
int3

Function at 0x1d82760
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.01e63410
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x5c
call fcn.01e5f33c
add esp, 4
mov esi, eax
mov ebx, dword [ebp - 0x130]
mov eax, dword [0x1f10404]
mov ecx, dword [0x1f0c740]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d8281e
mov ecx, esi
push ebx
push 0x1f103e0
push edi
call fcn.01d82980
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1f10404
call fcn.01e5f3e7
add esp, 4
cmp dword [0x1f10404], 0xffffffff
jne 0x1d827f9
xorps xmm0, xmm0
movups xmmword [0x1f103f0], xmm0
movups xmmword [0x1f103e0], xmm0
mov dword [0x1f10400], 0
push 0x1f103e0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1f10404
call fcn.01e5f45d
add esp, 4
jmp 0x1d827f9
Function at 0x1d828d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1f10404]
mov ecx, dword [0x1f0c740]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d82926
movzx eax, word [0x1f103e0]
cmp eax, 0xc
ja case.0x1d828fc.1
jmp dword [eax*4 + 0x1ebbc24]
mov eax, 3
pop ebp
ret
mov eax, 5
pop ebp
ret
mov eax, 2
pop ebp
ret
mov eax, 1
pop ebp
ret
mov eax, 4
pop ebp
ret
push 0x1f10404
call fcn.01e5f3e7
add esp, 4
cmp dword [0x1f10404], 0xffffffff
jne 0x1d828f0
xorps xmm0, xmm0
movups xmmword [0x1f103f0], xmm0
movups xmmword [0x1f103e0], xmm0
mov dword [0x1f10400], 0
push 0x1f103e0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1f10404
call fcn.01e5f45d
add esp, 4
jmp 0x1d828f0

Function at 0x1d83090
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x208
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x1b
push str....._basewinwin_util.cc
call fcn.01da2520
add esp, 8
test eax, eax
jle 0x1d830ee
lea esi, [ebp - 0x20c]
mov ecx, esi
push 0xffffffffffffffff
push 0x507
push str....._basewinwin_util.cc
call fcn.01da2590
lea eax, [ebp - 0x204]
push 0x19
push str.Checking_if_internal_user
push eax
call fcn.01cdcc16
add esp, 0xc
mov ecx, esi
call fcn.01da29c0
lea eax, [ebp - 0x20a]
push 0x1fe
push 0xff
push eax
call fcn.01e63410
add esp, 0xc
mov word [ebp - 0x20c], 0
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x210]
lea esi, [ebp - 0x20c]
push eax
push esi
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1d83158
push esi
call fcn.01e79bc6
add esp, 4
push 1
push 0x13
push str..corp.microsoft.com
push eax
push esi
call fcn.01ddebf0
add esp, 0x14
test al, al
je 0x1d83158
mov bl, 1
jmp 0x1d83185
mov eax, dword [0x1f10414]
mov ecx, dword [0x1f0c740]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d8319b
cmp byte [0x1f10412], 0
setne bl
and bl, byte [0x1f10410]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x208
pop esi
pop ebx
pop ebp
ret
push 0x1f10414
call fcn.01e5f3e7
add esp, 4
cmp dword [0x1f10414], 0xffffffff
jne 0x1d83175
call fcn.01d83820
mov byte [0x1f10412], al
push 0x1f10414
call fcn.01e5f45d
add esp, 4
jmp 0x1d83175
Function at 0x1d83f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x11], 0xff
mov ebx, dword [ecx]
lea edi, [ebp - 0x24]
push 0x1a6
push str....._basewin_registry.cc
push str.ReadValue
push edi
call fcn.01da46e0
add esp, 0x10
lea ecx, [ebp - 0x11]
push 1
push ebx
push edi
call fcn.01de1380
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x28]
push eax
push ecx
push edx
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
lea ecx, [ebp - 0x11]
call sym.msedge_elf.dll_OQS_destroy
test esi, esi
jne 0x1d8402e
mov eax, dword [ebp - 0x28]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1d8402e
cmp dword [ebp - 0x2c], 4
jne 0x1d8402e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x1d84050
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.01e60860
mov esi, ecx
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x810]
push 0x800
push 0xff
push eax
call fcn.01e63410
add esp, 0xc
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x101c], 0x800
mov byte [ebp - 0x1011], 0xff
mov edi, dword [esi]
lea ebx, [ebp - 0x1010]
push 0x1a6
push str....._basewin_registry.cc
push str.ReadValue
push ebx
call fcn.01da46e0
add esp, 0x10
lea ecx, [ebp - 0x1011]
push 1
push edi
push ebx
call fcn.01de1380
lea eax, [ebp - 0x101c]
lea ecx, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x810]
push eax
push ecx
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
lea ecx, [ebp - 0x1011]
call sym.msedge_elf.dll_OQS_destroy
test edi, edi
jne 0x1d8416c
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1018]
cmp eax, 2
je 0x1d84125
mov edi, 0x3f4
cmp eax, 1
jne 0x1d8416c
mov ecx, esi
lea eax, [ebp - 0x810]
push eax
jmp 0x1d84165
push 0x800
push 0xff
push ebx
call fcn.01e63410
add esp, 0xc
push 0x400
push ebx
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x101c], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x1d8416c
mov ecx, esi
push ebx
call fcn.01d7445e
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8