joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c51a90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x171
push str....._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.01c695c0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.01c72820
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x1c51cb1
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x1c51ca0
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x1c51bbd
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x1c51c05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x1c51c79
mov eax, edi
inc eax
cmp eax, 2
jb 0x1c51bfc
mov dword [ebx], edi
call fcn.01c695f0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x1c51c51
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x1c51c65
test cl, 0xa
je 0x1c51c2d
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x1c51c93
lea ecx, [esp + 0x20]
call fcn.01c72890
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c87bd3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01c51970
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x1c51c33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x1c51c2d
call fcn.01c695f0
push dword [ebx]
call fcn.01c6ca00
add esp, 4
mov dword [ebx], 0
jmp 0x1c51bed
push dword [ebp + 8]
call fcn.01c4c9d0
add esp, 4
jmp 0x1c51c33
bt ebx, 0x15
jb 0x1c51cce
or edx, 0x20000000
jmp 0x1c51b4e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.01ccaad0
jmp 0x1c51c33
int3
Function at 0x1c53300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x1cff040]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, 0x7fffffff
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1c5335f
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x1c5335c
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.01c87bd3
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
int3
xor esi, esi
dec esi
jmp 0x1c5334a

Function at 0x1c53370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1cff040]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, 0x7fffffff
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
mov esi, ecx
call ecx
test eax, eax
je 0x1c533f3
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1c533dd
cmp ebx, 0xffffffff
je 0x1c533f0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x1c53405
mov ebx, dword [ebp - 0x14]
jmp 0x1c533c9
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1c533c9
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
mov esi, dword [ebp - 0x18]
jmp 0x1c533a6

Function at 0x1c53860
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov esi, dword [ebp + 8]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.01c53750
add esp, 0x10
or edx, eax
jne 0x1c53897
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x1c538ad
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0xa4
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.01c6d5f0
add esp, 4
test al, al
je 0x1c538f7
call fcn.01ccfae0
lea esi, [ebp - 0xac]
mov ecx, esi
push eax
push 2
push 0xfc
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.01ccfcb0
lea eax, [ebp - 0xa4]
push 0xc
push 0x1cf6a2a
push eax
call fcn.01c5b050
add esp, 0xc
mov ecx, esi
call fcn.01ccfd10
xor ebx, ebx
jmp 0x1c53897
Function at 0x1c55060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x1c5518c
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x1cfa1e0]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x1cfa1e0]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x1cfa1e0]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x1c55131
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x1c55125
push 1
call fcn.01c7df00
add esp, 4
bt eax, 0x19
jae 0x1c55190
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.01c23500
add esp, 0xc
mov eax, 0x1c21d10
mov ecx, 0x1c21180
lea edx, [ebp - 0x20]
mov edi, dword [ebp - 0x44]
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edx]
movups xmmword [edi], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x1c55178
bt eax, 9
jae 0x1c551b1
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.01c24020
add esp, 0xc
xor eax, eax
mov ecx, 0x1c240d0
jmp 0x1c5515d
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.01cd9370
add esp, 0xc
mov eax, 0x1cd9b00
mov ecx, 0x1cd9280
jmp 0x1c5515d
Function at 0x1c55c40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x1c55c57
test eax, eax
je 0x1c55c57
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
sete al
mov ecx, dword [0x1d28c7c]
test ecx, ecx
setne dl
and dl, al
cmp dl, 1
je 0x1c55caa
cmp dword [0x1d28c74], 0
je 0x1c55c51
mov esi, dword [0x1d28c78]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x1c55cb4
test esi, esi
je 0x1c55c51
mov ecx, dword [0x1d28c74]
call dword [0x1cfa1e0]
push esi
call ecx
add esp, 4
jmp 0x1c55c51
call dword [0x1cfa1e0]
call ecx
jmp 0x1c55c6e
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1c55c92

Function at 0x1c56c10
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x1c56c29
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x1c56c41
cmp byte [esi + 0x28], 1
je 0x1c56cb2
or ebx, 0x20000000
test bl, 8
jne 0x1c56cba
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x1c56c5b
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x1c56c69
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 1
je 0x1c56d0c
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x1c56d22
test ecx, ecx
jne 0x1c56cdf
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x1c56cd6
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x1c56c41
cmp byte [esi + 0x34], 1
jne 0x1c56ccb
or ebx, 0x40000000
jmp 0x1c56c46
or ebx, 0x10000000
jmp 0x1c56c46
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1c56ca3
cmp ecx, 4
jne 0x1c56ceb
mov ecx, 6
jmp 0x1c56c8c
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x1c56cfc
mov ecx, 7
jmp 0x1c56c8c
cmp esi, 1
jne 0x1c56d08
mov ecx, 4
jmp 0x1c56c8c
xor ecx, ecx
jmp 0x1c56c8c
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.01c51880
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x1c56c76
mov ecx, esi
mov esi, edx
call fcn.01c51880
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x1c56c85
Function at 0x1c56d40
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x1c56d6a
cmp byte [esi + 0x28], 1
je 0x1c56df0
or ebx, 0x20000000
test bl, 8
jne 0x1c56dfb
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x1c56d83
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x1c56d91
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 1
je 0x1c56e17
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x1c56e2d
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x1c56ddf
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x1c56e24
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x1c56e3d
mov edx, 7
jmp 0x1c56db9
or ebx, 0x80000000
jmp 0x1c56d6a
cmp byte [esi + 0x34], 1
jne 0x1c56e0c
or ebx, 0x40000000
jmp 0x1c56d73
or ebx, 0x10000000
jmp 0x1c56d73
lea ecx, [esi + 0x10]
call fcn.01c51880
jmp 0x1c56d9a
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1c56dd0
mov ecx, esi
mov esi, edx
call fcn.01c51880
mov edx, esi
jmp 0x1c56dac
test esi, esi
jne 0x1c56e49
xor edx, edx
inc edx
jmp 0x1c56db9
cmp esi, 1
jne 0x1c56e58
mov edx, 4
jmp 0x1c56db9
xor edx, edx
jmp 0x1c56db9
Function at 0x1c589b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1cff040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x1c589e0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c58af0
push 0
push eax
push 0x1c58990
push 0x1d2a130
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c58ae8
cmp dword [0x1d2a134], 0
jne 0x1c589cc
push dword [0x1d2a138]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c589cc
mov esi, eax
mov eax, 0x1d2a13c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x1d2a140]
mov ebx, dword [0x1d2a144]
mov eax, dword [0x1d2a148]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1d2a14c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1d2a150]
mov dword [ebp - 0x24], eax
mov eax, 0x1d2a13c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x1c58ace
test ebx, ebx
jne 0x1c58aa8
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1c58a86
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x1c58a97
test ebx, ebx
jne 0x1c58abb
push esi
call fcn.01c68d20
add esp, 4
jmp 0x1c589cc
mov edi, dword [esi + 8]
call dword [0x1cfa1e0]
push edi
call ecx
add esp, 4
jmp 0x1c58a6a
mov edi, dword [esi + 0xc]
call dword [0x1cfa1e0]
push edi
call ecx
add esp, 4
jmp 0x1c58a74
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x1cfa1e0]
push edi
call ebx
add esp, 4
jmp 0x1c58a63
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x1cfa1e0]
push edi
call ebx
add esp, 4
jmp 0x1c58a78
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x1cfa1e0]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x1c58a5f
call fcn.01c9a3d6
int3
Function at 0x1c58b10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x1c58af0
push 0
push eax
push 0x1c58990
push 0x1d2a130
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c58bd8
mov esi, dword [ebp + 0xc]
cmp dword [0x1d2a134], 0
jne 0x1c58be6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1d2a138]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1c58b9b
push 0x14
push 1
call fcn.01c68dc0
add esp, 8
test eax, eax
je 0x1c58be6
mov edi, eax
push eax
push dword [0x1d2a138]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1c58bdd
mov ebx, dword [ebp + 8]
mov esi, 0x1d2a13c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x1d2a140], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01c9a3d6
push edi
call fcn.01c68d20
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x1cfa1e0]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x1c58bc4
Function at 0x1c626e0
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
jne 0x1c626ef
xor eax, eax
cmp dword [ecx + 0x14], 0
je 0x1c626f0
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ecx + 0xc]
mov esi, dword [ecx + 0x10]
test esi, esi
jne 0x1c62757
test edi, edi
jne 0x1c627e1
mov edi, dword [ecx]
test edi, edi
je 0x1c627ad
mov dword [ecx + 0xc], edi
mov edx, dword [ecx + 4]
cmp edx, 0x40
jb 0x1c627cd
mov ebx, edx
movzx edx, word [edi]
cmp edx, 0x5a4d
jne 0x1c627cd
mov esi, dword [edi + 0x3c]
lea edx, [esi + 0x18]
cmp edx, ebx
ja 0x1c627ad
add esi, edi
cmp dword [esi], 0x4550
jne 0x1c627ad
mov edx, edi
add esi, 4
mov dword [ecx + 0x10], esi
mov edi, ebx
jne 0x1c6275c
jmp 0x1c627ad
mov edx, edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
add esi, 0x14
mov ebx, esi
sub ebx, edx
lea edx, [ebx + 2]
cmp edx, edi
ja 0x1c627ad
mov dword [ebp - 0x18], esi
movzx edx, word [esi]
cmp edx, 0x20b
jne 0x1c627b9
mov al, 1
mov dword [ebp - 0x10], eax
mov eax, 2
mov dword [ecx + 8], eax
lea edx, [ebx + 0xf0]
cmp edx, edi
seta dl
add ebx, 0xe0
cmp ebx, edi
ja 0x1c627ad
and dl, byte [ebp - 0x10]
mov esi, dword [ebp - 0x18]
jne 0x1c627ad
cmp edi, 0xffffffff
je 0x1c627d6
mov dword [ecx + 0x14], esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1c626ef
cmp edx, 0x10b
jne 0x1c627e9
xor eax, eax
inc eax
mov dword [ebp - 0x10], 0
jmp 0x1c62785
mov dword [ecx + 0xc], 0
jmp 0x1c627ad
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x4c]
mov dword [ecx + 4], edx
jmp 0x1c627aa
mov ebx, dword [ecx + 4]
jmp 0x1c62735
mov dword [ecx + 8], 0
jmp 0x1c627ad
Function at 0x1c66f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x1c67043
mov esi, ecx
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x3c]
cmp dword [edx + eax + 0x74], 0
je 0x1c67043
add edx, eax
xor eax, eax
cmp word [edx + 0x14], 0x68
jb 0x1c67039
add edx, 0x78
je 0x1c67039
mov ecx, esi
push dword [edx]
call fcn.01c66f20
test eax, eax
je 0x1c67043
cmp dword [ebp + 8], 0xffff
jbe 0x1c67047
mov edi, eax
mov dword [ebp - 0x10], esi
mov ecx, esi
push dword [eax + 0x20]
call fcn.01c66f20
mov esi, eax
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x18]
lea ebx, [esi + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
jmp 0x1c66fdc
xor ecx, ecx
lea edi, [esi + edi*2]
movzx edx, cl
movzx eax, byte [eax]
cmp edx, eax
lea edx, [edi + 4]
cmovg esi, edx
cmovs ebx, edi
cmp cl, al
je 0x1c67016
cmp esi, ebx
je 0x1c67043
mov edi, ebx
sub edi, esi
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
push dword [esi + edi*2]
call fcn.01c66f20
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x1c66fc2
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x1c66fc4
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1c67008
jmp 0x1c66fc2
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call fcn.01c66f20
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx ecx, word [eax + edi]
add cx, word [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
mov al, 1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor eax, eax
jmp 0x1c67039
mov ecx, dword [ebp + 8]
jmp 0x1c67031
Function at 0x1c67050
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d1cb0c]
mov ecx, dword [0x1d1a468]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c670a0
mov esi, dword [0x1d1cb08]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d1cb0c
call fcn.01c86cf1
add esp, 4
cmp dword [0x1d1cb0c], 0xffffffff
jne 0x1c67083
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c8abb0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.01c86c86
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d1cb3c]
mov ecx, dword [0x1d1a468]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c67149
mov ecx, esi
push ebx
push 0x1d1cb18
push edi
call fcn.01c3e540
mov dword [0x1d1cb08], esi
push 0x1d1cb0c
call fcn.01c86d6b
add esp, 4
jmp 0x1c67083
push 0x1d1cb3c
call fcn.01c86cf1
add esp, 4
cmp dword [0x1d1cb3c], 0xffffffff
jne 0x1c67123
xorps xmm0, xmm0
movups xmmword [0x1d1cb28], xmm0
movups xmmword [0x1d1cb18], xmm0
mov dword [0x1d1cb38], 0
push 0x1d1cb18
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d1cb3c
call fcn.01c86d6b
add esp, 4
jmp 0x1c67123
Function at 0x1c727e0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01c7be00
Function at 0x1c758a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
movzx eax, byte [0x1d28b44]
test al, 1
je 0x1c7590c
call fcn.01c7df30
pop esi
pop edi
pop ebp
jmp fcn.01c7df50
push 0x1d28b4c
call fcn.01c86cf1
add esp, 4
cmp dword [0x1d28b4c], 0xffffffff
jne 0x1c75929
push str.bcryptprimitives.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x1c75944
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1c75947
mov dword [0x1d28b48], eax
push 0x1d28b4c
call fcn.01c86d6b
add esp, 4
jmp 0x1c75929
mov eax, dword [0x1d28b4c]
mov ecx, dword [0x1d1a468]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c758c3
mov ecx, dword [0x1d28b48]
call dword [0x1cfa1e0]
push edi
push esi
call ecx
test eax, eax
je 0x1c75941
pop esi
pop edi
pop ebp
ret
int3
int3
int3

Function at 0x1c79490
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x42
push str....._base_files_file_win.cc
push str.Read
push esi
call fcn.01c695c0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.01c72820
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x1c79562
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x1c79562
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c80ec0
test al, al
jne 0x1c79599
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c79582
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x1c79594
lea ecx, [esp + 0x28]
call fcn.01c80f60
lea ecx, [esp + 0x30]
call fcn.01c72890
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1c79559
int3
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.01cdafc0
jmp 0x1c79514