joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c4334a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x18], eax
xor esi, esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c433a2
mov ebx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 0x10], esi
cmp eax, 0x7ffffff0
jae 0x1c43483
cmp ebx, 5
jae 0x1c433bc
lea edi, [esp + 8]
mov byte [edi + 0xb], bl
mov dword [esp + 4], edi
mov eax, edi
jmp 0x1c433e4
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c92b01
mov eax, edi
jmp 0x1c4347b
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.01c92a8c
add esp, 4
lea edi, [esp + 8]
mov dword [edi], eax
or esi, 0x80000000
mov dword [edi + 8], esi
mov dword [edi + 4], ebx
mov dword [esp + 4], edi
mov ecx, ebx
add ecx, ebx
push ecx
push 0
push eax
mov esi, eax
call fcn.01c97000
add esp, 0xc
mov word [esi + ebx*2], 0
mov eax, dword [esp + 4]
mov esi, eax
cmp byte [eax + 0xb], 0
jns 0x1c4340c
mov edi, dword [esp + 8]
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movzx ecx, byte [esi + 0xb]
test eax, eax
mov esi, dword [ebp + 8]
je 0x1c43454
mov edx, ecx
test cl, cl
jns 0x1c4342c
mov edx, dword [esp + 0xc]
cmp eax, edx
jae 0x1c43454
lea edi, [esp + 8]
mov ecx, edi
push 0
push eax
call fcn.01c3f678
mov eax, dword [edi + 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [edi]
mov esi, dword [ebp + 8]
movsd qword [esi], xmm0
jmp 0x1c4346e
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
test cl, cl
jns 0x1c4346e
push dword [esp + 8]
call fcn.01c92abc
add esp, 4
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 8]
call fcn.01c3eb04
Function at 0x1c43736
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
push dword [ebp + 0xc]
call fcn.01caafe4
add esp, 4
mov ebx, eax
movzx ecx, byte [esi + 0xb]
mov eax, ecx
mov dword [ebp - 0x14], ecx
test cl, cl
jns 0x1c4376c
mov eax, dword [esi + 4]
lea esi, [eax + ebx]
cmp esi, 0x7ffffff0
jae 0x1c437f0
cmp esi, 4
mov dword [ebp - 0x10], eax
ja 0x1c43789
mov esi, dword [ebp + 8]
mov byte [esi + 0xb], bl
mov edi, esi
jmp 0x1c437b0
add esi, 8
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.01c92a8c
add esp, 4
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
or esi, 0x80000000
mov dword [eax + 8], esi
mov esi, eax
mov dword [eax + 4], ebx
test ebx, ebx
je 0x1c437c5
mov eax, ebx
add eax, ebx
push eax
push dword [ebp + 0xc]
push edi
call fcn.01c96500
add esp, 0xc
mov word [edi + ebx*2], 0
cmp byte [ebp - 0x14], 0
jns 0x1c437d8
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
jmp 0x1c437db
mov eax, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp - 0x10]
push eax
call fcn.01c3f946
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.01c3eb04
Function at 0x1c437f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov ebx, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x20], eax
cmp byte [ebx + 0xb], 0
mov esi, ebx
jns 0x1c4381c
mov esi, dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c4384a
test al, 0x10
jne 0x1c4393b
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.01c43989
add esp, 0xc
xor ebx, ebx
jmp 0x1c43974
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 0xb]
mov ecx, ebx
test al, al
jns 0x1c43867
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
add eax, eax
test eax, eax
je 0x1c438be
movzx edx, word [ecx + eax - 2]
add eax, 0xfffffffe
cmp dx, 0x5c
je 0x1c43881
cmp dx, 0x2f
jne 0x1c43869
cmp eax, 0xfffffffe
je 0x1c438be
sar eax, 1
lea edx, [ebx + 0xc]
lea edi, [esp + 4]
mov ecx, edi
push edx
push eax
push 0
push ebx
call fcn.01c3f514
movsd xmm0, qword [edi]
lea eax, [esp + 0x10]
movsd qword [eax], xmm0
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
push eax
call fcn.01c437f8
add esp, 4
test al, al
je 0x1c43952
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c43961
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1c4392a
mov dword [esp], eax
lea edi, [esp + 4]
mov ecx, edi
push esi
call fcn.01c3be7a
cmp byte [edi + 0xb], 0
jns 0x1c438f7
mov edi, dword [esp + 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
cmp byte [esp + 0xf], 0
jns 0x1c43923
push dword [esp + 4]
mov edi, eax
call fcn.01c92abc
mov eax, edi
add esp, 4
test al, al
mov eax, dword [esp]
jne 0x1c43961
push eax
push esi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.01c43989
add esp, 0xc
jmp 0x1c4395f
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_exists___n
call fcn.01c43989
add esp, 0xc
mov bl, 1
jmp 0x1c43974
push str.Failed_to_create_one_of_the_parent_directories
call fcn.01c43989
add esp, 4
xor ebx, ebx
cmp byte [esp + 0x1b], 0
jns 0x1c43974
push dword [esp + 0x10]
call fcn.01c92abc
add esp, 4
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c43989
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01c23c17
mov ebx, 0x1cf50d0
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01c9812e
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c43ff1
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x216]
push 0x206
push 0xff
push eax
call fcn.01c97000
add esp, 0xc
mov edi, 0xfffffff4
lea ebx, [ebp - 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [edi + str.PROGRAMW6432]
mov word [ebp - 0x218], 0
push 0x104
push ebx
push eax
call esi
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c44065
push dword [ebp + 8]
push eax
push ebx
call fcn.01c43f85
add esp, 0xc
test al, al
jne 0x1c4406e
add edi, 4
jne 0x1c44031
xor ebx, ebx
jmp 0x1c44070
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c445f6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1cf58d0]
test eax, eax
jne 0x1c446da
mov edi, 0xc
push edi
call fcn.01c92a8c
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1cf58d0], eax
push edi
call fcn.01c92a8c
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1cf58d4], eax
call fcn.01c42e00
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push str.user_data_dir
call fcn.01c3be7a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.01c3be7a
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.01c43006
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.01c4421c
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x1c446ad
push dword [ebp - 0x1c]
call fcn.01c92abc
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x1c446be
push dword [ebp - 0x34]
call fcn.01c92abc
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1c446cf
push dword [ebp - 0x28]
call fcn.01c92abc
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x1c446fb
mov eax, dword [0x1cf58d0]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.01c3f5d4
mov bl, 1
test esi, esi
je 0x1c446fd
mov ecx, esi
push dword [0x1cf58d4]
call fcn.01c3f5d4
jmp 0x1c446fd
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c44f80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
cmp ebx, 0x7ffffff0
jae 0x1c450e9
cmp ebx, 5
jae 0x1c44fc0
mov byte [esi + 0xb], bl
mov eax, esi
test ebx, ebx
jne 0x1c44fe0
jmp 0x1c450d0
lea edi, [ebx + 8]
and edi, 0xfffffff8
lea eax, [edi + edi]
push eax
call fcn.01c92a8c
add esp, 4
mov dword [esi], eax
or edi, 0x80000000
mov dword [esi + 8], edi
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 0xc]
cmp ebx, 0x10
jae 0x1c44fef
mov edx, ecx
jmp 0x1c450b4
mov edx, ebx
and edx, 0xfffffff0
lea edi, [edx - 0x10]
mov ebx, edi
shr ebx, 4
add ebx, 1
test edi, edi
mov dword [ebp - 0x10], ebx
je 0x1c450df
and ebx, 0xfffffffe
neg ebx
xor edi, edi
nop word cs:[eax + eax]
nop dword [eax + eax]
movq xmm0, qword [ecx + edi]
punpcklbw xmm0, xmm0
movq xmm1, qword [ecx + edi + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [eax + edi*2], xmm0
movdqu xmmword [eax + edi*2 + 0x10], xmm1
movq xmm0, qword [ecx + edi + 0x10]
punpcklbw xmm0, xmm0
movq xmm1, qword [ecx + edi + 0x18]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [eax + edi*2 + 0x20], xmm0
movdqu xmmword [eax + edi*2 + 0x30], xmm1
add edi, 0x20
add ebx, 2
jne 0x1c45020
test byte [ebp - 0x10], 1
je 0x1c450a8
movq xmm0, qword [ecx + edi]
movq xmm1, qword [ecx + edi + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [eax + edi*2], xmm0
movdqu xmmword [eax + edi*2 + 0x10], xmm1
lea eax, [eax + edx*2]
mov ebx, dword [ebp + 0x10]
cmp edx, ebx
je 0x1c450d0
add edx, ecx
add ecx, ebx
nop word cs:[eax + eax]
movsx edi, byte [edx]
mov word [eax], di
add edx, 1
add eax, 2
cmp ecx, edx
jne 0x1c450c0
mov word [eax], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
test byte [ebp - 0x10], 1
jne 0x1c45080
jmp 0x1c450a8
mov ecx, esi
call fcn.01c3eb04

Function at 0x1c450f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1c45142
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x1c4512c
call fcn.01c4fdb0
push dword [esi]
call fcn.01c4fdc0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1c4513b
mov dword [esi], ebx
call fcn.01c4fdb0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x1c45159
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
Function at 0x1c4ac66
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push str.LOCALAPPDATA
push esi
call fcn.01c4334a
add esp, 8
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c4aca0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1c4acd3
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov edi, dword [ebp - 0x14]
mov dword [esi + 8], edi
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movzx eax, byte [esi + 0xb]
test al, al
js 0x1c4ad2a
mov ecx, esi
jmp 0x1c4ad2f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1c4ad70
mov edi, eax
inc edi
mov ecx, esi
push 0
push edi
call fcn.01c3f678
cmp byte [ebp - 0x11], 0
jns 0x1c4acfb
mov esi, dword [ebp - 0x1c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1c4ad95
movzx ecx, byte [ebp - 0x11]
test cl, cl
jns 0x1c4ad16
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jae 0x1c4ad95
lea ecx, [ebp - 0x1c]
push 0
push eax
call fcn.01c3f678
jmp 0x1c4aca4
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 0xc]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x1c4ad43
mov ecx, esi
push 0x5c
call fcn.01c3fc12
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c4ad50
mov eax, dword [edi + 4]
mov edi, dword [edi]
mov ecx, esi
push eax
push edi
call fcn.01c3f946
mov ecx, esi
push 0x5c
call fcn.01c3fc12
mov ecx, esi
push str.User_Data
call fcn.01c3fb06
mov bl, 1
cmp byte [ebp - 0x11], 0
jns 0x1c4ad81
push dword [ebp - 0x1c]
call fcn.01c92abc
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x1c4ad70
Function at 0x1c4c7c2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x38], eax
cmp dword [0x1cf5998], 0
jne 0x1c4c993
push 0x64
call fcn.01c92a8c
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.01c4add2
mov dword [0x1cf5998], esi
mov ecx, esi
call fcn.01c4aed2
test al, al
je 0x1c4c993
xor eax, eax
dec eax
lea ebx, [esp + 0x2c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea esi, [esp + 0x20]
mov ecx, esi
push str.type
call fcn.01c3be7a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [esp + 0x10]
mov ecx, edi
push eax
call fcn.01c3be7a
push esi
push edi
push ebx
call fcn.01c43006
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1c4c85c
push dword [esp + 0x10]
call fcn.01c92abc
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x1c4c86f
push dword [esp + 0x20]
call fcn.01c92abc
add esp, 4
push 0x1cc1cbc
call fcn.01caafe4
add esp, 4
movzx ecx, byte [esp + 0x37]
test cl, cl
jns 0x1c4c889
mov ecx, dword [esp + 0x30]
cmp eax, ecx
jne 0x1c4c8a8
lea ecx, [esp + 0x2c]
push eax
push 0x1cc1cbc
push 0xffffffffffffffff
push 0
call fcn.01c4018a
test eax, eax
je 0x1c4c980
push dword [0x1cf5998]
call fcn.01c27314
add esp, 4
mov ecx, dword [0x1cf5998]
movzx eax, byte [ecx + 0x63]
test al, al
jns 0x1c4c8c7
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x1c4c90c
push ebx
push esi
call fcn.01c431ef
add esp, 8
movzx eax, byte [esp + 0x37]
test al, al
jns 0x1c4c8e2
mov eax, dword [esp + 0x30]
xor ecx, ecx
test eax, eax
sete cl
push esi
push ecx
call fcn.01c45b94
add esp, 8
cmp byte [esp + 0x2b], 0
jns 0x1c4c980
push dword [esp + 0x20]
call fcn.01c92abc
add esp, 4
jmp 0x1c4c980
mov ecx, esi
call fcn.01c59230
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 4]
push ebx
mov ebx, eax
push eax
call fcn.01c431ef
add esp, 8
movzx eax, byte [esp + 0x37]
test al, al
jns 0x1c4c93e
mov eax, dword [esp + 0x30]
xor ecx, ecx
test eax, eax
sete cl
push esi
push edi
push ebx
push ecx
call fcn.01c45de2
add esp, 0x10
cmp byte [esp + 0xf], 0
jns 0x1c4c964
push dword [esp + 4]
call fcn.01c92abc
add esp, 4
cmp byte [esp + 0x1b], 0
jns 0x1c4c977
push dword [esp + 0x10]
call fcn.01c92abc
add esp, 4
lea ecx, [esp + 0x20]
call fcn.01c59350
cmp byte [esp + 0x37], 0
jns 0x1c4c993
push dword [esp + 0x2c]
call fcn.01c92abc
add esp, 4
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.01c92b01
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c4d75a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1c4d83d
mov ebx, ecx
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x1c4d83d
cmp word [eax + edx + 0x14], 0x68
jb 0x1c4d83d
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x1c4d83d
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x1c4d7b4
mov word [edi], ax
jmp 0x1c4d86a
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x1c4d83d
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
lea esi, [edx + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
mov ebx, edx
mov edi, esi
sub edi, ebx
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push dword [ebx + edi*2]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x1c4d817
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x1c4d819
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1c4d80b
xor ecx, ecx
lea edi, [ebx + edi*2]
movzx ecx, cl
movzx eax, byte [eax]
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [edi + 4]
cmovg ebx, edx
cmovle esi, edi
cmp ecx, eax
je 0x1c4d849
xor eax, eax
cmp ebx, esi
jne 0x1c4d7e3
jmp 0x1c4d83f
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call dword [eax + 4]
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov al, 1
jmp 0x1c4d83f
Function at 0x1c50390
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x1cf59c8]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x1c50514
jp 0x1c50514
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1cf59d8]
mov ecx, dword [0x1cf5970]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c50539
mov eax, dword [0x1cf59e8]
mov ecx, dword [0x1cf5970]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c50572
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea esi, [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x1cf59e0]
sbb ebx, dword [0x1cf59e4]
movd xmm0, ebx
movd xmm1, edi
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x1cbd4c0]
subpd xmm1, xmmword [0x1cbd4d0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
divsd xmm0, qword [esp + 0x20]
xorpd xmm1, xmm1
movsd xmm2, qword [0x1cc2cc0]
ucomisd xmm2, xmm0
ja 0x1c50514
mov eax, dword [esp + 8]
sub eax, dword [0x1cf59d0]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x1cf59d4]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x1cbd4c0]
subpd xmm2, xmmword [0x1cbd4d0]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x1cf59c8], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.01c92b01
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1cf59d8
call fcn.01c92b47
add esp, 4
cmp dword [0x1cf59d8], 0xffffffff
jne 0x1c50402
rdtsc
mov dword [0x1cf59d0], eax
mov dword [0x1cf59d4], edx
push 0x1cf59d8
call fcn.01c92bbd
add esp, 4
jmp 0x1c50402
push 0x1cf59e8
call fcn.01c92b47
add esp, 4
cmp dword [0x1cf59e8], 0xffffffff
jne 0x1c50423
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x1cf59e4], ecx
mov dword [0x1cf59e0], eax
push 0x1cf59e8
call fcn.01c92bbd
add esp, 4
jmp 0x1c50423
Function at 0x1c56b60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x1c56bcd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c56ba0
cmp edx, 1
jne 0x1c56bd6
jmp 0x1c56bf2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x1c56bf2
cmp edx, 2
je 0x1c56be9
cmp edx, 3
jne 0x1c56bfd
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x1c56d58
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov edx, edi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x1c56c64
lea edx, [edi - 1]
and edx, ebx
jmp 0x1c56c70
mov edx, ebx
cmp ebx, edi
jb 0x1c56c70
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1c56d58
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x1c56d58
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x1c56cc6
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x1c56d56
mov ebx, dword [ebx]
test ebx, ebx
je 0x1c56d56
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
jne 0x1c56d20
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x1c56cdb
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x1c56cbc
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x1c56d38
cmp dword [ebp - 0x10], 0
je 0x1c56d52
cmp byte [esi], dl
jne 0x1c56cbc
add eax, 0xffffffff
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x1c56d52
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x1c56d00
jmp 0x1c56cbc
cmp dword [ebp - 0x28], 1
jbe 0x1c56cb0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x1c56cb3
xor edx, edx
div ecx
mov eax, edx
jmp 0x1c56cb3
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1c56d52
push eax
push esi
push ecx
call fcn.01c955ed
add esp, 0xc
test eax, eax
jne 0x1c56cbc
mov ecx, ebx
jmp 0x1c56d58
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8