joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c5bd60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
lea edi, [ebp - 0x10]
push edi
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1c5bdb7
push str.0.0.0.0
push 0x80
push 0x1d09328
call fcn.01cce753
add esp, 0xc
mov word [0x1d09426], 0
jmp 0x1c5be32
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100
lea eax, [ebp - 0x14]
push eax
push 0x1d09328
push edi
push 0
push str.CurrentVersion
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c5be07
mov eax, dword [ebp - 0x10]
add eax, 0xffffffff
cmp eax, 1
ja 0x1c5be07
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1c5be48
test al, 1
jne 0x1c5be07
and eax, 0xfffffffe
cmp word [eax + 0x1d09326], 0
je 0x1c5be1e
push str.0.0.0.0
push 0x80
push 0x1d09328
call fcn.01cce753
add esp, 0xc
mov word [0x1d09426], 0
test esi, esi
je 0x1c5be32
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01cb3141
mov eax, 0x1d09328
add esp, 0xc
pop esi
pop edi
pop ebp
ret
mov word [0x1d09328], 0
jmp 0x1c5be1e

Function at 0x1c5be60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp word [0x1d08d18], 0
jne 0x1c5bf1c
mov dword [ebp - 0x10], 0
lea edi, [ebp - 0x10]
push edi
push 1
push 0
push str.Software360SecureBrowserChrome
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1c5bea7
xor esi, esi
jmp 0x1c5beee
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100
lea eax, [ebp - 0x14]
push eax
push 0x1d08d18
push edi
push 0
push 0x1ce8020
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c5beee
mov eax, dword [ebp - 0x10]
add eax, 0xffffffff
cmp eax, 1
ja 0x1c5beee
cmp dword [ebp - 0x14], 0
jne 0x1c5beee
mov word [0x1d08d18], 0
cmp word [0x1d08d18], 0
jne 0x1c5bf11
push str.360sehw
push 0x1ce7f90
push 0x7f
push 0x1d08d18
call fcn.01c41620
add esp, 0x10
test esi, esi
je 0x1c5bf1c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01cb3141
mov eax, 0x1d08d18
add esp, 0xc
pop esi
pop edi
pop ebp
ret
Function at 0x1c5c190
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp word [0x1d08f18], 0
jne 0x1c5c1d6
push 0
push 0x26
push 0x1d08f18
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.internet_exploreriexplore.exe
push 0x1d08f18
call fcn.01cce66d
add esp, 8
push edi
push esi
push 0x1d08f18
call fcn.01c5c240
add esp, 0xc
mov ebx, 1
test eax, eax
jne 0x1c5c222
mov dword [ebp - 0x14], 4
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x14]
push eax
push esi
push ecx
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ebx, ebx
test eax, eax
jne 0x1c5c222
xor ebx, ebx
cmp word [esi], 0
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c5c240
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x4010
call fcn.01cb35d0
mov ebx, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x4010]
push 0x4000
push 0
push edi
call fcn.01cb76e0
add esp, 0xc
mov dword [ebp - 0x4014], 0xffffffff
lea eax, [ebp - 0x4014]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea ecx, [eax - 1]
xor esi, esi
cmp ecx, 0x3ffe
ja 0x1c5c313
push edi
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1c5c313
mov dword [ebp - 0x4018], 0xffffffff
mov dword [ebp - 0x401c], 0xffffffff
lea eax, [ebp - 0x401c]
lea ecx, [ebp - 0x4018]
push eax
push ecx
push 0x1ce3b8e
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1c5c313
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x4018]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
movzx edx, ax
shr eax, 0x10
movzx edi, cx
shr ecx, 0x10
mov ebx, dword [ebp + 0xc]
push edx
push eax
push edi
push ecx
push str._d._d._d._d
push esi
push ebx
call fcn.01c41620
add esp, 0x1c
mov word [ebx + esi*2 - 2], 0
mov esi, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, esi
add esp, 0x4010
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c5c730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
lea edi, [ebp - 0x14]
push edi
push 1
push 0
push str.Software360ChromeChrome
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1c5c7d7
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push eax
push ecx
push 0
push str.noexperience
push esi
call ebx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x20]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.fulldump
push esi
call ebx
cmp dword [ebp - 0x20], 0
je 0x1c5c7cc
mov byte [0x1d085d8], 1
test esi, esi
je 0x1c5c7d7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1c], 1
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c5c800
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
call fcn.01c5c730
test al, al
je 0x1c5c86c
mov edi, dword [ebp + 8]
call fcn.01c5c870
sub esp, 4
call fcn.01c5caf0
add esp, 4
call fcn.01c5da20
mov esi, eax
push edi
call fcn.01c5df40
add esp, 4
test esi, esi
je 0x1c5c83a
call fcn.01c5e940
mov eax, dword [0x1d085bc]
test eax, eax
je 0x1c5c85b
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x1d085bc], 0
call fcn.01c5ba80
add eax, 0x5d120
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop edi
pop ebp
ret
Function at 0x1c5c870
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1470
call fcn.01cb35d0
mov esi, esp
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esi + 0x1468], eax
cmp byte [0x1d05f00], 0
jne 0x1c5ca8f
lea eax, [esi + 0x420]
push 0x1048
push 0
push eax
call fcn.01cb76e0
add esp, 0xc
mov eax, dword [0x1d085b0]
mov ecx, dword [0x1d04a8c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c5caa4
mov eax, 0x1d085a4
cmp byte [0x1d085af], 0
jns 0x1c5c8ed
mov eax, dword [0x1d085a4]
test eax, eax
je 0x1c5c94b
mov dword [esi + 0xc], eax
push eax
call fcn.01ccdb20
add esp, 4
xor ebx, ebx
cmp eax, 0x3ffffffe
jg 0x1c5c94d
mov edi, eax
add edi, 1
lea ecx, [edi + edi]
lea eax, [edi + edi]
add eax, 3
and eax, 0xfffffffc
call fcn.01cb35d0
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push ecx
push 0xff
push ebx
call fcn.01cb76e0
add esp, 0xc
mov word [ebx], 0
push edi
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove ebx, eax
jmp 0x1c5c94d
xor ebx, ebx
push 0x1d0776c
push ebx
push 0x1d07564
push 0x1d07154
push 0x1d06f4c
push 0x1d06d44
push 0x1d06b3c
push 0x1d06934
push 0x1d0672c
push 0x1d0631c
push 0x1d05f0c
push 0
push 0
push 0x1d0631c
push 0x1d07564
push str.http:__browser.360totalsecurity.com_dd_static_a_1457.191.gif__pdt360SecureBrowserbq_dim_kpid__guid__ver_dim_v360SecureBrowser___s___sm_dmts_diname_sifver_simod_simodver_sicode_sioff_sios_siie_smid_spt_spid_s
push 0x823
lea eax, [esi + 0x420]
push eax
call fcn.01c41620
add esp, 0x48
call fcn.01c5ba80
mov edi, eax
mov ecx, eax
call fcn.01c78880
lea ebx, [edi + 0x5d530]
push 0x1048
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
lea eax, [esi + 0x420]
push eax
push 0x1ce7f90
push 0x823
push ebx
call fcn.01c5f7e0
add esp, 0x10
lea ebx, [esi + 0x218]
push 0x208
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
lea eax, [esi + 0x10]
push 0x208
push 0
push eax
call fcn.01cb76e0
add esp, 0xc
push ebx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esi + 0x10]
push ecx
push eax
push 0x1ce8460
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ebx, [edi + 0x5d120]
push 0x208
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
lea eax, [esi + 0x10]
push eax
push 0x1ce7f90
push 0x103
push ebx
call fcn.01c5f840
add esp, 0x10
mov dword [edi + 0x2468], 1
mov dword [edi + 0x26a8], 0x1388
mov ecx, edi
call fcn.01c785c0
mov ecx, edi
push 0x1f40
call fcn.01c78a20
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x1468]
xor ecx, ebp
call fcn.01cb3141
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d085b0
call fcn.01cb3187
add esp, 4
cmp dword [0x1d085b0], 0xffffffff
jne 0x1c5c8d6
mov dword [0x1d085a8], 0
mov dword [0x1d085a4], 0
mov dword [0x1d085ac], 0
push 0x1d085b0
call fcn.01cb31fd
add esp, 4
jmp 0x1c5c8d6
Function at 0x1c5e940
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x630
mov esi, esp
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esi + 0x628], eax
mov dword [esi + 0xc], 0
lea eax, [esi + 0xc]
push eax
call fcn.01c5ed70
add esp, 4
mov dword [0x1d085bc], eax
test eax, eax
je 0x1c5eb17
lea edi, [esi + 0x420]
push 0x208
push 0
push edi
call fcn.01cb76e0
add esp, 0xc
push edi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esi + 0x218]
push 0x208
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push eax
push 0x1ce82cc
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call fcn.01c5ba80
mov edi, eax
mov ecx, eax
call fcn.01c78880
lea ebx, [edi + 0x5d530]
push 0x1048
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
push str.http:__browser.360totalsecurity.com_interface_dumpinfo_
push 0x1ce7f90
push 0x823
push ebx
call fcn.01c5f7e0
add esp, 0x10
lea ebx, [edi + 0x5d120]
push 0x208
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
lea eax, [esi + 0x218]
push eax
push 0x1ce7f90
push 0x103
push ebx
call fcn.01c5f840
add esp, 0x10
mov dword [edi + 0x26a8], 0x2710
lea eax, [esi + 0x10]
push 0x208
push 0
push eax
call fcn.01cb76e0
add esp, 0xc
sub esp, 0x54
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
mov dword [ebx + 0x50], 0xffffffff
mov word [ebx], 0
push 0x2a
push ebx
push 0xffffffffffffffff
push str.___________________________7d9114302a0cb6
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove ebx, eax
push ebx
push str.multipart_form_data__boundary_s
push 0x103
lea eax, [esi + 0x10]
push eax
call fcn.01c41620
add esp, 0x10
mov eax, dword [esi + 0xc]
mov ecx, dword [0x1d085bc]
mov dword [edi + 0x2480], ecx
mov dword [edi + 0x2484], eax
lea ebx, [edi + 0x2488]
push 0x208
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
lea eax, [esi + 0x10]
push eax
push 0x1ce7f90
push 0x103
push ebx
call fcn.01c5f840
add esp, 0x10
mov ecx, edi
call fcn.01c785c0
mov ecx, edi
push 0x2ee0
call fcn.01c78a20
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x628]
xor ecx, ebp
call fcn.01cb3141
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c5eba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x830
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x834]
push 0x824
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
cmp dword [ebp + 0x18], 0
je 0x1c5eca5
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push dword [ebp + 0x10]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
push 0x823
push ebx
call fcn.01c5ed10
add esp, 0x18
push ebx
call fcn.01ccdb20
add esp, 4
mov edi, eax
push 0x1ce066f
push esi
call fcn.01cc9f37
add esp, 8
test eax, eax
je 0x1c5ece5
mov esi, eax
push 2
push 0
push eax
call fcn.01ccbb8d
add esp, 0xc
push esi
call fcn.01ccbe64
add esp, 4
mov ebx, eax
push 0
push 0
push esi
call fcn.01ccbb8d
add esp, 0xc
lea edx, [edi + ebx]
add edx, 2
xor eax, eax
mov ecx, dword [ebp + 0xc]
cmp edx, dword [ecx]
jae 0x1c5ec95
mov dword [ebp - 0x838], edi
push edi
lea eax, [ebp - 0x834]
push eax
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x83c], edx
call fcn.01cb6be0
add esp, 0xc
add edi, dword [ebp - 0x838]
push esi
push 1
push ebx
push edi
call fcn.01ccb98a
add esp, 0x10
mov word [ebx + edi], 0xa0d
mov eax, dword [ebp - 0x83c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call fcn.01ccb3a0
add esp, 4
jmp 0x1c5ecee
push esi
push dword [ebp + 0x10]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
push 0x823
push ebx
call fcn.01c5ed10
add esp, 0x18
push ebx
call fcn.01ccdb20
add esp, 4
mov esi, eax
xor eax, eax
cmp esi, dword [edi]
jae 0x1c5ece1
push esi
push ebx
push dword [ebp + 8]
call fcn.01cb6be0
add esp, 0xc
mov eax, esi
mov dword [edi], eax
jmp 0x1c5ecee
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
add esp, 0x830
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c5f160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esp + 0x98], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push edi
call fcn.01c5f480
add esp, 8
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, ebx
neg ecx
sbb eax, edx
jge 0x1c5f331
mov dword [esp + 0x10], edx
push ebx
call fcn.01cb3133
add esp, 4
mov dword [esp + 8], eax
cmp byte [edi + 0xb], 0
jns 0x1c5f1d0
mov edi, dword [edi]
sub esp, 0x1c
movdqa xmm0, xmmword [0x1ce7f80]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x1c5f34e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x1c5f347
mov esi, eax
call fcn.01c4c750
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push 0
push eax
push ebx
push dword [esp + 0x14]
mov dword [esp + 0x1c], edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esp + 0x14]
mov ecx, esi
sar ecx, 0x1f
xor ebx, esi
mov edx, dword [esp + 0x10]
xor edx, ecx
xor edi, edi
or edx, ebx
cmovne esi, edi
test eax, eax
cmove esi, eax
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x7c], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea eax, [esp + 0x30]
push eax
call fcn.01c7ec70
add esp, 4
test esi, esi
jle 0x1c5f2d8
nop word cs:[eax + eax]
mov eax, dword [esp + 8]
add eax, edi
mov dword [esp + 0x20], eax
mov ebx, esi
sub ebx, edi
cmp ebx, 0x1001
mov eax, 0x1001
cmovge ebx, eax
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.01c7ec80
add esp, 8
add edi, ebx
cmp esi, edi
jg 0x1c5f2a0
mov eax, dword [ebp + 0x10]
mov edx, eax
movzx eax, byte [eax + 0xb]
test al, al
mov ecx, dword [edx]
cmovns ecx, edx
mov dword [esp + 0x20], ecx
cmovs eax, dword [edx + 4]
mov dword [esp + 0x24], eax
lea esi, [esp + 0x20]
push esi
lea edi, [esp + 0x34]
push edi
call fcn.01c7ec80
add esp, 8
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x20], xmm0
push edi
push esi
call fcn.01c7eca0
add esp, 8
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.01c7ecb0
add esp, 8
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
jmp 0x1c5f368
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
jmp 0x1c5f37d
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
xor ebx, ebx
mov edi, dword [esp + 8]
lea eax, [ebx + 1]
cmp eax, 2
jae 0x1c5f395
test edi, edi
je 0x1c5f37d
push edi
call fcn.01cb313c
add esp, 4
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.01cb3141
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01c4c750
push ebx
call fcn.01c4c760
add esp, 4
test edi, edi
jne 0x1c5f374
jmp 0x1c5f37d
Function at 0x1c5f3b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10004
call fcn.01cb35d0
mov esi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
call fcn.01c595f0
test al, al
je 0x1c5f3df
xor ebx, ebx
jmp 0x1c5f462
cmp byte [esi + 0xb], 0
jns 0x1c5f3e7
mov esi, dword [esi]
push 0x40
push 0x1ce11c8
push esi
call fcn.01cc9f2c
add esp, 0xc
mov esi, eax
test eax, eax
je 0x1c5f45d
lea ebx, [ebp - 0x10010]
push 0x10000
push 0xff
push ebx
call fcn.01cb76e0
add esp, 0xc
push esi
push 0x10000
push 1
push ebx
call fcn.01ccb98a
add esp, 0x10
test eax, eax
je 0x1c5f454
mov edi, dword [ebp + 0xc]
jmp 0x1c5f445
push esi
push 0x10000
push 1
push ebx
call fcn.01ccb98a
add esp, 0x10
test eax, eax
je 0x1c5f454
test edi, edi
je 0x1c5f430
mov ecx, edi
push eax
push ebx
call fcn.01c4028c
jmp 0x1c5f430
push esi
call fcn.01ccb3a0
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0x10004
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c5f620
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x10], 0x40
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov eax, dword [0x1d04a8c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ebx, dword [esp + 0x20]
mov ecx, dword [0x1d05f08]
cmp ecx, dword [eax + 4]
jg 0x1c5f6e0
mov eax, edi
sub eax, ebx
mov ecx, esi
sbb ecx, edx
shld ecx, eax, 0xc
shld esi, edi, 0xc
mov dword [0x1d08bf4], 0
mov dword [0x1d08bf8], ecx
mov dword [0x1d08bfc], esi
mov dword [0x1d08c00], 0
mov dword [0x1d08c0c], 0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01cb3141
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d05f08
mov dword [esp + 0x10], edx
call fcn.01cb3187
mov edx, dword [esp + 0x10]
add esp, 4
cmp dword [0x1d05f08], 0xffffffff
jne 0x1c5f693
mov dword [0x1d05f04], 0x1ce6084
push 0x1d085c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1d05f08
call fcn.01cb31fd
mov edx, dword [esp + 0x10]
add esp, 4
jmp 0x1c5f693
Function at 0x1c66b90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.01cb35d0
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d02190]
cmp eax, 0xffffffff
je 0x1c66cee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x1c66cee
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.01cb6be0
add esp, 0xc
mov ecx, dword [0x1d02190]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.01c8bd00
add esp, 8
test ebx, ebx
je 0x1c66c0b
push ebx
call fcn.01cb313c
add esp, 4
mov eax, dword [0x1d0a40c]
mov ecx, dword [0x1d04a8c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c66d0f
mov esi, dword [0x1d0a408]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c66d03
lea eax, [ebp - 0x1410]
push 0xc00
push 0x1d09808
push eax
call fcn.01cb6be0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov esi, 0x100
test al, al
je 0x1c66cde
nop dword [eax]
xor edi, edi
lea ebx, [ebp - 0x1408]
xor eax, eax
jmp 0x1c66c8e
add edi, 1
add ebx, 0xc
cmp edi, 0x100
je 0x1c66cd0
mov ecx, dword [ebp + edi*8 - 0x810]
test ecx, ecx
je 0x1c66c80
cmp dword [ebx - 8], 0
je 0x1c66c80
mov edx, dword [ebp + edi*8 - 0x80c]
cmp edx, dword [ebx]
jne 0x1c66c80
mov edx, dword [ebx - 4]
test edx, edx
je 0x1c66c80
mov dword [ebp + edi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x1c66c80
cmp esi, 2
jb 0x1c66cde
add esi, 0xffffffff
and al, 1
test al, al
jne 0x1c66c70
push 2
push dword [ebp - 0x1414]
call fcn.01c8bd00
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.01c63850
jmp 0x1c66c41
push 0x1d0a40c
call fcn.01cb3187
add esp, 4
cmp dword [0x1d0a40c], 0xffffffff
jne 0x1c66c2c
push 4
call fcn.01cb30d6
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.01c63840
mov dword [0x1d0a408], esi
push 0x1d0a40c
call fcn.01cb31fd
add esp, 4
jmp 0x1c66c2c

Function at 0x1c66d60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d02190]
cmp eax, 0xffffffff
je 0x1c66d82
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret