joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1cb4dc7
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.01cb025a
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.01cb025a
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1cb4e3e
cmp word [ecx], dx
je 0x1cb4e3e
mov eax, dword [0x1cdc54c]
push edi
dec eax
push eax
push 0x1cdc438
call fcn.01cb4fb7
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1cb4eb1
cmp word [eax], dx
je 0x1cb4eb1
mov eax, dword [edi]
test eax, eax
je 0x1cb4e62
cmp word [eax], dx
je 0x1cb4e62
lea eax, [ebp - 0x10]
push eax
call fcn.01cb5018
jmp 0x1cb4e6b
lea eax, [ebp - 0x10]
push eax
call fcn.01cb5313
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1cb4edb
mov eax, dword [0x1cdc434]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1cdc128
call fcn.01cb4fb7
add esp, 0xc
test al, al
je 0x1cb4edb
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1cb4ea6
cmp word [eax], di
je 0x1cb4ea6
lea eax, [ebp - 0x10]
push eax
call fcn.01cb5018
pop ecx
jmp 0x1cb4edd
lea eax, [ebp - 0x10]
push eax
call fcn.01cb5313
jmp 0x1cb4ea3
mov eax, dword [edi]
test eax, eax
je 0x1cb4ec8
cmp word [eax], dx
je 0x1cb4ec8
lea eax, [ebp - 0x10]
push eax
call fcn.01cb5455
pop ecx
jmp 0x1cb4edb
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1cb4fa6
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.01cb5547
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1cb4fa6
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1cb4fa6
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1cb4fa6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1cb4f33
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.01cb0d4c
test ebx, ebx
je 0x1cb4fa1
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.01cb0d4c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1cb4fa6
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1cb4fa6
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.01cbcc26
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1cb4fa8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01c98173
leave
ret
Function at 0x1cb564d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.01cb025a
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1cb56bc
cmp esi, dword [ebp - 4]
je 0x1cb56b7
cmp dword [ebp + 0xc], 0
je 0x1cb56b7
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1cb5694
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.01cb5716
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1cb56be
xor eax, eax
inc eax
jmp 0x1cb56be
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1cb6b06
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1cb6ba3
push ebx
push esi
call fcn.01cb6bf4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.01cb6a0a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1cb6b50
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1cb6ba2
push edi
push eax
call fcn.01c68ed0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1cb6b70
call fcn.01c93ce0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1cb6ba1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.01cb6a0a
add esp, 0x20
test eax, eax
jne 0x1cb6b8f
push edi
call fcn.01c93ce0
jmp 0x1cb6b97
push ebx
call fcn.01c93ce0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1cb6ba6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1cb6bb7
pop esi
ret
push ebx
push edi
push esi
call fcn.01cb6bf4
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.01c68ed0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1cb6bdf
push ebx
push esi
push edi
call fcn.01c994a0
add esp, 0xc
push 0
call fcn.01c93ce0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1cb6c2b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cb6c36

Function at 0x1cb8d60
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x1cb8da3
call fcn.01ca6a97
mov dword [eax], 0xf
call fcn.01c968ab
mov dword [eax], 0xd
call fcn.01cb1cb2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01c98173
leave
ret
test eax, eax
jne 0x1cb8daa
inc eax
jmp 0x1cb8d97
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x1cb8d95
xor eax, eax
cmp ecx, 1
setne al
jmp 0x1cb8d97

Function at 0x1cc02c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x1cd1210
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret
Function at 0x1cd1d90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x1cf3040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov edi, 0x57
test eax, eax
je 0x1cd1dd5
cmp eax, 0xffffffff
je 0x1cd1dd5
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1cd1dd5
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1cd1dd5
cmp dword [ebp + 0x14], 0
je 0x1cd1dd5
mov edi, 0x20
cmp dword [esi], 0
je 0x1cd1deb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, edi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
cmp dword [esi + 4], 0
jne 0x1cd1dd5
cmp dword [esi + 8], 0
jne 0x1cd1dd5
mov dword [ebp - 0x20], method.std::__Cr::locale::facet.virtual_0
mov dword [ebp - 0x1c], eax
movzx edx, word [eax]
cmp edx, 0x5a4d
jne 0x1cd1e31
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
jne 0x1cd1e31
movzx edi, word [eax + edx + 0x14]
cmp edi, 0xe0
jne 0x1cd1e31
movzx eax, word [eax + edx + 0x18]
cmp eax, 0x10b
je 0x1cd1e38
mov edi, 0x57
jmp 0x1cd1dd5
lea edi, [ebp - 0x3c]
mov dword [edi], 0xffffff00
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
lea eax, [esi + 4]
mov ecx, dword [ebp + 0x14]
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], eax
lea eax, [esi + 8]
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], 0x7f
lea eax, [ebp - 0x18]
mov dword [eax], 0x1cd1ec0
mov dword [eax + 4], edi
lea ecx, [ebp - 0x20]
push ebx
push eax
push 0x1c34a70
call fcn.01c34940
cmp byte [edi], 0
jne 0x1cd1e9c
mov dword [ebp - 0x18], 0x1cd1ec0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x20]
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x1c35040
call fcn.01c34d40
mov edi, dword [ebp - 0x24]
test edi, edi
mov eax, dword [ebp + 0x14]
jne 0x1cd1dd5
mov dword [esi], eax
xor edi, edi
jmp 0x1cd1dd5

Function at 0x1cd1f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x57
test ecx, ecx
je 0x1cd1fb5
mov edi, edx
test edx, edx
je 0x1cd1fb5
mov esi, ecx
xorps xmm0, xmm0
lea eax, [ebp - 0x2c]
movups xmmword [eax + 0xc], xmm0
movups xmmword [eax], xmm0
push 0x1c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1cd1fad
test byte [ebp - 0x18], 0xf0
lea ebx, [ebp - 0x30]
mov dword [ebx], 0
mov eax, 4
mov ecx, 0x40
cmove ecx, eax
push ebx
push ecx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1cd1fad
mov eax, dword [edi]
mov dword [esi], eax
push ebx
push dword [ebp - 0x30]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
jmp 0x1cd1fb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1cd24d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x1cf8e2c], 0
je 0x1cd2508
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [0x1cf8e28]
test edi, edi
jne 0x1cd25d6
push 0xc
call fcn.01c9515a
add esp, 4
mov edi, eax
lea esi, [ebp - 0x218]
push 0x208
push 0xff
push esi
call fcn.01c99a20
add esp, 0xc
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
push esi
call fcn.01c66b60
movzx ecx, byte [edi + 0xb]
test cl, cl
mov eax, dword [edi]
mov esi, dword [edi + 4]
mov edx, ecx
mov dword [ebp - 0x21c], esi
cmovs edx, esi
mov esi, edi
mov dword [ebp - 0x220], eax
cmovs esi, eax
test edx, edx
je 0x1cd25c2
add edx, edx
test edx, edx
je 0x1cd25c2
lea eax, [edx - 2]
cmp word [esi + edx - 2], 0x5c
mov edx, eax
jne 0x1cd2583
cmp eax, 0xfffffffe
je 0x1cd25c2
sar eax, 1
lea edx, [eax + 1]
test cl, cl
jns 0x1cd26fc
cmp dword [ebp - 0x21c], eax
jbe 0x1cd271b
mov dword [edi + 4], edx
mov ecx, dword [ebp - 0x220]
mov word [ecx + eax*2 + 2], 0
mov ecx, edi
push 9
push str.debug.log
call fcn.01c67d20
mov dword [0x1cf8e28], edi
cmp byte [edi + 0xb], 0
jns 0x1cd25de
mov edi, dword [edi]
sub esp, 0x1c
movaps xmm0, xmmword [0x1ce3fe0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1cf8e2c], eax
inc eax
cmp eax, 1
ja 0x1cd24f1
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.01c99a20
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x1cd26f5
mov ecx, dword [0x1cf8e28]
push esi
call fcn.01c2a460
mov ecx, dword [0x1cf8e28]
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x1cd270d
mov eax, dword [ecx + 4]
test eax, eax
je 0x1cd2718
mov edx, dword [ecx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x1cd2695
push 1
push 0x1cea91c
call fcn.01c67d20
mov ecx, dword [0x1cf8e28]
push 9
push str.debug.log
call fcn.01c67d20
mov eax, dword [0x1cf8e28]
cmp byte [eax + 0xb], 0
jns 0x1cd26b4
mov eax, dword [eax]
movaps xmm0, xmmword [0x1ce3fe0]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1cf8e2c], eax
inc eax
cmp eax, 1
ja 0x1cd24f1
mov dword [0x1cf8e2c], 0
xor ebx, ebx
jmp 0x1cd24f1
cmp eax, ecx
jae 0x1cd271b
and dl, 0x7f
mov byte [edi + 0xb], dl
mov ecx, edi
jmp 0x1cd25bb
test eax, eax
je 0x1cd2718
mov edx, ecx
jmp 0x1cd2681
int3
int3
Function at 0x1cd47b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
mov esi, dword [0x1cf3040]
xor esi, ebp
mov dword [ebp - 0x10], esi
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebp - 0x20], xmm0
cmp ecx, edx
je 0x1cd47ff
mov edi, dword [ebp + 0xc]
add ecx, 0x10
movdqu xmm0, xmmword [ebp - 0x20]
movdqu xmm1, xmmword [ecx - 0x10]
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
je 0x1cd4816
lea eax, [ecx + 0x58]
add ecx, 0x48
cmp ecx, edx
mov ecx, eax
jne 0x1cd47df
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
lea ebx, [ecx - 0x10]
cmp ebx, edx
je 0x1cd47ff
cmp byte [ecx + 0xb], 0
jns 0x1cd4825
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor esi, esi
inc esi
cmp eax, 0xffffffff
cmovne esi, ecx
test esi, esi
jne 0x1cd4802
mov dword [edi], ebx
xor esi, esi
jmp 0x1cd4802

Function at 0x1cd4980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movdqu xmm0, xmmword [edx]
movdqu xmmword [ebp - 0x20], xmm0
mov ebx, dword [ecx + 0x28]
mov eax, dword [ecx + 0x2c]
cmp ebx, eax
je 0x1cd49cb
mov esi, ecx
mov ecx, dword [ebp + 8]
movdqu xmm0, xmmword [ebp - 0x20]
movdqu xmm1, xmmword [ebx]
pcmpeqb xmm1, xmm0
pmovmskb edx, xmm1
cmp edx, 0xffff
je 0x1cd49e2
add ebx, 0x58
cmp ebx, eax
jne 0x1cd49b0
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
inc edi
cmp ebx, eax
je 0x1cd49ce
mov eax, dword [ebx + 0x50]
cmp eax, ecx
je 0x1cd49fe
xor ecx, ecx
cmp eax, 1
sete cl
lea edi, [ecx + ecx*2]
inc edi
jmp 0x1cd49ce
cmp byte [ebx + 0x1b], 0
js 0x1cd4a09
lea eax, [ebx + 0x10]
jmp 0x1cd4a0c
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1cd49ce
shr eax, 3
and eax, 2
mov edi, eax
jne 0x1cd49ce
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor edi, edi
jmp 0x1cd49ce
Function at 0x1cd60a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.01cd5476
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01cd542b
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.01cd5466
xor esi, dword [esi + 0xd]
push 0x68
add al, 1
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1cd615a
cmp dword [ebp - 0x398], 0
je 0x1cd6324
cmp dword [ebp + 0xc], 1
je 0x1cd6324
cmp dword [ebp + 0xc], 8
jne 0x1cd62ec
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.01cd5476
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01cd542b
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.01cd5466
xchg ecx, eax
lodsb al, byte fs:[esi]
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01cd5642
add esp, 0x14
call fcn.01cd5466
mov word [edi], ss
mov edx, 0x68b5ff77
stc
invalid
call fcn.01cd5466
mov ch, 0x97
push 0xbca58063
cli
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
Function at 0x1cd7460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add ch, byte [eax]
add byte [eax], al
inc eax
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x1cd74b0
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1cd74b5
jmp 0x1cd6e08
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1cd74fc
lea eax, [ebp - 0x714]
push eax
call fcn.01cd5476
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.01cd542b
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1cd7507
jmp 0x1cd750c
jmp 0x1cd6e08

Function at 0x1cd77c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1cd77e3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1cd781e
mov ebx, eax
bt eax, 0xa
jae 0x1cd7816
cmp byte [ebp + 0xc], 0
jne 0x1cd7816
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, 0x10
shr ebx, 4
jmp 0x1cd77ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x80
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cbf530
add esp, 0xc
push edi
push eax
call fcn.01c39f30
add esp, 8
mov ecx, esi
call fcn.01c6d150
jmp 0x1cd77fd

Function at 0x1cd7870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1cd7893
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1cd78be
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x73
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cbf530
add esp, 0xc
push edi
push eax
call fcn.01c39f30
add esp, 8
mov ecx, esi
call fcn.01c6d150
xor ebx, ebx
jmp 0x1cd78a7
Function at 0x1cd7910
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1cd7933
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1cd794b
and eax, 0x410
cmp eax, 0x410
je 0x1cd79c4
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1cd7955
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x1cd7979
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x93
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.01cbf530
add esp, 0xc
push esi
push eax
call fcn.01c39f30
add esp, 8
mov ecx, edi
call fcn.01c6d150
xor ebx, ebx
jmp 0x1cd7962
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov ecx, esi
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01cd79e0

Function at 0x1cd79e0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, ecx
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1cd7a02
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x1cd7a2b
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [ebp - 0xb8]
mov ecx, ebx
push eax
push 2
push 0x2f
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01cd28c0
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.01cbf530
add esp, 0xc
push esi
push eax
call fcn.01c39f30
add esp, 8
mov ecx, ebx
call fcn.01c6d150
jmp 0x1cd7a0f

Function at 0x1cd8820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov eax, esi
sub eax, edx
je 0x1cd8858
js 0x1cd885c
shr eax, 2
movzx edi, byte [edx]
movzx ebx, al
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x1ce4c68]
inc edx
cmp edx, esi
jne 0x1cd8836
cmp eax, dword [ecx + 0xc]
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1cd884d
int3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx