joyce8/EMBER2024-capa huggingface dataset:
Function at 0x536000
Capabilities:
Encode data using xor

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x53600c
pop ebx
sub ebx, 0x8d00c
push 0
pop ecx
push ebx
sub dword [ebx + 0x2dc], 0x5c7d551b
xor dword [ebx + 0x16c], 0x1f6e71d3
xor dword [ebx + 0x78], 0x48c038a0
add dword [ebx + 0x13c], 0x1dba3383
not dword [ebx + 0x1c4]
add dword [ebx + 0x8c], 0xf113dc0
xor dword [ebx + 0x2b4], 0x57292426
add dword [ebx + 0x90], 0x72815eba
add dword [ebx + 0xdc], 0x3f676a03
sub dword [ebx + 0xac], 0x2cf74d38
add dword [ebx + 0xe0], 0x6b69131d
add dword [ebx + 0x29c], 0x2c485d6c
xor dword [ebx + 0xf4], 0x608f0170
sub dword [ebx + 0xbc], 0x210a4531
xor dword [ebx + 0x30c], 0x594b469c
not dword [ebx + 0xa8]
add dword [ebx + 0x228], 0x44c32042
not dword [ebx + 0x28]
not dword [ebx + 0x168]
add dword [ebx + 0x44], 0x4a34433d
not dword [ebx + 0x290]
sub dword [ebx + 0x150], 0x23f9257e
xor dword [ebx + 0x25c], 0x75b06c62
sub dword [ebx + 0x200], 0x315606bb
add dword [ebx + 0x1dc], 0x544d5946
xor dword [ebx + 0x54], 0x48fb5edc
sub dword [ebx + 0x3c8], 0x4b566e4a
xor dword [ebx + 0x284], 0x59a63ad8
not dword [ebx + 0x3d4]
not dword [ebx + 0x12c]
not dword [ebx + 0x138]
add dword [ebx + 0x70], 0x61052e5c
add dword [ebx + 0x308], 0x6d9a177e
not dword [ebx + 0xb4]
not dword [ebx + 0x318]
not dword [ebx + 0x1b8]
add dword [ebx + 0xe8], 0x39d6514c
xor dword [ebx + 0xc0], 0x593a3e75
sub dword [ebx + 0x14], 0x34c7254a
xor dword [ebx + 0x144], 0x4b767c0f
xor dword [ebx + 0x2bc], 0xfe146f3
not dword [ebx + 0x1b4]
not dword [ebx + 0x18]
not dword [ebx + 0xec]
sub dword [ebx + 0x354], 0x511101c
xor dword [ebx + 0x1f4], 0x7c8b0113
add dword [ebx + 0x2e0], 0x4e59037f
xor dword [ebx + 0x204], 0xa74530b
not dword [ebx + 0x3f0]
not dword [ebx + 0x36c]
sub dword [ebx + 0xf0], 0x2e2716d5
add dword [ebx + 0x3a0], 0x7dcd5ad3
sub dword [ebx + 0x124], 0x45c12a3f
not dword [ebx + 0x3f8]
not dword [ebx + 0x7c]
add dword [ebx + 0x3bc], 0x4b5662fc
not dword [ebx + 0x38c]
add dword [ebx + 0x3b4], 0x4716e9b
sub dword [ebx + 0x268], 0x7b5e5ed3
xor dword [ebx + 0x64], 0x79ae5b82
xor dword [ebx + 0x68], 0x21a5808
xor dword [ebx + 0x1ac], 0x1b11c25
not dword [ebx + 0xe4]
xor dword [ebx + 0x238], 0x17d02532
not dword [ebx + 0x158]
not dword [ebx + 0x2d8]
xor dword [ebx + 0x384], 0x6b5c1d99
add dword [ebx + 0x4c], 0x7063f5f
add dword [ebx + 0x328], 0x35035334
xor dword [ebx + 0x114], 0x10564ac8
add dword [ebx + 0x1cc], 0x82f30d6
sub dword [ebx + 0x2a8], 0xa784eff
sub dword [ebx + 0x198], 0xe8654bf
add dword [ebx + 0x50], 0x63ca43fa
add dword [ebx + 0x194], 0x5a675ee3
sub dword [ebx + 0x3a4], 0x6a3c4d34
not dword [ebx + 0x60]
xor dword [ebx + 0x5c], 0xcb362ec
add dword [ebx + 0x3d8], 0x68ea7a5d
not dword [ebx + 0x244]
not dword [ebx + 0x378]
add dword [ebx + 0x154], 0x6cd729aa
add dword [ebx + 0x234], 0x6de47141
xor dword [ebx + 0xd0], 0x409c43f3
not dword [ebx + 0x2b8]
not dword [ebx + 0x14c]
not dword [ebx + 0x2d4]
xor dword [ebx + 0x270], 0x7f203390
xor dword [ebx + 0x210], 0x2ea761a0
sub dword [ebx + 0x2f4], 0x7aa66ab
xor dword [ebx + 0x98], 0x1baa4fc7
sub dword [ebx + 0x330], 0x3dad3c3a
xor dword [ebx + 0xc8], 0x3d13443
invalid
inc ebx
Function at 0x1c26a00
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
xor edi, edi
push dword [esi + edi*4 + 0x28]
call fcn.01c9f88f
add esp, 4
mov dword [esi + edi*4 + 0x28], eax
inc edi
cmp edi, 0x10
jne 0x1c26a0d
xor eax, eax
mov ecx, dword [esi + eax*4 + 0x48]
xor ecx, dword [esi + eax*4 + 0x5c]
xor ecx, dword [esi + eax*4 + 0x30]
xor ecx, dword [esi + eax*4 + 0x28]
rol ecx, 1
mov dword [esi + eax*4 + 0x68], ecx
inc eax
cmp eax, 0x40
jne 0x1c26a25
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x20], eax
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x24]
xor edi, edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x20]
mov ecx, ebx
mov esi, dword [ebp - 0x1c]
mov ebx, eax
mov eax, edx
mov edx, ecx
rol edx, 5
cmp edi, 0x14
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], ecx
jae 0x1c26aa7
mov ecx, ebx
mov ebx, eax
and ebx, ecx
add ebx, edx
mov edx, eax
not edx
and edx, esi
add ebx, edx
add ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ebx, dword [ecx + edi*4 + 0x28]
mov ecx, 0x5a827999
jmp 0x1c26afc
cmp edi, 0x28
jae 0x1c26ac3
xor ebx, esi
xor ebx, eax
add ebx, edx
add ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ebx, dword [ecx + edi*4 + 0x28]
mov ecx, 0x6ed9eba1
jmp 0x1c26afc
cmp edi, 0x3b
mov dword [ebp - 0x18], esi
ja 0x1c26ad7
mov ecx, ebx
or ecx, esi
and ecx, eax
and ebx, esi
or ebx, ecx
jmp 0x1c26adb
xor ebx, esi
xor ebx, eax
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
add ebx, edx
add ebx, esi
add ebx, dword [ecx + edi*4 + 0x28]
cmp edi, 0x3c
mov ecx, 0xca62c1d6
mov edx, 0x8f1bbcdc
cmovb ecx, edx
mov esi, dword [ebp - 0x18]
add ebx, ecx
rol eax, 0x1e
inc edi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x34]
mov edx, ecx
cmp edi, 0x50
jne 0x1c26a6d
mov edi, dword [ebp - 0x10]
mov dword [edi + 0x10], esi
mov edx, dword [ebp - 0x1c]
mov dword [edi + 0xc], edx
mov dword [edi + 8], eax
mov dword [edi + 4], ecx
mov dword [edi], ebx
mov dword [ebp - 0x18], esi
mov esi, ecx
mov ecx, dword [ebp - 0x20]
add ecx, ebx
mov dword [edi + 0x14], ecx
mov ecx, dword [ebp - 0x24]
add ecx, esi
mov dword [edi + 0x18], ecx
mov ecx, dword [ebp - 0x28]
add ecx, eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x2c]
add eax, edx
mov dword [edi + 0x20], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x18]
mov dword [edi + 0x24], eax
mov dword [edi + 0x168], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c2a050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x1c2a07f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x1c2a061
pop esi
pop edi
pop ebp
ret 8
Function at 0x1c410c3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x1c410ec
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c41113
mov eax, 0x300
mov ecx, ebx
and ecx, eax
cmp ecx, eax
je 0x1c41113
cmp edi, 2
mov eax, 0x1ceba96
mov ecx, 0x1cebc96
cmove ecx, eax
cmp word [ecx], 0
je 0x1c41126
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c8b52d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x1c41113
cmp byte [0x1ceba94], 0
setne al
bt ebx, 8
jb 0x1c41113
shr ebx, 9
and ebx, 1
or bl, al
je 0x1c41113
cmp edi, 2
mov eax, 0x1cb8b84
mov edx, 0x1cb8b98
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax + 0xb]
test bl, bl
js 0x1c41185
mov ecx, ebx
mov esi, eax
mov eax, ebx
jmp 0x1c4118a
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov ebx, dword [edx + 4]
mov edi, eax
sub edi, ebx
jb 0x1c411d8
push ebx
push dword [edx]
push esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
call fcn.01c9f88f
mov edx, dword [esp + 0x24]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
je 0x1c411e8
add edx, 0x14
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x1c411ab
jmp 0x1c41252
movzx ecx, word [esi + ebx*2]
cmp cx, 0x5c
je 0x1c411f7
test cx, cx
jne 0x1c411d8
lea eax, [esi + ebx*2]
mov ebx, dword [edx + 8]
cmp ebx, 1
je 0x1c41217
cmp ebx, 2
mov esi, ebx
jne 0x1c41225
mov dword [esp + 8], str.WOW6432Node
mov dword [esp + 4], eax
jmp 0x1c41225
mov dword [esp + 8], str.WOW6432Node_
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp + 0xc], esi
cmp cx, 0x5c
jne 0x1c4123e
lea esi, [eax + 2]
dec edi
cmp word [eax + 2], 0x5c
mov eax, esi
je 0x1c4122f
jmp 0x1c41240
mov esi, eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov edx, eax
mov eax, edi
jmp 0x1c411e0
cmp dword [esp + 0xc], 0
je 0x1c41113
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x1c4126a
mov eax, ecx
jmp 0x1c4126c
mov eax, dword [ecx]
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
push dword [esp + 8]
push edx
call fcn.01c3ee72
jmp 0x1c41113
Function at 0x1c4237a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1cec09c]
test eax, eax
jne 0x1c4245e
mov edi, 0xc
push edi
call fcn.01c9f88f
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1cec09c], eax
push edi
call fcn.01c9f88f
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1cec0a0], eax
call fcn.01c437dc
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push str.user_data_dir
call fcn.01c3af3a
call dword [sym.imp.kernel32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.01c3af3a
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.01c42b46
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.01c41fa0
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x1c42431
push dword [ebp - 0x1c]
call fcn.01c8b528
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x1c42442
push dword [ebp - 0x34]
call fcn.01c8b528
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1c42453
push dword [ebp - 0x28]
call fcn.01c8b528
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x1c4247f
mov eax, dword [0x1cec09c]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.01c3e6a6
mov bl, 1
test esi, esi
je 0x1c42481
mov ecx, esi
push dword [0x1cec0a0]
call fcn.01c3e6a6
jmp 0x1c42481
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8b52d
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c427ed
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x216]
push 0x206
push 0xff
push eax
call fcn.01c8cb90
add esp, 0xc
mov edi, 0xfffffff4
lea ebx, [ebp - 0x218]
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [edi + str.PROGRAMW6432]
mov word [ebp - 0x218], 0
push 0x104
push ebx
push eax
call esi
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c42861
push dword [ebp + 8]
push eax
push ebx
call fcn.01c42781
add esp, 0xc
test al, al
jne 0x1c4286a
add edi, 4
jne 0x1c4282d
xor ebx, ebx
jmp 0x1c4286c
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8b52d
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c42d2f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x18], eax
movzx eax, byte [ecx + 0xb]
test al, al
js 0x1c42d5a
test al, al
jne 0x1c42d63
jmp 0x1c42db6
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c42db6
mov ecx, dword [ecx]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp], 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 0x10], edi
cmp eax, 0xfffffff0
jae 0x1c42e81
mov ebx, eax
cmp eax, 0xb
jae 0x1c42dc5
lea edi, [esp + 8]
mov byte [edi + 0xb], bl
mov dword [esp + 4], edi
test ebx, ebx
jne 0x1c42def
jmp 0x1c42dfb
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x1c42e6c
lea esi, [ebx + 0x10]
and esi, 0xfffffff0
push esi
call fcn.01c9f88f
add esp, 4
mov edi, eax
lea eax, [esp + 8]
mov dword [eax], edi
or esi, 0x80000000
mov dword [eax + 8], esi
mov esi, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [eax + 4], ebx
push ebx
push 0
push edi
call fcn.01c8cb90
add esp, 0xc
mov byte [edi + ebx], 0
mov eax, dword [esp + 4]
cmp byte [eax + 0xb], 0
jns 0x1c42e0f
mov eax, dword [esp + 8]
jmp 0x1c42e13
lea eax, [esp + 8]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx + 0xb]
test cl, cl
jns 0x1c42e23
mov ecx, dword [edx + 4]
mov edx, dword [edx]
xor edi, edi
push edi
push edi
push ebx
push eax
push ecx
push edx
push edi
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, ebx
jne 0x1c42e4e
mov eax, dword [esp + 0x10]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [esi], xmm0
jmp 0x1c42e6c
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 8], edi
mov eax, dword [esp + 4]
cmp byte [eax + 0xb], 0
jns 0x1c42e6c
push dword [esp + 8]
call fcn.01c8b528
add esp, 4
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c8b52d
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 8]
call fcn.01c3dbd4
Function at 0x1c42e8a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, dword [ebp + 8]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x18], eax
xor esi, esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c42ee2
mov ebx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 0x10], esi
cmp eax, 0x7ffffff0
jae 0x1c42fc1
cmp ebx, 5
jae 0x1c42efc
lea edi, [esp + 8]
mov byte [edi + 0xb], bl
mov dword [esp + 4], edi
mov eax, edi
jmp 0x1c42f24
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c8b52d
mov eax, edi
jmp 0x1c42fb9
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.01c9f88f
add esp, 4
lea edi, [esp + 8]
mov dword [edi], eax
or esi, 0x80000000
mov dword [edi + 8], esi
mov dword [edi + 4], ebx
mov dword [esp + 4], edi
mov ecx, ebx
add ecx, ebx
push ecx
push 0
push eax
mov esi, eax
call fcn.01c8cb90
add esp, 0xc
mov word [esi + ebx*2], 0
mov esi, dword [esp + 4]
cmp byte [esi + 0xb], 0
jns 0x1c42f4a
mov edi, dword [esp + 8]
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
movzx ecx, byte [esi + 0xb]
test eax, eax
mov esi, dword [ebp + 8]
je 0x1c42f92
mov edx, ecx
test cl, cl
jns 0x1c42f6a
mov edx, dword [esp + 0xc]
cmp eax, edx
jae 0x1c42f92
lea edi, [esp + 8]
mov ecx, edi
push 0
push eax
call fcn.01c3e74a
mov eax, dword [edi + 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [edi]
mov esi, dword [ebp + 8]
movsd qword [esi], xmm0
jmp 0x1c42fac
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
test cl, cl
jns 0x1c42fac
push dword [esp + 8]
call fcn.01c8b528
add esp, 4
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c8b52d
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 8]
call fcn.01c3dbd4
Function at 0x1c43274
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
push dword [ebp + 0xc]
call fcn.01c9f88f
add esp, 4
mov ebx, eax
movzx ecx, byte [esi + 0xb]
mov eax, ecx
mov dword [ebp - 0x10], ecx
test cl, cl
jns 0x1c432aa
mov eax, dword [esi + 4]
lea esi, [eax + ebx]
cmp esi, 0x7ffffff0
jae 0x1c4332e
cmp esi, 4
mov dword [ebp - 0x14], eax
ja 0x1c432c7
mov esi, dword [ebp + 8]
mov byte [esi + 0xb], bl
mov edi, esi
jmp 0x1c432ee
add esi, 8
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.01c9f88f
add esp, 4
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
or esi, 0x80000000
mov dword [eax + 8], esi
mov esi, eax
mov dword [eax + 4], ebx
test ebx, ebx
je 0x1c43303
mov eax, ebx
add eax, ebx
push eax
push dword [ebp + 0xc]
push edi
call fcn.01c8ccf0
add esp, 0xc
mov word [edi + ebx*2], 0
cmp byte [ebp - 0x10], 0
jns 0x1c43316
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
jmp 0x1c43319
mov eax, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp - 0x14]
push eax
call fcn.01c3ea18
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.01c3dbd4
Function at 0x1c43336
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov ebx, dword [ebp + 8]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x20], eax
cmp byte [ebx + 0xb], 0
mov esi, ebx
jns 0x1c4335a
mov esi, dword [ebx]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c43384
test al, 0x10
jne 0x1c433c4
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.01c434c7
add esp, 0xc
xor ebx, ebx
jmp 0x1c434b2
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 0xb]
mov ecx, ebx
test al, al
jns 0x1c433a1
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
test eax, eax
je 0x1c43417
add eax, eax
add eax, 0xfffffffe
movzx edx, word [ecx + eax]
cmp dx, 0x5c
je 0x1c433de
cmp dx, 0x2f
je 0x1c433de
add eax, 0xfffffffe
cmp eax, 0xfffffffe
jne 0x1c433aa
jmp 0x1c43417
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_exists___n
call fcn.01c434c7
add esp, 0xc
mov bl, 1
jmp 0x1c434b2
cmp eax, 0xfffffffe
je 0x1c43417
sar eax, 1
lea edx, [ebx + 0xc]
lea edi, [esp + 4]
mov ecx, edi
push edx
push eax
push 0
push ebx
call fcn.01c3e5e6
movsd xmm0, qword [edi]
lea eax, [esp + 0x10]
movsd qword [eax], xmm0
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
push eax
call fcn.01c43336
add esp, 4
test al, al
je 0x1c43490
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c4349f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1c4347f
mov dword [esp], eax
lea edi, [esp + 4]
mov ecx, edi
push esi
call fcn.01c3af3a
cmp byte [edi + 0xb], 0
jns 0x1c4344c
mov edi, dword [esp + 4]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
cmp byte [esp + 0xf], 0
jns 0x1c43478
push dword [esp + 4]
mov edi, eax
call fcn.01c8b528
mov eax, edi
add esp, 4
test al, al
mov eax, dword [esp]
jne 0x1c4349f
push eax
push esi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.01c434c7
add esp, 0xc
jmp 0x1c4349d
push str.Failed_to_create_one_of_the_parent_directories
call fcn.01c434c7
add esp, 4
xor ebx, ebx
cmp byte [esp + 0x1b], 0
jns 0x1c434b2
push dword [esp + 0x10]
call fcn.01c8b528
add esp, 4
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.01c8b52d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c434c7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01c23bb8
mov ebx, 0x1cec0a8
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01c9f88f
add esp, 0x1c
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8b52d
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c46180
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x1cec8c8]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x1c46304
jp 0x1c46304
mov edi, dword [sym.imp.kernel32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, dword [0x1cec8d8]
mov ecx, dword [0x1ced9a0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 8]
jg 0x1c46329
mov eax, dword [0x1cec8e8]
mov ecx, dword [0x1ced9a0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 8]
jg 0x1c46362
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea esi, [esp + 0x28]
push esi
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
sub edi, dword [0x1cec8e0]
sbb ebx, dword [0x1cec8e4]
movd xmm0, ebx
movd xmm1, edi
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x1cb5750]
subpd xmm1, xmmword [0x1cb5760]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
divsd xmm0, qword [esp + 0x20]
xorpd xmm1, xmm1
movsd xmm2, qword [0x1cba738]
ucomisd xmm2, xmm0
ja 0x1c46304
mov eax, dword [esp + 8]
sub eax, dword [0x1cec8d0]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x1cec8d4]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x1cb5750]
subpd xmm2, xmmword [0x1cb5760]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x1cec8c8], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.01c8b52d
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1cec8d8
call fcn.01c9f88f
add esp, 4
cmp dword [0x1cec8d8], 0xffffffff
jne 0x1c461f2
rdtsc
mov dword [0x1cec8d0], eax
mov dword [0x1cec8d4], edx
push 0x1cec8d8
call fcn.01c9f88f
add esp, 4
jmp 0x1c461f2
push 0x1cec8e8
call fcn.01c9f88f
add esp, 4
cmp dword [0x1cec8e8], 0xffffffff
jne 0x1c46213
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x1cec8e4], ecx
mov dword [0x1cec8e0], eax
push 0x1cec8e8
call fcn.01c9f88f
add esp, 4
jmp 0x1c46213