joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c410c3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x1c410ec
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c41113
mov eax, 0x300
mov ecx, ebx
and ecx, eax
cmp ecx, eax
je 0x1c41113
cmp edi, 2
mov eax, 0x1ceba96
mov ecx, 0x1cebc96
cmove ecx, eax
cmp word [ecx], 0
je 0x1c41126
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c8b52d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x1c41113
cmp byte [0x1ceba94], 0
setne al
bt ebx, 8
jb 0x1c41113
shr ebx, 9
and ebx, 1
or bl, al
je 0x1c41113
cmp edi, 2
mov eax, 0x1cb8b84
mov edx, 0x1cb8b98
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax + 0xb]
test bl, bl
js 0x1c41185
mov ecx, ebx
mov esi, eax
mov eax, ebx
jmp 0x1c4118a
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov ebx, dword [edx + 4]
mov edi, eax
sub edi, ebx
jb 0x1c411d8
push ebx
push dword [edx]
push esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
call fcn.01ca97a1
mov edx, dword [esp + 0x24]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
je 0x1c411e8
add edx, 0x14
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x1c411ab
jmp 0x1c41252
movzx ecx, word [esi + ebx*2]
cmp cx, 0x5c
je 0x1c411f7
test cx, cx
jne 0x1c411d8
lea eax, [esi + ebx*2]
mov ebx, dword [edx + 8]
cmp ebx, 1
je 0x1c41217
cmp ebx, 2
mov esi, ebx
jne 0x1c41225
mov dword [esp + 8], str.WOW6432Node
mov dword [esp + 4], eax
jmp 0x1c41225
mov dword [esp + 8], str.WOW6432Node_
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp + 0xc], esi
cmp cx, 0x5c
jne 0x1c4123e
lea esi, [eax + 2]
dec edi
cmp word [eax + 2], 0x5c
mov eax, esi
je 0x1c4122f
jmp 0x1c41240
mov esi, eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov edx, eax
mov eax, edi
jmp 0x1c411e0
cmp dword [esp + 0xc], 0
je 0x1c41113
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x1c4126a
mov eax, ecx
jmp 0x1c4126c
mov eax, dword [ecx]
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
push dword [esp + 8]
push edx
call fcn.01c3ee72
jmp 0x1c41113
Function at 0x1c4237a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1cec09c]
test eax, eax
jne 0x1c4245e
mov edi, 0xc
push edi
call fcn.01ca97a1
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1cec09c], eax
push edi
call fcn.01ca97a1
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1cec0a0], eax
call fcn.01c437dc
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push str.user_data_dir
call fcn.01c3af3a
call dword [sym.imp.kernel32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.01c3af3a
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.01c42b46
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.01c41fa0
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x1c42431
push dword [ebp - 0x1c]
call fcn.01c8b528
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x1c42442
push dword [ebp - 0x34]
call fcn.01c8b528
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1c42453
push dword [ebp - 0x28]
call fcn.01c8b528
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x1c4247f
mov eax, dword [0x1cec09c]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.01c3e6a6
mov bl, 1
test esi, esi
je 0x1c42481
mov ecx, esi
push dword [0x1cec0a0]
call fcn.01c3e6a6
jmp 0x1c42481
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8b52d
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c427ed
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x216]
push 0x206
push 0xff
push eax
call fcn.01c8cb90
add esp, 0xc
mov edi, 0xfffffff4
lea ebx, [ebp - 0x218]
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [edi + str.PROGRAMW6432]
mov word [ebp - 0x218], 0
push 0x104
push ebx
push eax
call esi
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c42861
push dword [ebp + 8]
push eax
push ebx
call fcn.01c42781
add esp, 0xc
test al, al
jne 0x1c4286a
add edi, 4
jne 0x1c4282d
xor ebx, ebx
jmp 0x1c4286c
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8b52d
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c42d2f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x18], eax
movzx eax, byte [ecx + 0xb]
test al, al
js 0x1c42d5a
test al, al
jne 0x1c42d63
jmp 0x1c42db6
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c42db6
mov ecx, dword [ecx]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp], 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 0x10], edi
cmp eax, 0xfffffff0
jae 0x1c42e81
mov ebx, eax
cmp eax, 0xb
jae 0x1c42dc5
lea edi, [esp + 8]
mov byte [edi + 0xb], bl
mov dword [esp + 4], edi
test ebx, ebx
jne 0x1c42def
jmp 0x1c42dfb
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x1c42e6c
lea esi, [ebx + 0x10]
and esi, 0xfffffff0
push esi
call fcn.01ca97a1
add esp, 4
mov edi, eax
lea eax, [esp + 8]
mov dword [eax], edi
or esi, 0x80000000
mov dword [eax + 8], esi
mov esi, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [eax + 4], ebx
push ebx
push 0
push edi
call fcn.01c8cb90
add esp, 0xc
mov byte [edi + ebx], 0
mov eax, dword [esp + 4]
cmp byte [eax + 0xb], 0
jns 0x1c42e0f
mov eax, dword [esp + 8]
jmp 0x1c42e13
lea eax, [esp + 8]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx + 0xb]
test cl, cl
jns 0x1c42e23
mov ecx, dword [edx + 4]
mov edx, dword [edx]
xor edi, edi
push edi
push edi
push ebx
push eax
push ecx
push edx
push edi
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, ebx
jne 0x1c42e4e
mov eax, dword [esp + 0x10]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [esi], xmm0
jmp 0x1c42e6c
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 8], edi
mov eax, dword [esp + 4]
cmp byte [eax + 0xb], 0
jns 0x1c42e6c
push dword [esp + 8]
call fcn.01c8b528
add esp, 4
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c8b52d
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 8]
call fcn.01c3dbd4
Function at 0x1c42e8a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, dword [ebp + 8]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x18], eax
xor esi, esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c42ee2
mov ebx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 0x10], esi
cmp eax, 0x7ffffff0
jae 0x1c42fc1
cmp ebx, 5
jae 0x1c42efc
lea edi, [esp + 8]
mov byte [edi + 0xb], bl
mov dword [esp + 4], edi
mov eax, edi
jmp 0x1c42f24
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c8b52d
mov eax, edi
jmp 0x1c42fb9
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.01ca97a1
add esp, 4
lea edi, [esp + 8]
mov dword [edi], eax
or esi, 0x80000000
mov dword [edi + 8], esi
mov dword [edi + 4], ebx
mov dword [esp + 4], edi
mov ecx, ebx
add ecx, ebx
push ecx
push 0
push eax
mov esi, eax
call fcn.01c8cb90
add esp, 0xc
mov word [esi + ebx*2], 0
mov esi, dword [esp + 4]
cmp byte [esi + 0xb], 0
jns 0x1c42f4a
mov edi, dword [esp + 8]
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
movzx ecx, byte [esi + 0xb]
test eax, eax
mov esi, dword [ebp + 8]
je 0x1c42f92
mov edx, ecx
test cl, cl
jns 0x1c42f6a
mov edx, dword [esp + 0xc]
cmp eax, edx
jae 0x1c42f92
lea edi, [esp + 8]
mov ecx, edi
push 0
push eax
call fcn.01c3e74a
mov eax, dword [edi + 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [edi]
mov esi, dword [ebp + 8]
movsd qword [esi], xmm0
jmp 0x1c42fac
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
test cl, cl
jns 0x1c42fac
push dword [esp + 8]
call fcn.01c8b528
add esp, 4
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c8b52d
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 8]
call fcn.01c3dbd4
Function at 0x1c43274
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
push dword [ebp + 0xc]
call fcn.01ca97a1
add esp, 4
mov ebx, eax
movzx ecx, byte [esi + 0xb]
mov eax, ecx
mov dword [ebp - 0x10], ecx
test cl, cl
jns 0x1c432aa
mov eax, dword [esi + 4]
lea esi, [eax + ebx]
cmp esi, 0x7ffffff0
jae 0x1c4332e
cmp esi, 4
mov dword [ebp - 0x14], eax
ja 0x1c432c7
mov esi, dword [ebp + 8]
mov byte [esi + 0xb], bl
mov edi, esi
jmp 0x1c432ee
add esi, 8
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.01ca97a1
add esp, 4
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
or esi, 0x80000000
mov dword [eax + 8], esi
mov esi, eax
mov dword [eax + 4], ebx
test ebx, ebx
je 0x1c43303
mov eax, ebx
add eax, ebx
push eax
push dword [ebp + 0xc]
push edi
call fcn.01c8ccf0
add esp, 0xc
mov word [edi + ebx*2], 0
cmp byte [ebp - 0x10], 0
jns 0x1c43316
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
jmp 0x1c43319
mov eax, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp - 0x14]
push eax
call fcn.01c3ea18
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.01c3dbd4
Function at 0x1c43336
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov ebx, dword [ebp + 8]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x20], eax
cmp byte [ebx + 0xb], 0
mov esi, ebx
jns 0x1c4335a
mov esi, dword [ebx]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c43384
test al, 0x10
jne 0x1c433c4
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.01c434c7
add esp, 0xc
xor ebx, ebx
jmp 0x1c434b2
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 0xb]
mov ecx, ebx
test al, al
jns 0x1c433a1
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
test eax, eax
je 0x1c43417
add eax, eax
add eax, 0xfffffffe
movzx edx, word [ecx + eax]
cmp dx, 0x5c
je 0x1c433de
cmp dx, 0x2f
je 0x1c433de
add eax, 0xfffffffe
cmp eax, 0xfffffffe
jne 0x1c433aa
jmp 0x1c43417
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_exists___n
call fcn.01c434c7
add esp, 0xc
mov bl, 1
jmp 0x1c434b2
cmp eax, 0xfffffffe
je 0x1c43417
sar eax, 1
lea edx, [ebx + 0xc]
lea edi, [esp + 4]
mov ecx, edi
push edx
push eax
push 0
push ebx
call fcn.01c3e5e6
movsd xmm0, qword [edi]
lea eax, [esp + 0x10]
movsd qword [eax], xmm0
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
push eax
call fcn.01c43336
add esp, 4
test al, al
je 0x1c43490
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c4349f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1c4347f
mov dword [esp], eax
lea edi, [esp + 4]
mov ecx, edi
push esi
call fcn.01c3af3a
cmp byte [edi + 0xb], 0
jns 0x1c4344c
mov edi, dword [esp + 4]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
cmp byte [esp + 0xf], 0
jns 0x1c43478
push dword [esp + 4]
mov edi, eax
call fcn.01c8b528
mov eax, edi
add esp, 4
test al, al
mov eax, dword [esp]
jne 0x1c4349f
push eax
push esi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.01c434c7
add esp, 0xc
jmp 0x1c4349d
push str.Failed_to_create_one_of_the_parent_directories
call fcn.01c434c7
add esp, 4
xor ebx, ebx
cmp byte [esp + 0x1b], 0
jns 0x1c434b2
push dword [esp + 0x10]
call fcn.01c8b528
add esp, 4
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.01c8b52d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c434c7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01c23bb8
mov ebx, 0x1cec0a8
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01ca97a1
add esp, 0x1c
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8b52d
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c46180
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x1cec8c8]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x1c46304
jp 0x1c46304
mov edi, dword [sym.imp.kernel32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, dword [0x1cec8d8]
mov ecx, dword [0x1ced9a0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 8]
jg 0x1c46329
mov eax, dword [0x1cec8e8]
mov ecx, dword [0x1ced9a0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 8]
jg 0x1c46362
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea esi, [esp + 0x28]
push esi
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
sub edi, dword [0x1cec8e0]
sbb ebx, dword [0x1cec8e4]
movd xmm0, ebx
movd xmm1, edi
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x1cb5750]
subpd xmm1, xmmword [0x1cb5760]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
divsd xmm0, qword [esp + 0x20]
xorpd xmm1, xmm1
movsd xmm2, qword [0x1cba738]
ucomisd xmm2, xmm0
ja 0x1c46304
mov eax, dword [esp + 8]
sub eax, dword [0x1cec8d0]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x1cec8d4]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x1cb5750]
subpd xmm2, xmmword [0x1cb5760]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x1cec8c8], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.01c8b52d
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1cec8d8
call fcn.01ca97a1
add esp, 4
cmp dword [0x1cec8d8], 0xffffffff
jne 0x1c461f2
rdtsc
mov dword [0x1cec8d0], eax
mov dword [0x1cec8d4], edx
push 0x1cec8d8
call fcn.01ca97a1
add esp, 4
jmp 0x1c461f2
push 0x1cec8e8
call fcn.01ca97a1
add esp, 4
cmp dword [0x1cec8e8], 0xffffffff
jne 0x1c46213
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x1cec8e4], ecx
mov dword [0x1cec8e0], eax
push 0x1cec8e8
call fcn.01ca97a1
add esp, 4
jmp 0x1c46213
Function at 0x1c4ad70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.01c8b9f0
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1cd11ac]
cmp eax, 0xffffffff
je 0x1c4aec6
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x1c4aec6
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.01c8ccf0
add esp, 0xc
mov ecx, dword [0x1cd11ac]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.01c528b0
add esp, 8
push ebx
call fcn.01c8b789
add esp, 4
mov eax, dword [0x1ced544]
mov ecx, dword [0x1ced9a0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 8]
jg 0x1c4aee7
mov esi, dword [0x1ced540]
push esi
call dword [sym.imp.kernel32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c4aedb
lea eax, [ebp - 0x1410]
push 0xc00
push 0x1cec940
push eax
call fcn.01c8ccf0
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ebx, 0x100
jmp 0x1c4ae5a
lea ecx, [ebx - 1]
cmp ebx, 2
mov ebx, ecx
jb 0x1c4aeb6
test al, 1
je 0x1c4aeb6
xor edi, edi
lea esi, [ebp - 0x1408]
xor eax, eax
jmp 0x1c4ae7e
add edi, 1
add esi, 0xc
cmp edi, 0x100
je 0x1c4ae50
mov ecx, dword [ebp + edi*8 - 0x810]
test ecx, ecx
je 0x1c4ae70
cmp dword [esi - 8], 0
je 0x1c4ae70
mov edx, dword [ebp + edi*8 - 0x80c]
cmp edx, dword [esi]
jne 0x1c4ae70
mov edx, dword [esi - 4]
test edx, edx
je 0x1c4ae70
mov dword [ebp + edi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x1c4ae70
push 2
push dword [ebp - 0x1414]
call fcn.01c528b0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8b52d
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.01c49b70
jmp 0x1c4ae1d
push 0x1ced544
call fcn.01ca97a1
add esp, 4
cmp dword [0x1ced544], 0xffffffff
jne 0x1c4ae08
push 4
call fcn.01ca97a1
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.01c49b60
mov dword [0x1ced540], esi
push 0x1ced544
call fcn.01ca97a1
add esp, 4
jmp 0x1c4ae08

Function at 0x1c4af30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1cd11ac]
cmp eax, 0xffffffff
je 0x1c4af52
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1c4af60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x1cd11ac]
cmp eax, 0xffffffff
je 0x1c4af7d
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test al, 3
jne 0x1c4af82
call fcn.01c4b0a0
mov eax, dword [0x1ced544]
mov ecx, dword [0x1ced9a0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 8]
jg 0x1c4b055
mov edi, dword [0x1ced540]
push edi
call dword [sym.imp.kernel32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c4b049
mov ecx, dword [0x1cec93c]
add ecx, 1
mov edx, 0x100
nop word cs:[eax + eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x1cec940], 0
je 0x1c4affd
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x1cec940], 0
je 0x1c4affd
add ecx, 2
add edx, 0xfffffffe
jne 0x1c4afd0
jmp 0x1c4b02d
lea ecx, [eax*4 + 0x1cec940]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x1cec944], ecx
mov dword [0x1cec93c], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x1cec948]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1c4b09a
cmp eax, 0x100
jge 0x1c4b09d
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.01c49b70
jmp 0x1c4afb8
push 0x1ced544
call fcn.01ca97a1
add esp, 4
cmp dword [0x1ced544], 0xffffffff
jne 0x1c4afa3
push 4
call fcn.01ca97a1
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.01c49b60
mov dword [0x1ced540], edi
push 0x1ced544
call fcn.01ca97a1
add esp, 4
jmp 0x1c4afa3
int3
int3

Function at 0x1c4b0a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x1cea148]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov eax, dword [0x1cd11ac]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x1c4b148
lea esi, [ebp - 0x810]
push esi
call fcn.01c52880
add esp, 4
test al, al
je 0x1c4b1c9
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x1c4b11f
push esi
call fcn.01c52880
add esp, 4
test al, al
je 0x1c4b1cc
cmp dword [ebp - 0x810], 0xffffffff
je 0x1c4b1cc
push 0xffffffffffffffff
call fcn.01c528a0
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x1cd11ac], ecx
mov eax, dword [ebp - 0x810]
je 0x1c4b148
push eax
call fcn.01c528a0
add esp, 4
mov eax, dword [0x1cd11ac]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test al, 3
jne 0x1c4b1c6
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.01c8cb90
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.01c528b0
add esp, 8
push 0x800
call fcn.01ca97a1
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.01c8ccf0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.01c528b0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c8b52d
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3