joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d84a30
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm1, qword [0x1f10458]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x1d84bac
jp 0x1d84bac
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1f10468]
mov ecx, dword [0x1f0c740]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d84bd1
mov eax, dword [0x1f10478]
mov ecx, dword [0x1f0c740]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1d84c0a
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea ebx, [esp + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esi, dword [0x1f10470]
sbb edi, dword [0x1f10474]
movd xmm0, edi
movd xmm1, esi
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm0, qword [esp + 0x30]
pxor xmm1, xmm1
movsd xmm2, qword [0x1ebc188]
ucomisd xmm2, xmm0
ja 0x1d84bac
mov eax, dword [esp + 8]
sub eax, dword [0x1f10460]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x1f10464]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x1ebc160]
subpd xmm2, xmmword [0x1ebc170]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x1f10458], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.01e60425
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1f10468
call fcn.01e5f3e7
add esp, 4
cmp dword [0x1f10468], 0xffffffff
jne 0x1d84aa2
rdtsc
mov dword [0x1f10460], eax
mov dword [0x1f10464], edx
push 0x1f10468
call fcn.01e5f45d
add esp, 4
jmp 0x1d84aa2
push 0x1f10478
call fcn.01e5f3e7
add esp, 4
cmp dword [0x1f10478], 0xffffffff
jne 0x1d84ac3
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [0x1f10474], ecx
mov dword [0x1f10470], eax
push 0x1f10478
call fcn.01e5f45d
add esp, 4
jmp 0x1d84ac3
Function at 0x1d857f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor eax, eax
cmp dword [ebp + 0xc], 0
sete al
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
push 0
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], 0
test eax, eax
je 0x1d85872
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x1d85847
call fcn.01da4710
push dword [esi]
call fcn.01d83bd0
add esp, 4
mov dword [esi], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x1d85856
mov dword [esi], edi
call fcn.01da4710
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x1d85879
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov byte [esi + 4], 0
int3
int3

Function at 0x1d85c80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
lea edx, [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
add ecx, 0x34
push edx
call fcn.01da5e00
mov eax, dword [edi + 0x38]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x1f12660]
bt edx, ecx
jae 0x1d85cc6
push eax
call fcn.01dad9e0
add esp, 4
mov eax, esi
shr eax, 0xe
mov ecx, esi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x1f12660]
bt ecx, eax
jae 0x1d85ce7
push esi
call fcn.01dad8e0
add esp, 4
jmp 0x1d85cf3
mov eax, esi
shr eax, 0x15
mov byte [eax + 0x1f1a660], 1
mov dword [edi + 0x38], esi
mov dword [ebp - 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov ebx, eax
mov dword [ebp - 0x28], edi
mov eax, dword [ebp + 8]
mov edi, dword [eax]
call esi
lea ecx, [ebp - 0x14]
push 2
push 0
push 0
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1d85d9d
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp dword [edi + 4], esi
je 0x1d85d72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [edi + 4]
inc eax
cmp eax, 2
jb 0x1d85d5b
call fcn.01da4710
push dword [edi + 4]
call fcn.01d83bd0
add esp, 4
mov dword [edi + 4], 0
lea eax, [esi + 1]
cmp eax, 2
jb 0x1d85d6b
mov dword [edi + 4], esi
call fcn.01da4710
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ebx, [edi + 8]
lea esi, [ebp - 0x24]
push 0x28
push str....._base_synchronizationwaitable_event_watcher_win.cc
push str.StartWatching
push esi
call fcn.01da46e0
add esp, 0x10
mov ecx, ebx
push esi
push edi
push dword [ebp - 0x14]
call fcn.01de1060
mov ebx, eax
jmp 0x1d85d9f
xor ebx, ebx
lea ecx, [ebp + 0xc]
call fcn.01da5ec0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1d85dbd
lock dec dword [eax + 4]
jne 0x1d85dbd
push eax
call fcn.01d93da0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1d86660
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1d866b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x1d8669a
call fcn.01da4710
push dword [esi]
call fcn.01d83bd0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1d866a9
mov dword [esi], ebx
call fcn.01da4710
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x1d866c7
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3

Function at 0x1d866d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x1d866f1
call fcn.01da4710
mov dword [esi], 0
test edi, edi
je 0x1d86715
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x1d8674c
cmp ebx, 2
jae 0x1d8676c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x1d86740
call fcn.01da4710
push dword [edi]
call fcn.01d83bd0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.01da4710
push dword [esi]
call fcn.01d83bd0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x1d8670e
mov dword [esi], edi
mov edi, eax
call fcn.01da4710
mov eax, edi
jmp 0x1d8670e

Function at 0x1d86780
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x1d867a2
cmp dword [esi], edi
jne 0x1d867ab
jmp 0x1d867c5
call fcn.01da4710
cmp dword [esi], edi
je 0x1d867c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x1d867fc
cmp ebx, 2
jae 0x1d8681c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x1d867f0
call fcn.01da4710
push dword [edi]
call fcn.01d83bd0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.01da4710
push dword [esi]
call fcn.01d83bd0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x1d867be
mov dword [esi], edi
mov edi, eax
call fcn.01da4710
mov eax, edi
jmp 0x1d867be
Function at 0x1d86a20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x1d86a46
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1d86a48
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1d86a6a
mov bl, 1
cmp byte [ebp + 0xc], 0
je 0x1d86ac8
cmp byte [esi + 4], 0
je 0x1d86aa9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1d86aab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x1d86a7e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1d86a80
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1d86a94
xor ebx, ebx
jmp 0x1d86ac8
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x1d86ab9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1d86abb
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1d86ac8
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1d89150
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
call fcn.01de59d0
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi], 0x1eae3c0
mov dword [esi + 0xc], 0
movaps xmm0, xmmword [0x1ebc3c0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x1d891d7
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jb 0x1d891bb
call fcn.01da4710
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.01d83bd0
mov dword [esi + 0xc], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x1d891cb
mov dword [esi + 0xc], edi
call fcn.01da4710
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d8b6e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
lea ebx, [eax + 1]
cmp ebx, 2
jae 0x1d8b704
xor ebx, ebx
jmp 0x1d8b7c9
mov esi, ecx
mov dword [ebp - 0x1c], eax
cmp dword [ecx + 4], 1
jne 0x1d8b7dd
mov dword [esi], 0
call fcn.01da4710
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.01da4710
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push 0
push 0
push 5
push ecx
push eax
mov edi, dword [ebp - 0x1c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne al
mov dword [ebp - 0x18], eax
je 0x1d8b7b3
mov edi, dword [ebp - 0x14]
cmp dword [esi], edi
je 0x1d8b7a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jb 0x1d8b78f
mov dword [ebp - 0x20], eax
call fcn.01da4710
push dword [esi]
call fcn.01d83bd0
mov eax, dword [ebp - 0x20]
add esp, 4
mov dword [esi], 0
lea ecx, [edi + 1]
cmp ecx, 2
jb 0x1d8b7a2
mov dword [esi], edi
mov edi, eax
call fcn.01da4710
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esi + 4], 0
mov edi, dword [ebp - 0x1c]
cmp ebx, 2
jb 0x1d8b7c6
call fcn.01da4710
push edi
call fcn.01d83bd0
add esp, 4
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x1d8b810
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, esp
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [esi + 0x68], eax
test ebx, ebx
je 0x1d8b98b
lea edi, [ebx + 0xffff]
and edi, 0xffff0000
cmp edi, ebx
jb 0x1d8b988
test edi, edi
js 0x1d8b988
cmp dword [ebp + 0xc], 0
je 0x1d8ba1c
mov dword [esi + 0x54], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0xffffffff
lea eax, [esi + 0x50]
push 2
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1d8b988
lea eax, [esi + 0x30]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1d8b988
push 0
lea eax, [esi + 0x50]
push eax
push 1
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1d8b988
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x14], 0xc
lea eax, [esi + 0x30]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0x14]
push 0
push edi
push 0
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x1d8b9a6
mov edi, eax
mov dword [esi + 0x58], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esi + 0x58]
push 0
push 0
push 7
push ecx
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [esi + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0xc], 0
je 0x1d8b9a6
mov edi, dword [esi + 0x58]
test edi, edi
je 0x1d8b9a6
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea edx, [edi + 1]
cmp edx, 2
jb 0x1d8b962
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], eax
call fcn.01da4710
mov eax, dword [esi + 0xc]
mov ecx, edi
mov dword [esi + 0xc], ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1d8b9b2
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.01da1ef0
mov eax, dword [esi + 0xc]
jmp 0x1d8b9f0
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.01da1ef0
mov ecx, dword [esi + 0x68]
xor ecx, ebp
call fcn.01e60425
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.01da1ef0
jmp 0x1d8ba06
mov dword [esi + 0xc], esp
sub esp, 0x10
mov edi, esp
lea eax, [esi + 0x58]
push eax
call fcn.01d916f0
add esp, 4
lea eax, [esi + 0x10]
mov ecx, edi
push eax
call fcn.01ce042a
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea eax, [esi + 0x58]
mov dword [edi + 0xc], eax
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.01d8b560
mov esp, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
inc eax
cmp eax, 2
jb 0x1d8ba06
call fcn.01da4710
push dword [esi + 0x10]
call fcn.01d83bd0
add esp, 4
cmp byte [esi + 0x2b], 0
jns 0x1d8b992
push dword [esi + 0x20]
call fcn.01e5f36c
add esp, 4
jmp 0x1d8b992
int3
Function at 0x1d8bbf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea edi, [esp + 0x10]
push 0x48
push str....._base_files_file_win.cc
push str.Read
push edi
call fcn.01da46e0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push edi
call fcn.01d93760
mov ebx, 0xffffffff
cmp dword [ebp + 0xc], 0
js 0x1d8bcef
mov eax, dword [ebp + 0x14]
test eax, eax
js 0x1d8bcef
mov ebx, eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01de90e0
test al, al
je 0x1d8bc8b
lea ecx, [esp + 0x28]
push 0
push ebx
push esi
push str.File::Read
call fcn.01de91f0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push edi
push eax
push ebx
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1d8bcd6
mov ebx, dword [esp + 0xc]
test ebx, ebx
jns 0x1d8bce6
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x28]
call fcn.01de9180
lea ecx, [esp + 0x30]
call fcn.01d937e0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1d8bd10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea ebx, [esp + 0x10]
push 0x65
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.01da46e0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.01d93760
test edi, edi
js 0x1d8bdc3
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01de90e0
test al, al
je 0x1d8bd99
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::ReadAtCurrentPos
call fcn.01de91f0
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1d8bdca
mov ebx, dword [esp + 0xc]
test ebx, ebx
jns 0x1d8bdda
int3
mov ebx, 0xffffffff
jmp 0x1d8bde3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x10]
call fcn.01de9180
lea ecx, [esp + 0x20]
call fcn.01d937e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1d8be10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea ebx, [esp + 0x10]
push 0x85
push str....._base_files_file_win.cc
push str.Write
push ebx
call fcn.01da46e0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.01d93760
mov edi, 0xffffffff
cmp dword [ebp + 0xc], 0
js 0x1d8bef8
mov eax, dword [ebp + 0x14]
test eax, eax
js 0x1d8bef8
mov edi, eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01de90e0
test al, al
je 0x1d8beaa
lea ecx, [esp + 0x28]
push 0
push edi
push esi
push str.File::Write
call fcn.01de91f0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
cmp eax, 1
sbb edi, edi
or edi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.01de9180
lea ecx, [esp + 0x30]
call fcn.01d937e0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01e60425
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1d8bf20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea ebx, [esp + 0x10]
push 0x9d
push str....._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.01da46e0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.01d93760
test edi, edi
js 0x1d8bfdb
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01de90e0
test al, al
je 0x1d8bfac
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::WriteAtCurrentPos
call fcn.01de91f0
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.01de9180
jmp 0x1d8bfe0
mov esi, 0xffffffff
lea ecx, [esp + 0x20]
call fcn.01d937e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01e60425
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1d8c460
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.01d8c470

Function at 0x1d8c6e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 1
pop ebp
jmp fcn.01d8c470