joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c3b040
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movsx eax, byte [ecx + 0xb]
test eax, eax
jns 0x1c3b065
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c3b11f
bt ebx, 8
jae 0x1c3b080
mov eax, ebx
and eax, 0x200
jne 0x1c3b11f
cmp edi, 2
mov eax, 0x1d1bce6
mov ecx, 0x1d1bee6
cmove ecx, eax
cmp word [ecx], 0
jne 0x1c3b11f
xorps xmm0, xmm0
lea esi, [ebp - 0x34]
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x1c3b11f
bt ebx, 8
jb 0x1c3b11f
shr ebx, 9
and ebx, 1
or bl, byte [0x1d1c2e6]
je 0x1c3b11f
cmp edi, 2
mov eax, 0x1cee2c8
mov edx, 0x1cee2dc
cmove edx, eax
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0xb]
test ecx, ecx
jns 0x1c3b1bf
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
xor esi, esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
jmp 0x1c3b13a
cmp dword [ebp - 0x44], 0
jne 0x1c3b1c9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
add edx, 0x14
inc esi
cmp esi, dword [ebp - 0x4c]
jae 0x1c3b115
mov edi, dword [edx + 4]
mov ebx, eax
sub ebx, edi
jb 0x1c3b131
push edi
push dword [edx]
push dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], eax
call fcn.01c9c9e1
mov edx, dword [ebp - 0x50]
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x48]
jne 0x1c3b131
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax + edi*2]
mov eax, dword [ebp - 0x48]
cmp ecx, 0x5c
jne 0x1c3b1ec
mov eax, dword [ebp - 0x38]
lea eax, [eax + edi*2]
mov esi, dword [edx + 8]
cmp esi, 2
je 0x1c3b185
cmp esi, 1
jne 0x1c3b18f
jmp 0x1c3b1f9
mov dword [ebp - 0x40], str.WOW6432Node
mov dword [ebp - 0x3c], eax
cmp cx, 0x5c
mov dword [ebp - 0x44], esi
jne 0x1c3b1ba
lea ecx, [eax + 2]
dec ebx
cmp word [eax + 2], 0x5c
mov dword [ebp - 0x38], ecx
mov eax, ecx
je 0x1c3b198
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x4c], eax
mov edx, dword [edx + 0xc]
xor esi, esi
mov eax, ebx
jmp 0x1c3b135
mov dword [ebp - 0x38], eax
jmp 0x1c3b1a8
mov dword [ebp - 0x38], eax
mov eax, ecx
jmp 0x1c3b0f6
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
jns 0x1c3b1d4
mov eax, dword [eax]
mov edx, dword [ebp - 0x3c]
sub edx, eax
sar edx, 1
mov ecx, dword [ebp + 8]
push dword [ebp - 0x40]
push edx
call fcn.01cc9570
jmp 0x1c3b11f
test ecx, ecx
jne 0x1c3b131
jmp 0x1c3b170
mov dword [ebp - 0x40], str.WOW6432Node_
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edi
jmp 0x1c3b18f
Function at 0x1c3b9f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x1d1bce4], 0
je 0x1c3ba4d
xor esi, esi
lea edi, [ebp - 0x18]
mov dword [edi + 4], esi
mov dword [edi], esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push edi
call sub.ntdll.dll_RtlInitUnicodeString
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
push ebx
call sub.ntdll.dll_NtSetValueKey
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01c3ac20
test al, al
jne 0x1c3ba0c
xor ebx, ebx
jmp 0x1c3ba39

Function at 0x1c3ba60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x1d1bce4], 0
je 0x1c3babf
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
lea ebx, [ebp - 0x18]
mov dword [ebx + 4], edi
mov dword [ebx], edi
push eax
push ebx
call sub.ntdll.dll_RtlInitUnicodeString
mov eax, 4
lea ecx, [ebp + 0x10]
push eax
push ecx
push eax
push edi
push ebx
push esi
call sub.ntdll.dll_NtSetValueKey
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01c3ac20
test al, al
jne 0x1c3ba7c
xor ebx, ebx
jmp 0x1c3baab
Function at 0x1c3cb00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov edi, dword [ebp + 8]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.01c8abb0
add esp, 0xc
mov word [esi - 2], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
dec eax
cmp eax, 0x102
ja 0x1c3cb8b
cmp word [ebp + esi*2 - 0x21a], 0x5c
je 0x1c3ccd7
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c3cb72
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01c9c9e1
add esp, 0xc
test eax, eax
je 0x1c3cc80
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
dec eax
cmp eax, 0x102
ja 0x1c3cbe7
cmp word [ebp + esi*2 - 0x21a], 0x5c
je 0x1c3cce3
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c3cbce
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01c9c9e1
add esp, 0xc
test eax, eax
je 0x1c3ccaa
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
dec eax
cmp eax, 0x102
ja 0x1c3cc3f
cmp word [ebp + esi*2 - 0x21a], 0x5c
je 0x1c3ccef
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c3cc2a
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01c9c9e1
add esp, 0xc
test eax, eax
je 0x1c3cc58
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
movsx eax, byte [edi + 0xb]
mov ecx, eax
test eax, eax
jns 0x1c3cc65
mov ecx, dword [edi + 4]
mov bl, 1
cmp ecx, esi
je 0x1c3cc41
jb 0x1c3ccfb
test al, al
jns 0x1c3cc77
mov edi, dword [edi]
cmp word [edi + esi*2], 0x5c
jne 0x1c3cc3f
jmp 0x1c3cc41
movsx eax, byte [edi + 0xb]
mov ecx, eax
test eax, eax
jns 0x1c3cc8d
mov ecx, dword [edi + 4]
mov bl, 1
cmp ecx, esi
je 0x1c3cc41
jb 0x1c3ccfb
mov ecx, edi
test al, al
jns 0x1c3cc9d
mov ecx, dword [edi]
cmp word [ecx + esi*2], 0x5c
jne 0x1c3cb8b
jmp 0x1c3cc41
movsx eax, byte [edi + 0xb]
mov ecx, eax
test eax, eax
jns 0x1c3ccb7
mov ecx, dword [edi + 4]
mov bl, 1
cmp ecx, esi
je 0x1c3cc41
jb 0x1c3ccfb
mov ecx, edi
test al, al
jns 0x1c3ccc7
mov ecx, dword [edi]
cmp word [ecx + esi*2], 0x5c
jne 0x1c3cbe7
jmp 0x1c3cc41
dec esi
jne 0x1c3cb59
jmp 0x1c3cb8b
dec esi
jne 0x1c3cbb5
jmp 0x1c3cbe7
dec esi
jne 0x1c3cc11
jmp 0x1c3cc3f
push str....._third_partylibc_srcinclude_string:1241:_assertion___pos___size___failed:_string_index_out_of_bounds_n
push 0x1ce99e6
call fcn.01cb3fe0
int3
Function at 0x1c3cf70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov byte [eax + 3], 4
mov ecx, str.type
lea edx, [ebp - 0x28]
cmp edx, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x1c3d0b4
mov dword [ebp - 0x24], 0x650070
mov dword [ebp - 0x28], 0x790074
mov word [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x1c3d0ad
mov esi, eax
push eax
call fcn.01ca0524
add esp, 4
cmp eax, 0x7ffffff8
jae 0x1c3d0c8
mov ebx, eax
lea eax, [ebp - 0x34]
cmp ebx, 4
jbe 0x1c3d0a5
mov edi, ebx
or edi, 3
inc edi
js 0x1c3d0c3
lea eax, [edi + edi]
push eax
call fcn.01c86c86
add esp, 4
mov dword [ebp - 0x34], eax
or edi, 0x80000000
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], ebx
lea edi, [eax + ebx*2]
cmp eax, esi
seta cl
cmp edi, esi
setbe dl
or dl, cl
je 0x1c3d0b4
test ebx, ebx
je 0x1c3d043
add ebx, ebx
push ebx
push esi
push eax
call fcn.01c8a630
add esp, 0xc
mov word [edi], 0
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.01c3d0e0
add esp, 0xc
cmp byte [ebp - 0x29], 0
jns 0x1c3d06d
push dword [ebp - 0x34]
call fcn.01c86cb6
add esp, 4
cmp byte [ebp - 0x1d], 0
js 0x1c3d0d0
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.01c3d310
mov dword [0x1d1c2f0], eax
cmp byte [esi + 0xb], 0
jns 0x1c3d093
push dword [ebp - 0x1c]
call fcn.01c86cb6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [ebp - 0x29], bl
jmp 0x1c3d01d
push str....._third_partylibc_srcinclude_string:973:_assertion___s___nullptr_failed:_basic_string_const_char__detected_nullptr_n
jmp 0x1c3d0b9
push str....._third_partylibc_srcinclude__stringchar_traits.h:222:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
push 0x1ce99e6
call fcn.01cb3fe0
call fcn.01cb3190
lea ecx, [ebp - 0x34]
call fcn.01cb3170
push dword [ebp - 0x28]
call fcn.01c86cb6
add esp, 4
jmp 0x1c3d073
Function at 0x1c3d570
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c3d751
mov ebx, eax
xor eax, eax
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp ebx, 0x7ffffff8
jae 0x1c3d723
cmp ebx, 5
jae 0x1c3d6cd
lea edi, [ebp - 0x1c]
mov byte [edi + 0xb], bl
mov eax, ebx
add eax, ebx
push eax
push 0
push edi
call fcn.01c8abb0
add esp, 0xc
mov word [edi + ebx*2], 0
cmp byte [ebp - 0x11], 0
js 0x1c3d5e6
lea eax, [ebp - 0x1c]
jmp 0x1c3d5e9
mov eax, dword [ebp - 0x1c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c3d72b
movsx ebx, byte [ebp - 0x11]
test ebx, ebx
mov edx, dword [ebp - 0x18]
mov ecx, ebx
cmovs ecx, edx
cmp eax, ecx
jae 0x1c3d72b
mov edi, eax
test bl, bl
jns 0x1c3d667
sub edi, edx
ja 0x1c3d67e
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ecx + eax*2]
mov word [eax], 0
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
xorps xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
cmp byte [ebp - 0x11], 0
js 0x1c3d741
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
sub edi, ebx
ja 0x1c3d673
lea ecx, [ebp - 0x1c]
mov byte [ecx + 0xb], al
jmp 0x1c3d620
je 0x1c3d628
mov ecx, ebx
mov eax, 4
jmp 0x1c3d690
je 0x1c3d628
mov ecx, dword [ebp - 0x14]
mov eax, ecx
and eax, 0x7fffffff
dec eax
shr ecx, 0x18
mov ebx, edx
mov edx, eax
sub edx, ebx
cmp edx, edi
jb 0x1c3d6ff
test cl, cl
jns 0x1c3d6a1
mov esi, dword [ebp - 0x1c]
jmp 0x1c3d6a4
lea esi, [ebp - 0x1c]
lea eax, [esi + ebx*2]
lea ecx, [edi + edi]
push ecx
push 0
push eax
call fcn.01c8abb0
add esp, 0xc
add ebx, edi
cmp byte [ebp - 0x11], 0
jns 0x1c3d775
mov dword [ebp - 0x18], ebx
lea eax, [esi + ebx*2]
jmp 0x1c3d623
mov eax, ebx
or eax, 3
inc eax
js 0x1c3d770
mov dword [ebp - 0x20], eax
add eax, eax
push eax
call fcn.01c86c86
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
or eax, 0x80000000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
jmp 0x1c3d5c5
mov edx, edi
sub edx, eax
add edx, ebx
xor esi, esi
lea ecx, [ebp - 0x1c]
push esi
push esi
push ebx
push ebx
push edx
push eax
call fcn.01c5d1f0
lea eax, [ebp - 0x1c]
mov dword [eax + 4], ebx
mov cl, byte [eax + 0xb]
jmp 0x1c3d698
lea ecx, [ebp - 0x1c]
call fcn.01cb3170
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
movsd qword [esi], xmm0
mov dword [esi + 8], 0
jmp 0x1c3d649
push dword [ebp - 0x1c]
call fcn.01c86cb6
add esp, 4
jmp 0x1c3d653
xorps xmm0, xmm0
movsd qword [edi], xmm0
mov dword [edi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, edi
jmp 0x1c3d65f
call fcn.01cb3190
mov eax, ebx
and al, 0x7f
mov byte [ebp - 0x11], al
jmp 0x1c3d6c5
Function at 0x1c3d8b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ebx + 0xb], 0
mov esi, ebx
jns 0x1c3d8d0
mov esi, dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c3d90d
test al, 0x10
je 0x1c3d9da
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_exists___n
call fcn.01c3da40
add esp, 0xc
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
movsd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
movsx eax, byte [ebx + 0xb]
mov ecx, ebx
test eax, eax
jns 0x1c3d92b
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
add eax, eax
test eax, eax
je 0x1c3d94c
movzx edx, word [ecx + eax - 2]
add eax, 0xfffffffe
cmp edx, 0x5c
je 0x1c3d943
cmp edx, 0x2f
jne 0x1c3d92d
cmp eax, 0xfffffffe
jne 0x1c3d9f4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c3d9c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
cmp eax, 0xb7
jne 0x1c3d9ad
lea edi, [ebp - 0x2c]
mov ecx, edi
push esi
call fcn.01cc6740
cmp byte [edi + 0xb], 0
jns 0x1c3d97f
mov edi, dword [ebp - 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
mov edi, eax
cmp byte [ebp - 0x21], 0
jns 0x1c3d9a7
push dword [ebp - 0x2c]
call fcn.01c86cb6
add esp, 4
mov eax, edi
test al, al
jne 0x1c3d9c0
push dword [ebp - 0x30]
push esi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.01c3da40
add esp, 0xc
xor ebx, ebx
cmp byte [ebp - 0x15], 0
jns 0x1c3d8f9
push dword [ebp - 0x20]
call fcn.01c86cb6
add esp, 4
jmp 0x1c3d8f9
push esi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.01c3da40
add esp, 0xc
xor ebx, ebx
jmp 0x1c3d8f9
sar eax, 1
lea edx, [ebp - 0x11]
lea edi, [ebp - 0x2c]
mov ecx, edi
push edx
push eax
push 0
push ebx
call fcn.01c664f0
movsd xmm0, qword [edi]
lea eax, [ebp - 0x20]
movsd qword [eax], xmm0
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
push eax
call fcn.01c3d8b0
add esp, 4
test al, al
jne 0x1c3d94c
push str.Failed_to_create_one_of_the_parent_directories
call fcn.01c3da40
add esp, 4
jmp 0x1c3d9be

Function at 0x1c3da40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01c5b350
mov ebx, 0x1d1c2f4
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01c8bb9b
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c3e350
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d1cb0c]
mov ecx, dword [0x1d1a468]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c3e39d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, 0x1d1cb08
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1d1cb0c
call fcn.01c86cf1
add esp, 4
cmp dword [0x1d1cb0c], 0xffffffff
jne 0x1c3e383
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.01c8abb0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.01c86c86
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x1d1cb3c]
mov ecx, dword [0x1d1a468]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c3e446
mov ecx, esi
push ebx
push 0x1d1cb18
push edi
call fcn.01c3e540
mov dword [0x1d1cb08], esi
push 0x1d1cb0c
call fcn.01c86d6b
add esp, 4
jmp 0x1c3e383
push 0x1d1cb3c
call fcn.01c86cf1
add esp, 4
cmp dword [0x1d1cb3c], 0xffffffff
jne 0x1c3e420
xorps xmm0, xmm0
movups xmmword [0x1d1cb28], xmm0
movups xmmword [0x1d1cb18], xmm0
mov dword [0x1d1cb38], 0
push 0x1d1cb18
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d1cb3c
call fcn.01c86d6b
add esp, 4
jmp 0x1c3e420

Function at 0x1c3e4a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d1cb3c]
mov ecx, dword [0x1d1a468]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c3e4d1
movzx eax, word [0x1d1cb18]
cmp eax, 9
jne 0x1c3e51c
xor eax, eax
inc eax
pop ebp
ret
push 0x1d1cb3c
call fcn.01c86cf1
add esp, 4
cmp dword [0x1d1cb3c], 0xffffffff
jne 0x1c3e4c0
xorps xmm0, xmm0
movups xmmword [0x1d1cb28], xmm0
movups xmmword [0x1d1cb18], xmm0
mov dword [0x1d1cb38], 0
push 0x1d1cb18
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d1cb3c
call fcn.01c86d6b
add esp, 4
jmp 0x1c3e4c0
test eax, eax
je 0x1c3e4cf
cmp eax, 6
jne 0x1c3e52c
mov eax, 2
jmp 0x1c3e4cf
cmp eax, 0xc
jne 0x1c3e538
mov eax, 3
jmp 0x1c3e4cf
mov eax, 4
jmp 0x1c3e4cf

Function at 0x1c3ec50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1c3ec8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x1c3eca2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1c3ec84
mov dword [esi], ebx
call fcn.01c695f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x1c3ecb9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.01c695f0
push dword [esi]
call fcn.01c6ca00
add esp, 4
mov dword [esi], 0
jmp 0x1c3ec75
int3
Function at 0x1c47920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c47993
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1c4797d
cmp dword [ebp - 0x18], 4
jne 0x1c4797d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x1c4797d

Function at 0x1c479a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.01c87ff0
mov esi, ecx
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.01c8abb0
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c47a2f
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x1c47a33
mov ecx, esi
push edi
call fcn.01c39e00
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x1c47a16
cmp eax, 2
jne 0x1c47a75
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.01c8abb0
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x1c47a7c
mov ecx, esi
push ebx
jmp 0x1c47a0f
mov esi, 0x3f4
jmp 0x1c47a16
mov esi, 0xea
jmp 0x1c47a16
Function at 0x1c4b590
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1cff040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movsx ecx, byte [eax + 0xb]
test ecx, ecx
jns 0x1c4b5b4
mov ecx, dword [eax + 4]
mov eax, dword [eax]
test ecx, ecx
js 0x1c4b646
sete dl
test eax, eax
setne dh
or dh, dl
je 0x1c4b64d
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x1c]
push ecx
push eax
push esi
call fcn.01c68220
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x1c4b5e6
mov esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x28]
push ebx
push dword [ebp + 8]
push edi
call fcn.01c68220
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1c4b5ff
mov edi, dword [ebp - 0x28]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x1d], 0
jns 0x1c4b61a
push dword [ebp - 0x28]
call fcn.01c86cb6
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x1c4b62b
push dword [ebp - 0x1c]
call fcn.01c86cb6
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
jmp 0x1c4b652
push str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
push 0x1ce99e6
call fcn.01cb3fe0
int3

Function at 0x1c4b6d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.01c87ff0
mov esi, dword [ebp + 8]
mov eax, dword [0x1cff040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.01c68220
add esp, 0xc
test esi, esi
je 0x1c4b789
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.01c8abb0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x1c4b735
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x1c4b75b
cmp eax, 0x7fff
jae 0x1c4b7b2
push esi
push eax
push edi
call fcn.01c3f720
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x1c4b772
push dword [ebp - 0x1001c]
call fcn.01c86cb6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c87bd3
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x1c4b79a
lea eax, [ebp - 0x1001c]
jmp 0x1c4b7a0
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x1c4b75b
int3