joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c7dfdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c7dfff
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c7e018
test eax, 0x410
sete bl
jmp 0x1c7e0bd
push 2
call fcn.01c64270
add esp, 4
test al, al
je 0x1c7e0bb
call fcn.01c64b80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c64d20
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01c23dd0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c7e069
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.01c4af70
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c7e08e
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.01c23dd0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c7e0b0
push dword [ebp - 0xc4]
call fcn.01caae80
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01c64dd0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c7e0d4
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c7e0f7
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c7e12a
and eax, 0x410
cmp eax, 0x410
jne 0x1c7e12a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01c7e204
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c7e134
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x1c7e1ed
push 2
call fcn.01c64270
add esp, 4
test al, al
je 0x1c7e1eb
call fcn.01c64b80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c64d20
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.01c23dd0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c7e199
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c4af70
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c7e1be
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.01c23dd0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c7e1e0
push dword [ebp - 0xc4]
call fcn.01caae80
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01c64dd0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c7e204
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c7e226
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x1c7e2e3
push 2
call fcn.01c64270
add esp, 4
test al, al
je 0x1c7e2e3
call fcn.01c64b80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c64d20
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.01c23dd0
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x1c7e28c
mov ecx, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.01c4af70
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c7e2b1
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push dword [ebp - 0xc8]
call fcn.01c23dd0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c7e2d8
push dword [ebp - 0xc4]
call fcn.01caae80
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01c64dd0
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c7ec80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov edi, dword [ebp + 0x14]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea ebx, [esp + 0x10]
push 0x3e
push str..._.._base_files_file_win.cc
push str.Read
push ebx
call fcn.01c56aa0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.01c76110
test edi, edi
js 0x1c7ed53
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c820c0
test al, al
je 0x1c7ed0f
lea ecx, [esp + 0x28]
push 0
push edi
push esi
push str.File::Read
call fcn.01c821d0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c7ed5a
mov ebx, dword [esp + 0xc]
jmp 0x1c7ed6a
mov ebx, 0xffffffff
jmp 0x1c7ed73
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x28]
call fcn.01c82160
lea ecx, [esp + 0x30]
call fcn.01c76170
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1c7eda0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea ebx, [esp + 0x10]
push 0x57
push str..._.._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.01c56aa0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.01c76110
test edi, edi
js 0x1c7ee52
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01c820c0
test al, al
je 0x1c7ee2f
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::ReadAtCurrentPos
call fcn.01c821d0
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c7ee59
mov ebx, dword [esp + 0xc]
jmp 0x1c7ee69
mov ebx, 0xffffffff
jmp 0x1c7ee72
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x10]
call fcn.01c82160
lea ecx, [esp + 0x20]
call fcn.01c76170
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01caaec1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x1c7eea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov edi, dword [ebp + 0x14]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea ebx, [esp + 0x10]
push 0x73
push str..._.._base_files_file_win.cc
push str.Write
push ebx
call fcn.01c56aa0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.01c76110
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c820c0
test al, al
je 0x1c7ef2f
mov eax, edi
sar eax, 0x1f
lea ecx, [esp + 0x28]
push eax
push edi
push esi
push str.File::Write
call fcn.01c821d0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.01c82160
lea ecx, [esp + 0x30]
call fcn.01c76170
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01caaec1
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1c7efa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea ebx, [esp + 0x10]
push 0x88
push str..._.._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.01c56aa0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.01c76110
test edi, edi
js 0x1c7f061
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01c820c0
test al, al
je 0x1c7f032
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::WriteAtCurrentPos
call fcn.01c821d0
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.01c82160
jmp 0x1c7f066
mov esi, 0xffffffff
lea ecx, [esp + 0x20]
call fcn.01c76170
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01caaec1
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c7f150
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea esi, [esp + 0x10]
push 0x160
push str..._.._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.01c56aa0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push esi
call fcn.01c76110
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov ecx, 1
cmove ecx, eax
test bl, 4
mov edx, 4
cmovne ecx, edx
test bl, 8
mov esi, 2
cmove esi, ecx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x1c7f30d
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov ecx, ebx
and ecx, 0x40
shl ecx, 0x18
test bl, 0x80
cmove edx, ecx
mov ecx, ebx
rol ecx, 0x1a
mov esi, ebx
shl esi, 0xb
and esi, 0x20000000
mov edi, ebx
shr edi, 4
and edi, 0x10000
and ecx, 0x80000100
or ecx, esi
or ecx, edi
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
mov esi, ebx
and esi, 0x400
mov eax, ebx
mov dword [esp + 0xc], esi
mov ebx, esi
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, eax
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, eax
shl edi, 8
mov ebx, edi
and ebx, 0x2000000
or ebx, esi
and edi, 0x8000000
or edi, ebx
mov esi, dword [ebp + 8]
xor edx, 3
cmp byte [esi + 0xb], 0
jns 0x1c7f299
mov esi, dword [esi]
mov ebx, dword [esp + 8]
mov eax, dword [esp + 4]
push 0
push edi
push eax
push 0
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp dword [ebx], eax
je 0x1c7f2f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jb 0x1c7f2db
call fcn.01c56ad0
push dword [ebx]
call fcn.01c56ae0
add esp, 4
mov dword [ebx], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x1c7f2ea
mov dword [ebx], edi
call fcn.01c56ad0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
jae 0x1c7f31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01c7f090
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x1c7f34f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [edi + 0x14], 0xffffffff
jmp 0x1c7f34f
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
mov eax, dword [ebp + 0xc]
test al, 4
jne 0x1c7f340
test al, 0xa
je 0x1c7f34f
mov byte [ebx + 0x18], 1
jmp 0x1c7f34f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [ebx + 0x18]
lea ecx, [esp + 0x20]
call fcn.01c76170
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01caaec1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c7f7f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x1c7f801
test eax, eax
jne 0x1c7f851
test eax, eax
jne 0x1c7f817
mov ecx, dword [0x1d1b0e4]
test ecx, ecx
je 0x1c7f817
call dword [section..00cfg]
call ecx
cmp dword [0x1d1b0dc], 0
je 0x1c7f851
mov esi, dword [0x1d1b0e0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x1c7f857
test esi, esi
je 0x1c7f851
mov ecx, dword [0x1d1b0dc]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x1c7f83f
jmp 0x1c7f851

Function at 0x1c82280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d1b110]
mov ecx, dword [0x1d0dc5c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c822ab
mov ecx, 0x1d1b108
pop ebp
jmp fcn.01c707e0
push 0x1d1b110
call fcn.01caaf07
add esp, 4
cmp dword [0x1d1b110], 0xffffffff
jne 0x1c822a0
mov dword [0x1d1b10c], 0
mov dword [0x1d1b108], 0
mov ecx, 0x1d1b108
push 0
call fcn.01c70850
push 0x1d1b110
call fcn.01caaf7d
add esp, 4
jmp 0x1c822a0

Function at 0x1c82e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x1c82f16
mov esi, ecx
mov dword [esp + 0x14], 0x9ff00ff
mov dword [esp + 0xc], 0x63736964
mov dword [esp + 0x10], 0x65647261
mov byte [esp + 0x14], 0x64
lea eax, [esp + 0xc]
mov edi, esp
push eax
push edi
call fcn.01c82df0
push 0x48
call fcn.01caae50
add esp, 4
mov ebx, eax
mov ecx, eax
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x14]
push eax
call fcn.01c844e0
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x1c82f00
mov ecx, edi
call fcn.01c84550
push edi
call fcn.01caae80
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x1c82f13
push dword [esp + 0xc]
call fcn.01caae80
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01caaec1
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1c8f4e4
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01c7e0d4
Function at 0x1c9b000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x1c9b079
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x1c9b01c
xor esi, esi
jmp 0x1c9b05e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x1ce1db8]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x1ce1db8]
add esi, 2
cmp ebx, esi
jne 0x1c9b030
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x1c9b079
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x1ce1db8]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c9f0f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1cf151c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
jne 0x1c9f1ed
mov dword [ebp - 0x14], 0x1c9f210
lea eax, [ebp - 0x14]
push 0
push eax
push 0x1c9f0d0
push 0x1d1bde0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c9f201
cmp dword [0x1d1bde4], 0
jne 0x1c9f1ed
push dword [0x1d1bde8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c9f1ed
mov esi, eax
push 0x1d1bdec
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ebx, dword [0x1d1bdf0]
mov edi, dword [0x1d1bdf4]
mov eax, dword [0x1d1bdf8]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1d1bdfc]
mov dword [ebp - 0x20], eax
push 0x1d1bdec
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test ebx, ebx
je 0x1c9f1a3
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, ebx
call dword [section..00cfg]
push dword [ebp - 0x18]
call ebx
add esp, 4
test edi, edi
je 0x1c9f1b8
mov ebx, dword [esi + 4]
mov ecx, edi
call dword [section..00cfg]
push ebx
call edi
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1c9f1ce
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1c9f1e4
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
push esi
call fcn.01c9b090
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.01cbd630
int3
Function at 0x1ccc301
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01ccc54a

Function at 0x1ccf535
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01ccf540
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
invalid
jno 0x41538d
int 0x61
or al, 0x7a
clc
jmp 0xfe47d94b
outsb dx, byte [esi]
jno 0x4153c7
mov dword [0x2460183e], eax
cmp edi, ecx
imul esi, dword [ebp + 0xf01bb29], 0xd95b10cd
lds eax, [edi]
push ecx
lea edi, [edi - 0x7d6500bb]
clc
xor dword [esi], esp
cmp eax, dword [edx + 5]
push ebp
js 0x4153fe
mov ecx, 0x1b94b25
lea ebp, [ebx + 7]
invalid

Function at 0x914384
Capabilities:
Encode data using xor

Disassembly:
jmp 0x91438e
pushal
call 0x914394
pop ebp
sub ebp, 0x10
sub ebp, 0x514384
jmp 0x9143aa
mov eax, 0x514384
add eax, ebp
add eax, 0x4c
mov ecx, 0x605
mov edx, 0x8b0a8d46
xor byte [eax], dl
inc eax
dec ecx
jne 0x9143c1
jmp 0x9143d4
int 0x8b
int 0xcf
jp 0x914420
inc esi
inc esi
mov dword [edi + 0x464646be], 0x40fe8b45
inc esi
inc esi
inc esi
cld
outsb dx, byte [esi]
inc esi
inc esi
inc esi
mov cl, 0xa4
inc ebp
mov cs, ebp
invalid
bound edi, qword [edx - 0x349d9531]
sub ah, byte [edx + 0x46]
int 0xc3
dec esi
inc esi
inc esi
inc esi
int 0xd3
dec edx
inc esi
inc esi
inc esi
int 0xcb
push esi
inc esi
inc esi
inc esi
xchg dword [edi - 0x3abb88bc], ebp
test byte [edx + 0xf], al
dec ecx
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xfe1100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0xfe5042], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0xfe5228
push 0xfe5290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xfe114b
xor eax, eax
jmp 0xfe1166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10038543
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003858f
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10038580
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1003858d
push 0
push 0x2573
call dword [sym.imp.GDI32.dll_GetClipBox]
jmp 0x100385df
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100385c5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100385c3
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x100385df
push 0
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret