joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x14761b56
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x75c5598f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x448fdf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004491d2
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00453d27
xor ebx, ebx
cmp eax, ebx
jne 0x44918d
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004491d2
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00450a06
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004a22fb
add esp, 0x10
test eax, eax
jne 0x4490a8
push esi
call fcn.00446691
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4490a8
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x449093
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4490a8
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4490a1
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call int.0045523a
cmp byte [esp + 0x13], bl
je 0x4490d8
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0044920f
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x449148
push 0x14
call fcn.004a1568
cmp eax, ebx
pop ecx
je 0x449102
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x449104
xor edi, edi
cmp edi, ebx
je 0x449148
push esi
push edi
call fcn.00448735
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004487fd
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00448926
add esp, 0x18
call fcn.004491d2
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004533f4
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x44915f
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x449171
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4491b4
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4491b4
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004487fd
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00448926
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45439d
Capabilities:
Encode data using xor

Disassembly:
sbb al, byte [edx - 0x7f]
mov ecx, 0xe090f03a
mov ecx, 0xff07b5dd
dec eax
loopne 0x45441d
mov dh, byte [esi - 0x3c8ac03c]
aad 0xc0
and dword [0x834cdf72], esp
jle 0x4543d6
mov dword [edi], esi
mov al, 0x8e
stosd dword es:[edi], eax
jb 0x4543c7
add ebx, ebp
xor al, 0x38
push 0xf61033d8
mov edi, 0x43560abf
imul esp
jmp 0x4543fd
invalid
invalid
invalid
invalid
invalid
Function at 0x46a183
Capabilities:
Encode data using xor

Disassembly:
adc dword [edi - 0x46], 0x6dac495f
arpl word [ebx - 0x38a136ce], di
sbb dword [edx], 3
sbb al, 0x4d
invalid
Function at 0x48a728
Capabilities:
Encode data using xor

Disassembly:
jmp 0x48a731
popal
sub eax, 0x57cb0b16
push edi
fucom st(6)
mov dl, byte [edi]
mov bl, byte [edi]
xor al, 0x3d
sub eax, 0xcbf3ab56
jnp 0x48a72c
insb byte es:[edi], dx
enter 0xffffffffffffcbbe, 0xffffffffffffffd4
mov ah, 0xd6
pop edi
invalid
Function at 0x48e51f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0048e712
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00499267
xor ebx, ebx
cmp eax, ebx
jne 0x48e6cd
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0048e712
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00495f46
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4e783b
add esp, 0x10
test eax, eax
jne 0x48e5e8
push esi
call fcn.0048bbd1
mov esi, eax
cmp esi, ebx
pop ecx
je 0x48e5e8
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x48e5d3
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x48e5e8
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48e5e1
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0049a77a
cmp byte [esp + 0x13], bl
je 0x48e618
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0048e74f
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x48e688
push 0x14
call 0x4e6aa8
cmp eax, ebx
pop ecx
je 0x48e642
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x48e644
xor edi, edi
cmp edi, ebx
je 0x48e688
push esi
push edi
call fcn.0048dc75
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0048dd3d
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048de66
add esp, 0x18
call fcn.0048e712
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00498934
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48e69f
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x48e6b1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x48e6f4
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x48e6f4
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0048dd3d
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048de66
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4acfcb
Capabilities:
Check for software breakpoints

Disassembly:
imul ebp, dword [edx + 0x3b2292e6], 0xffffffe5
outsb dx, byte [esi]
mov esi, 0x431f39d1
aas
test byte [edx + edi*8], bh
in eax, 0xcc
out dx, al
dec ebp
daa
les edx, [edi - 0x6a]
inc esi
mov al, byte [0x75895d93]
cmpsb byte [esi], byte es:[edi]
adc ah, byte [eax + 0x66]
scasd eax, dword es:[edi]
invalid

Function at 0x4ad00a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xd29dde9c
dec ebx
pop es
jo 0x4ad085
or cl, byte [edx]
inc eax
invalid
rcr al, cl
stc
lodsb al, byte [esi]
ret
out dx, eax
imul edx, dword [edi], 0x8925337f
shr eax, cl
sub al, 0xc9
pop ss
jg 0x4ad0bd
and eax, 0x2ce8d389
leave
or ch, bh
cmp eax, 0x90cb0456
adc dword [edi - 0x70], edx
test eax, 0x33be89dd
fcmove st(0), st(4)
adc eax, 0xbdac3d2d
dec ecx
mov dword [esi + 0x15ccda33], edi
sub eax, 0x49bdac3d
cli
cmpsd dword [esi], dword es:[edi]
xor byte [eax + ebx*8], 0x6d
ficomp dword [eax]
jo 0x4ad087
add ebp, dword [edx - 0x1345ea72]
add byte [ecx + 0x50abf44a], 0xea
add dword [edi - 0x58], esp
add dh, byte [ebp - 0x24469bfa]
loop 0x4ad09c
ljmp 0x6b5:0x2a86701
xchg ebx, eax
je 0x4ad07b
push ebp
loope 0x4ad13e
xchg ecx, eax
push edx
sar dword [eax], cl
inc edx
fisttp dword [edx + 0x50]
invalid
add eax, 0xc488cbeb
mov edi, 0xb36373e9
aaa
mov dh, 0x77
xor byte [edx], ah
lodsb al, byte [esi]
invalid

Function at 0x4afdfa
Capabilities:
Encode data using xor

Disassembly:
ror dword [ebx], 0x19
bound ebx, qword [esi + 0x3db91714]

Function at 0x4b83aa
Capabilities:
Encode data using xor

Disassembly:
cli
lea ecx, [ebx - 0xee2d8c4]
sub byte [0xa5ecc43f], cl
in al, dx
movsd dword es:[edi], dword [esi]
Function at 0x10035270
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016ac6b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x10200854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x10035448
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
cmp byte [esi + 0xc], 0
jne 0x10035448
lea eax, [ebp - 0x1b8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10035448
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100352e1
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x100352ef
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x12
xor eax, eax
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1bc], 0
lea ecx, [ebp - 0x1d0]
push str.DnsAntiHijackParam
mov byte [esi + 0xc], 1
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1bc], 7
mov word [ebp - 0x1d0], ax
call fcn.10004820
mov dword [ebp - 4], 0
xor eax, eax
push 0x24
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
push str.10E0F78A_7E9D_4375_838C_24A971E345D2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10004820
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.10072e00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.100047b0
mov byte [esi + 8], 1
cmp dword [0x10208ecc], 0
je 0x10035448
push 0
mov ecx, 0x10208ecc
call fcn.10125700
mov eax, dword [0x10208ecc]
cmp byte [eax + 0x54], 0
je 0x10035448
cmp dword [eax + 0x58], 4
jb 0x10035448
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x28]
push 0xb
push 0x101b2ea8
call fcn.10004820
push 0x44
push str.RC::RCDnsAntiHijackProcessor::StartJob
push str.d:jenkinsworkspacepc_2345mpcsafe_build_2_rhinoprotect_rtpsystem_src_sdhipslogic_srcdnsantihijack_rcdnsantihijackprocessor.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x10208ecc
push eax
push 4
call fcn.10126060
test bl, bl
je 0x10035439
lea eax, [ebp - 0x28]
mov ecx, 0x10208ecc
push eax
call fcn.10126380
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101611d3
mov esp, ebp
pop ebp
ret 4
Function at 0x10047fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016d8f7
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10200854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov word [esi + 0x30], 0x101
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10047ff1
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi], 0
mov dword [esi + 0x2c], eax
jne 0x1004807a
push 0xc
call fcn.101611e4
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push esi
movq qword [eax], xmm0
mov ecx, eax
push 0x10048280
mov dword [eax + 8], 0
call fcn.100fafe0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov edi, dword [esi]
cmp edi, ebx
je 0x10048073
mov ecx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test ebx, ebx
je 0x10048057
push 1
lea eax, [ebx + 4]
push eax
call ecx
mov edi, dword [esi]
mov ecx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test edi, edi
je 0x1004806f
push 0xffffffffffffffff
lea eax, [edi + 4]
push eax
call ecx
sub eax, 1
jne 0x1004806f
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [esi], ebx
mov edi, ebx
mov ecx, edi
call fcn.100fb240
cmp dword [0x10208ecc], 0
je 0x1004811c
push 0
mov ecx, 0x10208ecc
call fcn.10125700
mov eax, dword [0x10208ecc]
cmp byte [eax + 0x54], 0
je 0x1004811c
cmp dword [eax + 0x58], 4
jb 0x1004811c
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0xc
push 0x101b68b4
call fcn.10004820
push 0x43
push str.RC::RCSoftMgrHelper::Start
push str.d:jenkinsworkspacepc_2345mpcsafe_build_2_rhinoprotect_rtpsystem_src_sdhipslogic_src_softmgrhelper_rcsoftmgrhelper.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x10208ecc
push eax
push 4
call fcn.10126060
test bl, bl
je 0x1004810d
lea eax, [ebp - 0x28]
mov ecx, 0x10208ecc
push eax
call fcn.10126380
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101611d3
mov esp, ebp
pop ebp
ret
Function at 0x1006c810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov edx, ecx
test edi, edi
je 0x1006c84c
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1006c84b
not dword [edx]
movzx eax, byte [edi]
lea edi, [edi + 1]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x101bb5e8]
xor eax, ecx
mov dword [edx], eax
sub esi, 1
jne 0x1006c827
not eax
mov dword [edx], eax
pop esi
pop edi
pop ebp
ret 8
Function at 0x1007b260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016dd60
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10200854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 4]
mov dword [edi + 0x28], 1
push eax
push 0
push 4
lea eax, [edi + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
test esi, esi
jne 0x1007b2c4
cmp eax, 0x3e5
sete bl
test bl, bl
jne 0x1007b35f
cmp dword [0x10208ecc], 0
je 0x1007b41a
push 0
mov ecx, 0x10208ecc
call fcn.10125700
mov eax, dword [0x10208ecc]
cmp byte [eax + 0x54], bl
je 0x1007b41a
cmp dword [eax + 0x58], 2
jb 0x1007b41a
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x1007b330
mov eax, dword [eax]
push dword [ebp - 0x2c]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push edi
push str.request_next_failed__p__p__s___d
push eax
call fcn.100620d0
add esp, 0x18
lea eax, [ebp - 0x28]
push 0x34
push str.RC::RCNamePipeServer::RCPipeClientNode::RequestNext
push str.d:jenkinsworkspacepc_2345mpcsafe_build_2_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 2
jmp 0x1007b3ef
cmp dword [0x10208ecc], 0
je 0x1007b41a
push 0
mov ecx, 0x10208ecc
call fcn.10125700
mov eax, dword [0x10208ecc]
cmp byte [eax + 0x54], 0
je 0x1007b41a
cmp dword [eax + 0x58], 5
jb 0x1007b41a
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x1007b3c8
mov eax, dword [eax]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push edi
push str.request_next__p__p__s
push eax
call fcn.100620d0
add esp, 0x14
lea eax, [ebp - 0x28]
push 0x3c
push str.RC::RCNamePipeServer::RCPipeClientNode::RequestNext
push str.d:jenkinsworkspacepc_2345mpcsafe_build_2_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 5
mov ecx, 0x10208ecc
call fcn.10126060
test bh, bh
je 0x1007b40b
lea eax, [ebp - 0x28]
mov ecx, 0x10208ecc
push eax
call fcn.10126380
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101611d3
mov esp, ebp
pop ebp
ret
Function at 0x1007b440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016dd60
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10200854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x20]
lea esi, [edi + 0x1c]
sub eax, dword [esi]
mov ecx, dword [edi + 0x18]
cmp eax, ecx
jae 0x1007b488
push esi
push ecx
mov ecx, esi
call fcn.10010120
mov ecx, dword [edi + 0x18]
lea eax, [edi + 4]
mov dword [edi + 0x28], 2
push eax
push 0
push ecx
push dword [esi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
test esi, esi
jne 0x1007b4bc
cmp eax, 0x3e5
sete bl
test bl, bl
jne 0x1007b557
cmp dword [0x10208ecc], 0
je 0x1007b615
push 0
mov ecx, 0x10208ecc
call fcn.10125700
mov eax, dword [0x10208ecc]
cmp byte [eax + 0x54], bl
je 0x1007b615
cmp dword [eax + 0x58], 2
jb 0x1007b615
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x1007b528
mov eax, dword [eax]
push dword [ebp - 0x2c]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push edi
push str.request_data_failed__p__p__s___d
push eax
call fcn.100620d0
add esp, 0x18
lea eax, [ebp - 0x28]
push 0x5a
push str.RC::RCNamePipeServer::RCPipeClientNode::RequestData
push str.d:jenkinsworkspacepc_2345mpcsafe_build_2_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 2
jmp 0x1007b5ea
cmp dword [0x10208ecc], 0
je 0x1007b615
push 0
mov ecx, 0x10208ecc
call fcn.10125700
mov eax, dword [0x10208ecc]
cmp byte [eax + 0x54], 0
je 0x1007b615
cmp dword [eax + 0x58], 5
jb 0x1007b615
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x1007b5c0
mov eax, dword [eax]
push dword [edi + 0x18]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push edi
push str.request_data__p__p__s___d
push eax
call fcn.100620d0
add esp, 0x18
lea eax, [ebp - 0x28]
push 0x63
push str.RC::RCNamePipeServer::RCPipeClientNode::RequestData
push str.d:jenkinsworkspacepc_2345mpcsafe_build_2_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 5
mov ecx, 0x10208ecc
call fcn.10126060
test bh, bh
je 0x1007b606
lea eax, [ebp - 0x28]
mov ecx, 0x10208ecc
push eax
call fcn.10126380
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101611d3
mov esp, ebp
pop ebp
ret
Function at 0x1007b9d0
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016dd60
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10200854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 4]
mov dword [edi + 0x28], 0
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esi, eax
test esi, esi
setne bh
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
test esi, esi
jne 0x1007ba2c
cmp eax, 0x3e5
sete bh
test bh, bh
jne 0x1007babe
cmp dword [0x10208ecc], 0
je 0x1007bb70
push 0
mov ecx, 0x10208ecc
call fcn.10125700
mov eax, dword [0x10208ecc]
cmp byte [eax + 0x54], bh
je 0x1007bb70
cmp dword [eax + 0x58], 2
jb 0x1007bb70
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [edi]
push edi
push str.start_listen_failed__p__p___d
push eax
call fcn.100620d0
add esp, 0x14
lea eax, [ebp - 0x28]
push 0xa9
push str.RC::RCNamePipeServer::RCPipeClientNode::StartListen
push str.d:jenkinsworkspacepc_2345mpcsafe_build_2_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 2
jmp 0x1007bb45
cmp dword [0x10208ecc], 0
je 0x1007bb70
push 0
mov ecx, 0x10208ecc
call fcn.10125700
mov eax, dword [0x10208ecc]
cmp byte [eax + 0x54], 0
je 0x1007bb70
cmp dword [eax + 0x58], 5
jb 0x1007bb70
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x28]
push dword [edi]
push edi
push str.start_new_listen_success___p__p
push eax
call fcn.100620d0
add esp, 0x10
lea eax, [ebp - 0x28]
push 0xb0
push str.RC::RCNamePipeServer::RCPipeClientNode::StartListen
push str.d:jenkinsworkspacepc_2345mpcsafe_build_2_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 5
mov ecx, 0x10208ecc
call fcn.10126060
test bl, bl
je 0x1007bb61
lea eax, [ebp - 0x28]
mov ecx, 0x10208ecc
push eax
call fcn.10126380
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov al, bh
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101611d3
mov esp, ebp
pop ebp
ret