joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c1c9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c648]
jne 0x40c1d3
repz ret
jmp fcn.004125fe

Function at 0x418391
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040dc85
and dword [ebp - 4], 0
cmp dword [0xa0428c], 0
mov ebx, eax
jne 0x418442
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4184f3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4204b4
push edi
call esi
test eax, eax
je 0x4184f3
push eax
call fcn.0040dc13
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0xa0428c], eax
call esi
push eax
call fcn.0040dc13
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0xa04290], eax
call esi
push eax
call fcn.0040dc13
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0xa04294], eax
call esi
push eax
call fcn.0040dc13
pop ecx
mov dword [0xa0429c], eax
test eax, eax
je 0x418442
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040dc13
pop ecx
mov dword [0xa04298], eax
mov eax, dword [0xa04298]
cmp eax, ebx
je 0x41849a
cmp dword [0xa0429c], ebx
je 0x41849a
push eax
call fcn.0040dc8e
push dword [0xa0429c]
mov esi, eax
call fcn.0040dc8e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41849a
test edi, edi
je 0x41849a
call esi
test eax, eax
je 0x418491
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x418491
test byte [ebp - 0xc], 1
jne 0x41849a
or dword [ebp + 0x10], 0x200000
jmp 0x4184d3
mov eax, dword [0xa04290]
cmp eax, ebx
je 0x4184d3
push eax
call fcn.0040dc8e
pop ecx
test eax, eax
je 0x4184d3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4184d3
mov eax, dword [0xa04294]
cmp eax, ebx
je 0x4184d3
push eax
call fcn.0040dc8e
pop ecx
test eax, eax
je 0x4184d3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0xa0428c]
call fcn.0040dc8e
pop ecx
test eax, eax
je 0x4184f3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4184f5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007540
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10161fb1
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x101fe854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
lea eax, [esi + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xb4], eax
je 0x10007661
push 7
mov edx, esi
lea ecx, [ebp - 0xb0]
call fcn.100efde0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x100075a8
mov eax, dword [eax]
mov edx, str.device
mov ecx, eax
call fcn.100efa70
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100047b0
test bl, bl
je 0x100075f1
cmp edi, esi
je 0x1000772d
cmp dword [esi + 0x14], 8
jb 0x100075dc
mov esi, dword [esi]
mov ebx, dword [ebp - 0xb4]
mov ecx, edi
push dword [ebx]
push esi
call fcn.10004820
jmp 0x1000772d
cmp dword [edi + 0x14], 8
mov eax, edi
mov dword [edi + 0x10], 0
jb 0x10007602
mov eax, dword [edi]
mov ebx, dword [ebp - 0xb4]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebx], 2
jb 0x10007661
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb4], esp
push esi
call fcn.10004e10
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.10104be0
add esp, 0x18
mov dword [ebp - 4], 2
cmp dword [ebp - 0xa0], 0
jne 0x10007668
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100047b0
xor al, al
jmp 0x1000772f
push 0x80
lea eax, [ebp - 0x98]
mov dword [ebp - 0x16], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1000768f
mov eax, dword [esi]
mov ax, word [eax]
mov word [ebp - 0x18], ax
mov eax, esi
jb 0x1000769c
mov eax, dword [esi]
mov ax, word [eax + 2]
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x98]
push 0x40
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1000764f
lea ecx, [ebp - 0x98]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100076d0
sub ecx, edx
lea eax, [ebp - 0x98]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.1000e430
cmp dword [ebx], 2
jbe 0x1000771b
cmp dword [esi + 0x14], 8
jb 0x100076fb
mov esi, dword [esi]
add esi, 4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007703
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.1000e430
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100047b0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015f463
mov esp, ebp
pop ebp
ret 8
Function at 0x10009460
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162677
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x101fe854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.RC::ISimpleDownloadEvent.0
mov dword [ebp - 4], 0
lea eax, [ebx + 8]
mov dword [ebx + 4], vtable.RC::ISolitaryFunctionCtrlListener.0
xor ecx, ecx
mov dword [ebx], vtable.RC::RCBHORcmdBrowser.1.0
mov dword [ebx + 4], vtable.RC::RCBHORcmdBrowser.0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 7
mov word [eax + 8], cx
mov byte [ebp - 4], 2
lea eax, [ebx + 0x28]
mov dword [ebp - 0x14], eax
mov dword [eax], ecx
mov byte [eax + 4], cl
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], 7
mov word [eax + 8], cx
mov byte [ebp - 4], 4
mov dword [ebx + 0x48], ecx
mov byte [ebp - 4], 5
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x54], ecx
mov byte [ebp - 4], 6
mov dword [ebx + 0x58], ecx
mov dword [ebx + 0x5c], ecx
mov dword [ebx + 0x60], ecx
mov byte [ebp - 4], 7
lea eax, [ebx + 0x64]
mov dword [ebp - 0x14], eax
mov dword [eax], 1
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], 7
mov word [eax + 4], cx
mov byte [ebp - 4], 8
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], 7
mov word [eax + 0x1c], cx
mov byte [ebp - 4], 0xa
xor eax, eax
mov byte [ebx + 0x98], cl
mov dword [ebx + 0x9c], ecx
mov dword [ebx + 0xa0], ecx
mov dword [ebx + 0xa4], ecx
mov dword [ebx + 0xa8], ecx
mov dword [ebx + 0xac], ecx
mov dword [ebx + 0xb0], ecx
mov dword [ebx + 0xb4], ecx
mov dword [ebx + 0xc8], ecx
mov dword [ebx + 0xcc], 7
mov word [ebx + 0xb8], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebx + 0xd8]
mov dword [ebp - 0x14], ecx
mov dword [ebx + 0xd0], eax
mov dword [ecx], eax
add ecx, 8
call fcn.100092a0
mov byte [ebp - 4], 0xd
xor eax, eax
mov byte [ebx + 0x178], 0
mov dword [ebx + 0x18c], 0
mov dword [ebx + 0x190], 7
mov word [ebx + 0x17c], ax
mov byte [ebp - 4], 0xe
push 8
call fcn.1015f474
mov esi, eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xf
mov dword [esi], 0
mov byte [ebp - 4], 0x10
push 0x18
call fcn.1015f474
add esp, 8
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0xe
mov dword [ebx + 0x194], esi
mov byte [ebp - 4], 0x12
lea ecx, [ebx + 0x198]
push 0x33
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.FF4855A3_CB3B_4E03_835E_A71240711E0E_FM_RBBHO_MUTEX
mov word [ecx], ax
call fcn.10004820
mov byte [ebp - 4], 0x13
push 0x18
mov byte [ebx + 0x1b0], 0
call fcn.1015f474
add esp, 4
mov dword [ebx + 0x1b4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b6c0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164de1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101fe854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.1001b8c0
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov word [ebx + 0xc], 0
mov dword [ebp - 4], 0
lea edi, [ebx + 0x10]
mov dword [ebp - 0x18], edi
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.10004e10
mov byte [ebp - 4], 1
add esi, 0x18
add edi, 0x18
mov dword [ebp + 8], edi
push esi
mov ecx, edi
call fcn.10004e10
mov byte [ebp - 4], 2
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10004e10
mov byte [ebp - 4], 3
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10004e10
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b940
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164ea1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101fe854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.100047b0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.100047b0
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.100047b0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.100047b0
push 0x70
push ebx
call fcn.1015f4a4
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10032440
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1394
call fcn.10161580
mov eax, dword [0x101fe854]
xor eax, esp
mov dword [esp + 0x1390], eax
push ebx
push esi
push edi
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [esp + 0x1394], 0xffffffff
mov ecx, 1
mov dword [esp + 0x14], eax
nop dword [eax + eax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [esp + ecx*4 + 0x14], eax
inc ecx
cmp ecx, 0x270
jl 0x10032480
mov esi, dword [ebp + 8]
dec esi
mov dword [esp + 0x10], 0x270
cmp esi, 0xffffffff
jne 0x100324cd
lea ecx, [esp + 0x10]
call fcn.10033e70
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1390]
xor ecx, esp
call fcn.1015f463
mov esp, ebp
pop ebp
ret 4
lea ebx, [esi + 1]
mov dword [esp + 0xc], ebx
jmp 0x100324d9
lea ebx, [esi + 1]
xor edi, edi
xor eax, eax
test esi, esi
je 0x100324ef
lea ecx, [esp + 0x10]
call fcn.10033e70
mov edi, eax
or eax, 0xffffffff
xor edx, edx
div ebx
mov ecx, eax
mov ebx, edx
xor edx, edx
mov eax, edi
div dword [esp + 0xc]
cmp eax, ecx
jb 0x10032507
cmp ebx, esi
jne 0x100324d6
mov eax, edi
mov ecx, dword [esp + 0x139c]
xor edx, edx
div dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, edx
call fcn.1015f463
mov esp, ebp
pop ebp
ret 4
Function at 0x10035270
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10168eeb
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x101fe854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x10035448
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
cmp byte [esi + 0xc], 0
jne 0x10035448
lea eax, [ebp - 0x1b8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10035448
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100352e1
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x100352ef
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x12
xor eax, eax
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1bc], 0
lea ecx, [ebp - 0x1d0]
push str.DnsAntiHijackParam
mov byte [esi + 0xc], 1
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1bc], 7
mov word [ebp - 0x1d0], ax
call fcn.10004820
mov dword [ebp - 4], 0
xor eax, eax
push 0x24
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
push str.10E0F78A_7E9D_4375_838C_24A971E345D2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10004820
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.10072e00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.100047b0
mov byte [esi + 8], 1
cmp dword [0x10206ecc], 0
je 0x10035448
push 0
mov ecx, 0x10206ecc
call fcn.10123990
mov eax, dword [0x10206ecc]
cmp byte [eax + 0x54], 0
je 0x10035448
cmp dword [eax + 0x58], 4
jb 0x10035448
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x28]
push 0xb
push 0x101b0e7c
call fcn.10004820
push 0x44
push str.RC::RCDnsAntiHijackProcessor::StartJob
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sdhipslogic_srcdnsantihijack_rcdnsantihijackprocessor.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x10206ecc
push eax
push 4
call fcn.101242f0
test bl, bl
je 0x10035439
lea eax, [ebp - 0x28]
mov ecx, 0x10206ecc
push eax
call fcn.10124610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015f463
mov esp, ebp
pop ebp
ret 4
Function at 0x100425a0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016ace2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x101fe854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.RC::RCQNWallpaperDeploySvcProcessor.0
mov dword [edi + 8], vtable.RC::RCQNWallpaperDeploySvcProcessor.1.0
mov dword [ebp - 4], 2
lea esi, [edi + 0x88]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 5
mov ecx, esi
mov eax, dword [esi]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.10044b60
mov byte [ebp - 4], 2
push 0x30
push dword [esi]
call fcn.1015f4a4
mov byte [ebp - 4], 1
lea eax, [edi + 0x58]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.MSVCP140.dll__Mtx_destroy_in_situ]
add esp, 0xc
mov byte [ebp - 4], 0
lea esi, [edi + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 8
lea ecx, [esi + 0x30]
call fcn.100047b0
mov byte [ebp - 4], 7
lea ecx, [esi + 0x18]
call fcn.100047b0
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.100047b0
mov dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 1
mov dword [edi], vtable.RC::RCSafeCenterProcessorBase.0
mov dword [edi + 4], 0
je 0x10042677
push 0x90
push edi
call fcn.1015f4a4
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10046a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016b8f9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101fe854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.RC::RCSafeCenterProcessorBase.0
mov dword [ebx + 4], 0
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebx], vtable.RC::RCSdkTlMonitorProcessor.0
mov byte [ebx + 8], 0
mov dword [ebp - 0x14], edi
push 0x148
mov dword [edi], vtable.RC::RCSdkMonitorCtrlMgr.0
call fcn.1015f474
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
lea eax, [esi + 0x20]
mov dword [esi], 0
xor ecx, ecx
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 0x1c], eax
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 2
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], 7
mov word [eax + 0x18], cx
mov byte [ebp - 4], 3
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], 7
mov word [eax + 0x30], cx
mov byte [ebp - 4], 4
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], 7
mov word [eax + 0x48], cx
mov byte [ebp - 4], 6
lea edx, [esi + 0x80]
mov dword [ebp - 0x1c], edx
mov byte [edx], cl
lea ecx, [edx + 8]
mov dword [ebp - 0x20], ecx
mov dword [ecx], 0
add ecx, 8
call fcn.100092a0
mov byte [ebp - 4], 8
xor eax, eax
mov dword [edx + 0xb8], 0
mov dword [edx + 0xbc], 7
mov word [edx + 0xa8], ax
mov byte [ebp - 4], 0xa
mov byte [esi + 0x140], al
mov byte [ebp - 4], al
mov dword [edi + 4], esi
mov byte [ebp - 4], 0xb
lea ecx, [edi + 8]
mov dword [ebp - 0x20], ecx
mov dword [ecx], vtable.RC::RCSdkMonConfigMgr.0
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 7
mov word [ecx + 4], ax
mov byte [ebp - 4], 0xc
call fcn.1006f030
mov byte [ebp - 4], 0xd
mov byte [edi + 0x24], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016bb77
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101fe854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov word [esi + 0x30], 0x101
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10047ff1
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi], 0
mov dword [esi + 0x2c], eax
jne 0x1004807a
push 0xc
call fcn.1015f474
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push esi
movq qword [eax], xmm0
mov ecx, eax
push 0x10048280
mov dword [eax + 8], 0
call fcn.100f9270
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov edi, dword [esi]
cmp edi, ebx
je 0x10048073
mov ecx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test ebx, ebx
je 0x10048057
push 1
lea eax, [ebx + 4]
push eax
call ecx
mov edi, dword [esi]
mov ecx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test edi, edi
je 0x1004806f
push 0xffffffffffffffff
lea eax, [edi + 4]
push eax
call ecx
sub eax, 1
jne 0x1004806f
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [esi], ebx
mov edi, ebx
mov ecx, edi
call fcn.100f94d0
cmp dword [0x10206ecc], 0
je 0x1004811c
push 0
mov ecx, 0x10206ecc
call fcn.10123990
mov eax, dword [0x10206ecc]
cmp byte [eax + 0x54], 0
je 0x1004811c
cmp dword [eax + 0x58], 4
jb 0x1004811c
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0xc
push 0x101b4860
call fcn.10004820
push 0x43
push str.RC::RCSoftMgrHelper::Start
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_src_sdhipslogic_src_softmgrhelper_rcsoftmgrhelper.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x10206ecc
push eax
push 4
call fcn.101242f0
test bl, bl
je 0x1004810d
lea eax, [ebp - 0x28]
mov ecx, 0x10206ecc
push eax
call fcn.10124610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100047b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015f463
mov esp, ebp
pop ebp
ret
Function at 0x1005ee30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016fc4f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x101fe854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edi, [ecx + 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea esi, [edi + 0x58]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 5
lea ecx, [esi + 0x30]
call fcn.100047b0
mov byte [ebp - 4], 4
lea ecx, [esi + 0x18]
call fcn.100047b0
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.100047b0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x34]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.100047b0
mov byte [ebp - 4], 0
lea ecx, [edi + 0x18]
call fcn.100047b0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.100047b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100618b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
mov eax, dword [0x101fe854]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
mov esi, ecx
mov eax, edx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], ecx
mov dword [ecx], 0
push edi
test esi, esi
je 0x10061af3
test eax, eax
je 0x10061af3
cmp eax, 0xe
jb 0x10061af3
movzx eax, byte [esi + 0xd]
cdq
mov edi, eax
mov ecx, edx
movzx eax, byte [esi + 0xc]
shld ecx, edi, 8
cdq
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0xb]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0xa]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [esi + 9]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [esi + 8]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [esi + 7]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [esi + 6]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
mov eax, edi
adc ecx, edx
or eax, ecx
je 0x10061af3
push 0x102067ec
push edi
call fcn.1015f93a
mov esi, eax
add esp, 8
test esi, esi
je 0x10061af3
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov cl, byte [eax]
mov byte [esp + 0xf], cl
cmp cl, 1
ja 0x10061aea
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff2
mov dword [esp + 0x14], ecx
cmp ecx, 5
jb 0x10061aea
push ecx
lea edx, [eax + 1]
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x4c], 0
call fcn.10133f30
add esp, 4
test eax, eax
jne 0x10061aea
push ecx
mov edx, ecx
lea ecx, [esp + 0x3c]
call fcn.10133f90
add esp, 4
test eax, eax
jne 0x10061aea
movups xmm0, xmmword [esp + 0x20]
mov dword [esp + 0x5c], eax
mov edx, edi
mov dword [esp + 0x80], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x54], esi
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x44]
add eax, 0xe
mov dword [esp + 0x6c], edi
push eax
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x94], 1
mov dword [esp + 0x98], 1
call fcn.10133ca0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10061a89
cmp dword [esp + 0x18], 3
mov eax, 6
cmove edi, eax
push dword [esp + 0x48]
mov eax, dword [esp + 0x60]
push 0x101feb18
mov dword [esp + 0x18], eax
call dword [0x101feb1c]
add esp, 8
test edi, edi
jne 0x10061aea
cmp byte [esp + 0xf], 1
mov edi, dword [esp + 0x10]
jne 0x10061ace
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push ecx
mov edx, edi
mov ecx, esi
call fcn.10132670
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.1015f463
mov esp, ebp
pop ebp
ret
push esi
call fcn.1015f91e
add esp, 4
mov ecx, dword [esp + 0xac]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1015f463
mov esp, ebp
pop ebp
ret