joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494b20
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4da083
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004ccb24
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4dc064]
push eax
mov ecx, edi
call fcn.004d21bd
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004d36d9
test eax, eax
je 0x494c3c
mov ecx, dword [esp + 0x3c]
call fcn.004d21ea
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4dc518]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x494c00
push edi
mov ecx, esi
call fcn.004cf857
mov ecx, esi
call fcn.00494de0
cmp dword [esp + 0x38], 1
jne 0x494c35
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004cf992
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x496e50
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x496e83
push esi
call fcn.004a50c0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x496e7c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x496f09
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x496ef2
mov eax, dword [esi + 8]
test eax, eax
je 0x496ea7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x496eee
cmp eax, 2
je 0x496ef2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x496e9a
cmp eax, 3
je 0x496ecd
cmp eax, 1
jne 0x496e9a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x496e9a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x496e9a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00496f30
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x496f18
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00496f30
add esp, 4
pop esi
ret
Function at 0x4b8170
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5898ec]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4b8183
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4b81c4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x589994]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4b81f6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4b81fa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4b81eb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4b8218
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4b821c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4b820d
xor ecx, ecx
mov eax, 0x5898fc
xor ebx, ebx
mov bl, byte [ecx + 0x5899a4]
cmp byte [esp + ebx + 0x14], 0
je 0x4b8247
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5899bc]
cmp byte [esp + ebx + 0x14], 0
je 0x4b825e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4b822e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4b81b7
lea edx, [esp + 0x84]
push edx
call fcn.004b82a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x5c8c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x5c8d1c
test eax, eax
je 0x5c8d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x5e3fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x5c8d03
lea edi, [eax + 4]
jmp 0x5c8c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x5c8c7c
mov dword [ebp - 4], 2
jmp 0x5c8c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x5c8c93
mov dword [ebp - 4], 1
jmp 0x5c8c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x5c8d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x5c8cd6
mov byte [ecx], 0x3d
jmp 0x5c8ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x5c8ced
mov byte [ecx], 0x3d
jmp 0x5c8cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x5c8c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x794597
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
jmp 0x9545d4
push ebp
mov ebp, esp
jmp 0xc980f3
nop
jmp 0x115450a
nop
jmp 0xc13311
nop
nop
jmp 0x8e9402
nop
jmp 0xec45ab
nop
stc
nop
nop
clc
cmc
nop
nop
clc
nop
test ebp, edx
clc
jmp 0x1172d3a
jne 0x1172e26
pop esi
movsx ecx, sp
seta dl
pop ecx
bswap dx
pop edx
jmp 0x11673ec
nop
nop
jmp 0x8b3e5f
nop
nop
jmp 0x11e1998
nop
jmp 0x1528360
nop
jmp 0x1518205
nop
cmc
nop
stc
nop
test bx, ax
nop
cmc
test ah, 0x71
nop
nop
clc
pushal
xor ecx, ecx
mov eax, 1
or dh, 0x7f
bsf ax, si
mov eax, 2
test sp, bp
stc
mov eax, 4
mov eax, 2
mov eax, 5
shr cx, 0x73
mov eax, 4
mov eax, 2
sar edi, 0xe6
mov eax, 5
mov eax, 6
and ax, cx
movzx ecx, di
popal
cmp bp, bp
mov eax, eax
push edx
bt edx, ebp
mov edx, 1
shrd ax, bp, 0xa2
dec dl
mov edx, 2
rcl al, cl
bsr dx, sp
shld edx, edx, 0x1e
mov edx, 4
mov edx, 2
shld eax, ecx, 0x52
ror dh, cl
mov edx, 5
bts ax, cx
cmovb edx, esi
rol al, 0x1f
mov edx, 4
mov edx, 2
dec edx
btr ax, cx
cmc
mov edx, 5
btr edx, eax
cmp dh, dl
mov eax, 0x336da3
mov edx, 5
shr edx, cl
shld dx, di, 0xcd
bt ax, cx
pop edx
sar al, cl
push edx
bswap edx
bts ax, sp
push ecx
bt cx, cx
push esi
test edx, esi
dec cl
sub esi, esi
shr eax, cl
lahf
sub al, 0x79
mov eax, dword [ebp + 8]
rcl cl, 0x7f
lea ecx, ds:[esi*4]
rcr dh, 0xe6
mov ecx, dword [eax + ecx]
xor ecx, 0x264f2576
sar dl, cl
sal dl, cl
bt edx, 0x61
xor ecx, 0x7a4dab89
shl dh, 0x63
mov edx, eax
xor ecx, 0x12ce4eb7
shr dl, cl
ror dh, 0x33
xor ecx, 0x4f227ba8
xor ecx, 0x47079cbc
xchg dl, dh
sub dx, si
xor ecx, 0x30336f06
test al, 0x7d
shrd edx, edx, 0xca
stc
xor ecx, 0x1b053707
movsx edx, si
xor ecx, 0x6309476
or edx, ebp
xor ecx, 0x2077df7d
xor ecx, 0x3bf20b9
sal dl, 0x35
shl dl, cl
ror edx, cl
xor ecx, 0x6a509cd0
add dh, 0x2b
xor ecx, 0x4d6b419f
xor dh, 0xd2
btr edx, 0xa3
xor ecx, 0x7cdc088b
not dx
xadd edx, edx
xor ecx, 0x740804fc
sar edx, 0xf0
xor ecx, 0x2f1fb42
test ah, 0x5e
cmovbe dx, bx
xor ecx, 0x2782b4d0
btr edx, ebp
sal dh, 0xf6
sbb edx, 0x1d1e6ff3
xor ecx, 0x63547236
rcr dl, cl
adc dx, dx
stc
xor ecx, 0x4d3b00e0
xor ecx, 0x5629a15c
shl dx, cl
inc edx
xor ecx, 0xcc68e70
btc edx, 0x3b
movsx edx, cx
bt dx, 6
xor ecx, 0x11a4cceb
movzx edx, bp
sar edx, 0x1d
xor ecx, 0x1786a1d5
xor ecx, 0x5a2addf5
sar dl, cl
cmovl edx, eax
movsx edx, cx
xor ecx, 0x2e3c7c0d
bsr edx, ecx
and dh, 0x25
xor ecx, 0xa488394
rcr dx, cl
xor ecx, 0x3d674ce6
cmp di, di
xor ecx, 0x7d0f1a68
xor ecx, 0x35eebe28
cmovle edx, eax
btc dx, ax
add dl, bl
xor ecx, 0x22e52afe
add dh, dh
nop
cmp bh, bh
btc edx, 0x9a
nop
nop
mov dx, si
nop
xchg dl, dl
rcr dh, cl
shl dh, cl
nop
nop
ror dl, 0xf
shl dl, 0x26
add dh, ch
lea edx, ds:[esi*4]
test ebp, esi
mov dword [eax + edx], ecx
cmp edi, 0x71480ce1
add esi, 1
clc
cmp esp, ecx
stc
cmp esi, dword [ebp + 0xc]
jmp 0xd41e8a
nop
jmp 0x1438b3b
nop
jmp 0xdc224b
nop
jmp 0x6d4b27
nop
jmp 0x44a365
Function at 0x8eb4de
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0x161b65c
nop
nop
jmp 0x94ecfb
nop
jmp 0x131480a
nop
jmp 0x766b53
jmp 0x67867d
push ebp
jmp 0xdc4288
call fcn.0044759e
add esp, 4
not al
pop eax
jmp 0xaff31f
nop
jmp 0x10353aa
nop
jmp 0xf30f4a
nop
jmp 0xbb5d85
mov dword [0x58f5e0], eax
mov dword [0x58f5e4], 1
jmp 0xc2daeb
je 0x14b838c
push eax
mov ebx, eax
jmp 0x12225d9
nop
jmp 0x41be24
nop
jmp 0xdc29bc
nop
jmp 0xc4d05a
nop
jmp 0x12ccf81
nop
nop
jmp 0x7894a2
nop
jmp 0x11fca73
mov ebp, esp
jmp 0x8c44ae
nop
nop
nop
jmp 0x14495e5
pushal
mov bx, 0x336f
cwd
mov eax, 1
mov eax, 2
movzx edi, sp
xchg ebp, edx
mov eax, 4
mov eax, 2
movsx ebx, ax
mov eax, 5
jmp 0x117ac13
nop
jmp 0xbc4d17
nop
nop
jmp 0xa4596c
mov eax, 4
lahf
movzx bx, bl
mov eax, 2
bswap bp
setne bh
mov eax, 5
sets cl
cwde
mov eax, 6
cdq
not si
popal
push edx
mov edx, 1
mov edx, 2
bswap dx
mov edx, 4
movsx dx, ah
mov edx, 2
mov edx, 5
setp dl
mov edx, 4
mov edx, 2
cmova edx, ecx
mov edx, 5
not dx
mov dh, 0x1c
mov edx, 5
jmp 0x14ff9a2
nop
jmp 0x966d14
call fcn.00401712
inc eax
jmp 0x14b8371
nop
jmp 0xe10765
nop
nop
jmp 0x152fa96
nop
jmp 0xceaa84
je 0x902d48
push ebx
jmp 0x902d3e
push eax
call fcn.00447598
pop ecx
pop esi
mov edi, eax
movsx bx, al
setle bh
rep movsb byte es:[edi], byte [esi]
inc bx
cmp al, 0xdc
bts ebx, ecx
push eax
sal bh, 0xe8
or bh, 0xbd
shl ebx, cl
mov ebx, dword [0x58f5e0]
test ecx, 0x494d2439
clc
test ebx, ebx
jmp 0x14912dd
pop edx
fninit
mov eax, dword [ebp + 8]
mov dword [0x58f5dc], eax
ror ax, 0x28
sbb al, 0x99
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jmp 0xb8f827
nop
jmp 0x10e3030
nop
nop
jmp 0x8941a5

Function at 0xb75b97
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 5
sar edx, 0xc9
or dx, bp
movzx edx, bx
mov edx, 5
neg dx
ror dl, 0x9b
sub edx, ebx
pop edx
push eax
push ecx
xor eax, eax
mov ecx, dword [ebp + 0x10]
not al
mov al, byte [ecx + ebp + 7]
cmovb ecx, ecx
movzx cx, ch
mov cl, 0xea
mov dword [ebp - 4], eax
xchg ecx, ecx
not cx
pop ecx
not eax
movsx eax, di
jmp 0x1190134
nop
pushal
inc edx
shl ah, cl
mov eax, 1
btc ecx, edi
adc bp, 0x6aa3
and ebx, 0x2693482c
mov eax, 2
seta dl
btr di, 0x78
mov eax, 4
mov eax, 2
btr ebx, 0xf4
neg bx
mov eax, 5
bt di, ax
mov eax, 4
cbw
bsf edx, edi
mov eax, 2
not di
mov eax, 5
sal edx, 0x29
shrd bp, bp, 0xa9
mov ah, 0x3f
mov eax, 6
add si, dx
bt ax, 0x57
popal
test bh, 0xc1
jmp 0xc8e319
push ebp
inc bp
cmp bp, bp
mov ebp, esp
sub esp, 4
jmp 0xeedb7d
push edx
sar dl, 0xd0
movsx edx, dx
bts dx, cx
mov edx, 1
adc edx, 0x12094f07
shl dx, 0xaa
mov edx, 2
cmp eax, esi
sbb dh, dh
mov edx, 4
ror dx, cl
shl dh, 0xe5
stc
mov edx, 2
xchg edx, edx
mov edx, 5
sar dh, 0x86
sal edx, 0x46
btc dx, bx
mov edx, 4
shr dl, 0x4a
mov edx, 2
adc dl, ah
jmp 0x5c9815
jmp loc.0041fa5f
mov dword [ebp - 4], 0
jmp 0x15c3f0c
pop eax
mov eax, dword [ebp - 4]
jmp 0xebf5af
nop
stc
nop
nop
clc
nop
test al, 0x93
nop
nop
cmp bx, 0x5118
nop
nop
cmp bl, 0x77
cmc
cmp edi, esi
nop
test esp, 0x2f3d30ca
nop
stc
nop
jmp 0x824f20
Function at 0x1509d87
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [ebp - 0x14], esp
push 0x40
mov ah, 0xff
cmovge ax, ax
seto ah
push 0x1000
setnp ah
push 0x64
not al
mov al, 0x43
cmovbe eax, edx
push 0
bswap eax
mov eax, 0xb
jmp 0xae1a33
nop
jmp 0x9b371a
mov dword [ebp - 4], eax
not ax
jmp 0x6cd275
je 0x8c9919
push 0x5c
jmp 0xd3697c
nop
jmp 0xd6b519
push 0x64
movsx ax, cl
jmp 0xc76683
nop
jmp 0xb437c7
mov dword [ebp - 0xc], 0
jmp 0x1616c28
mov dword [ebp - 8], 0
jmp 0xa51af9
call fcn.004475b0
cmp dword [ebp - 0x14], esp
jmp 0xd7dbc0
nop
nop
jmp 0xe59999
nop
jmp 0x1493ddd
push 6
jmp 0x10c7b2c
push 0
mov al, 0x52
not ax
jmp 0x424c5f
push 0x40
push 0x1000
push 0x64
movsx eax, si
bswap ax
push 0
cwde
movsx eax, cx
mov eax, 0xb
jmp 0xf70894
push 0x402a855
jmp 0xc32c8f
mov eax, 2
cbw
cwd
mov ebp, 0x3be9470c
mov eax, 5
mov ebx, 0x35c130b3
movsx ax, ah
mov eax, 6
popal
push edx
mov edx, ebp
mov edx, 1
movsx edx, di
movzx dx, ah
xchg dx, ax
mov edx, 2
movzx eax, di
xchg dx, dx
mov edx, 4
cmovle ax, cx
xchg al, dl
cbw
mov edx, 2
rdtsc
cwde
mov edx, 5
mov edx, 4
not ah
cdq
movzx eax, sp
mov edx, 2
rdtsc
mov ax, 0x349d
xchg al, dl
mov edx, 5
movzx eax, sp
mov ah, dh
mov edx, 5
setne ah
cbw
pop edx
lahf
setno al
mov dword [ebp - 0x14], esp
cmovle eax, esp
jmp 0xd31dfe
call fcn.004475aa
add esp, 0xc
jmp 0xe669b6
pushal
jmp 0xd9777a
je 0xe669b6
push 0xad
jmp 0x123d746
mov eax, 1
bswap ax
mov eax, 2
movzx dx, bl
lahf
jmp 0x13208b0
nop
jmp 0xc25ee9
nop
jmp 0xe0dd4b
mov dword [ebp - 8], eax
nop
movzx eax, bx
not ax
mov dword [ebp - 0x14], esp
cmovno ax, si
push 0x40
movsx ax, dh
mov eax, 0x6c1549ae
push 0x1000
movzx eax, cx
jmp 0x9a123b
nop
jmp 0x75df21
nop
jmp 0xf9db22
call fcn.004475b0
cmp dword [ebp - 0x14], esp
jmp 0x8eb4ce
nop
jmp 0xeafd62
call fcn.004475aa
add esp, 0xc
jmp 0x8c9919
push 0x402a855
push 6
jmp 0xd49259
mov eax, 4
mov eax, 2
not bp
cbw
mov eax, 5
cdq
cbw
mov eax, 4
not bh
jmp 0xd440ea
mov dword [ebp - 4], 0
jmp 0xacf565
nop
jmp 0x97bc7f
push ebp
shl bp, 0xd
btr bp, si
mov ebp, esp
test si, si
sub esp, 0x24
jmp 0x1470a01
mov dword [ebp - 0x10], 0
jmp 0xf205aa
Function at 0x10009bd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a9f56
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100e1008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x2c], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.1000aae0
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 0x1c]
mov byte [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 0
mov dword [ebp - 0x2c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1000aa60
mov dword [esi], eax
mov byte [ebp - 4], 5
push 0x18
mov dword [edi + 0x28], 0x384
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 2
mov dword [edi + 0x34], 0x41
call fcn.100a7115
add esp, 4
mov dword [edi + 0x38], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 6
xor eax, eax
push 0x10
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x48], 0
push str.2345SafeTray.exe
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
call fcn.10005260
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5c]
call fcn.10070940
mov byte [edi + 8], al
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5c]
call fcn.10005200
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x44]
push 0xa
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
push str.2345PCSafe
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.10005260
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x28]
push dword [ebp - 0x34]
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.10005260
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x44]
call fcn.10005200
lea ecx, [ebp - 0x28]
call fcn.1001fc50
mov ecx, edi
mov byte [edi + 0x18], al
call fcn.1000a870
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.10005200
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a7104
mov esp, ebp
pop ebp
ret
Function at 0x1000f1d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], ebx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1000f271
lea eax, [ebp - 0xc]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0xc], xmm0
call fcn.1007d4d0
test al, al
je 0x1000f271
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
test eax, eax
jne 0x1000f210
cmp esi, 0x20
jb 0x1000f271
cmp esi, 0x20
jne 0x1000f226
test eax, eax
jne 0x1000f226
mov dword [ebx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 4]
add esi, 0xffffffe0
test ecx, ecx
je 0x1000f247
lea eax, [ebp - 0xc]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x20
movlpd qword [ebp - 0xc], xmm0
call fcn.1007d550
push 0x100e1f90
push esi
call fcn.100a7804
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1000f271
push esi
push ebx
mov ecx, edi
call fcn.1000ffe0
test al, al
jne 0x1000f27c
push ebx
call fcn.100a77ff
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
test esi, esi
je 0x1000f2a7
mov edi, ebx
or eax, 0xffffffff
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, eax
mov edx, eax
movzx ecx, cl
shr edx, 8
mov eax, dword [ecx*4 + 0x100c2f20]
xor eax, edx
sub esi, 1
jne 0x1000f287
not eax
mov ecx, dword [ebp - 0x10]
push ebx
mov dword [ecx], eax
call fcn.100a77ff
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001a8d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac450
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100e1008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 4]
mov dword [edi + 0x28], 1
push eax
push 0
push 4
lea eax, [edi + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
test esi, esi
jne 0x1001a934
cmp eax, 0x3e5
sete bl
test bl, bl
jne 0x1001a9cf
cmp dword [0x100e244c], 0
je 0x1001aa8a
push 0
mov ecx, 0x100e244c
call fcn.10096430
mov eax, dword [0x100e244c]
cmp byte [eax + 0x54], bl
je 0x1001aa8a
cmp dword [eax + 0x58], 2
jb 0x1001aa8a
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x1001a9a0
mov eax, dword [eax]
push dword [ebp - 0x2c]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push edi
push str.request_next_failed__p__p__s___d
push eax
call fcn.10097230
add esp, 0x18
lea eax, [ebp - 0x28]
push 0x34
push str.RC::RCNamePipeServer::RCPipeClientNode::RequestNext
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 2
jmp 0x1001aa5f
cmp dword [0x100e244c], 0
je 0x1001aa8a
push 0
mov ecx, 0x100e244c
call fcn.10096430
mov eax, dword [0x100e244c]
cmp byte [eax + 0x54], 0
je 0x1001aa8a
cmp dword [eax + 0x58], 5
jb 0x1001aa8a
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x1001aa38
mov eax, dword [eax]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push edi
push str.request_next__p__p__s
push eax
call fcn.10097230
add esp, 0x14
lea eax, [ebp - 0x28]
push 0x3c
push str.RC::RCNamePipeServer::RCPipeClientNode::RequestNext
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 5
mov ecx, 0x100e244c
call fcn.10096d90
test bh, bh
je 0x1001aa7b
lea eax, [ebp - 0x28]
mov ecx, 0x100e244c
push eax
call fcn.100970b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005200
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a7104
mov esp, ebp
pop ebp
ret
Function at 0x1001aab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac450
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100e1008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x20]
lea esi, [edi + 0x1c]
sub eax, dword [esi]
mov ecx, dword [edi + 0x18]
cmp eax, ecx
jae 0x1001aaf8
push esi
push ecx
mov ecx, esi
call fcn.1001d4a0
mov ecx, dword [edi + 0x18]
lea eax, [edi + 4]
mov dword [edi + 0x28], 2
push eax
push 0
push ecx
push dword [esi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
test esi, esi
jne 0x1001ab2c
cmp eax, 0x3e5
sete bl
test bl, bl
jne 0x1001abc7
cmp dword [0x100e244c], 0
je 0x1001ac85
push 0
mov ecx, 0x100e244c
call fcn.10096430
mov eax, dword [0x100e244c]
cmp byte [eax + 0x54], bl
je 0x1001ac85
cmp dword [eax + 0x58], 2
jb 0x1001ac85
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x1001ab98
mov eax, dword [eax]
push dword [ebp - 0x2c]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push edi
push str.request_data_failed__p__p__s___d
push eax
call fcn.10097230
add esp, 0x18
lea eax, [ebp - 0x28]
push 0x5a
push str.RC::RCNamePipeServer::RCPipeClientNode::RequestData
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 2
jmp 0x1001ac5a
cmp dword [0x100e244c], 0
je 0x1001ac85
push 0
mov ecx, 0x100e244c
call fcn.10096430
mov eax, dword [0x100e244c]
cmp byte [eax + 0x54], 0
je 0x1001ac85
cmp dword [eax + 0x58], 5
jb 0x1001ac85
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x1001ac30
mov eax, dword [eax]
push dword [edi + 0x18]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push edi
push str.request_data__p__p__s___d
push eax
call fcn.10097230
add esp, 0x18
lea eax, [ebp - 0x28]
push 0x63
push str.RC::RCNamePipeServer::RCPipeClientNode::RequestData
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeserver.cpp
push eax
push 5
mov ecx, 0x100e244c
call fcn.10096d90
test bh, bh
je 0x1001ac76
lea eax, [ebp - 0x28]
mov ecx, 0x100e244c
push eax
call fcn.100970b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005200
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a7104
mov esp, ebp
pop ebp
ret