joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004f50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov al, byte [0x10036aec]
test al, al
jne 0x10004ff2
mov byte [0x10036aec], 1
call sym.LIBMYSQL.dll_my_init
call fcn.100047f0
mov eax, dword [0x10036af0]
test eax, eax
jne 0x10004fc8
push 0x10031774
push str.mysql
mov dword [0x10036af0], 0xcea
call sub.WSOCK32.dll_getservbyname
test eax, eax
je 0x10004fa9
movzx eax, word [eax + 8]
push eax
call sub.WSOCK32.dll_ntohs
xor ecx, ecx
mov cx, ax
mov dword [0x10036af0], ecx
push str.MYSQL_TCP_PORT
call fcn.1001115f
add esp, 4
test eax, eax
je 0x10004fc8
push eax
call fcn.10010380
add esp, 4
mov dword [0x10036af0], eax
mov eax, dword [0x10036af4]
test eax, eax
jne 0x10004ff1
push str.MYSQL_UNIX_PORT
mov dword [0x10036af4], 0x10031744
call fcn.1001115f
add esp, 4
test eax, eax
je 0x10004ff1
mov dword [0x10036af4], eax
ret
jmp sym.LIBMYSQL.dll_my_thread_init
Function at 0x100059a0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call sub.WSOCK32.dll_connect
ret

Function at 0x10008bc0
Capabilities:
Allocate thread local storage
Initialize winsock library

Disassembly:
mov al, byte [0x10036b11]
test al, al
jne 0x10008c5d
mov byte [0x10036b11], 1
call fcn.10009540
mov eax, dword [0x10036b18]
test eax, eax
jne 0x10008c58
call fcn.10008d70
push str.HOME
call fcn.1001115f
add esp, 4
test eax, eax
mov dword [0x10036b18], eax
je 0x10008c10
push eax
push 0x10036d20
call fcn.10008290
add esp, 8
mov dword [0x10036b18], eax
push str.UMASK
call fcn.1001115f
add esp, 4
test eax, eax
je 0x10008c34
push eax
call fcn.10008c60
add esp, 4
or eax, 0x180
mov dword [0x100318ec], eax
push str.UMASK_DIR
call fcn.1001115f
add esp, 4
test eax, eax
je 0x10008c58
push eax
call fcn.10008c60
add esp, 4
or eax, 0x1c0
mov dword [0x100318f0], eax
jmp 0x10008e80
ret
sub esp, 0x190
call fcn.10008ee0
test al, al
je 0x10008ecf
lea eax, [esp]
push eax
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10008eab
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esp]
push ecx
jmp 0x10008ebd
cmp word [esp], 2
je 0x10008ec8
call sub.WSOCK32.dll_WSACleanup
lea edx, [esp]
push edx
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x10008ecf
mov byte [0x10036b10], 1
xor al, al
add esp, 0x190
ret

Function at 0x10008d70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa04
push 0x10036ad8
push 2
mov dword [esp + 0xc], 0x100
mov dword [esp + 0x10], 0x400
call fcn.10011617
add esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMySQL
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008e71
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
mov edx, dword [esp + 0x10]
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
mov esi, 1
call edi
cmp eax, 0x103
je 0x10008e64
nop
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x51c]
push edx
call fcn.10008d50
lea eax, [esp + 0x520]
push eax
call fcn.1001a75a
lea ecx, [esp + 0x524]
push ecx
call fcn.1001b5ce
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x118]
push ecx
push 0
push 0
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
mov eax, esi
push ecx
push eax
push edx
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], 0x400
inc esi
call edi
cmp eax, 0x103
jne 0x10008df0
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0xa04
ret
Function at 0x10008f70
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x10008f7f
mov edi, 1
push edi
call fcn.1001082a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10008fd3
push esi
call fcn.10010b73
mov esi, eax
call fcn.100096b0
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov esi, eax
and esi, 8
je 0x10008fb6
mov edx, dword [fcn.100090a0]
mov dword [fcn.100090a0], edx
test al, 0x18
je 0x10008fc7
push edi
push 0x24
push 5
call fcn.100086e0
add esp, 0xc
test esi, esi
pop esi
je 0x10008fee
push 1
call fcn.10010eb4
test byte [esp + 0x10], 0x20
je 0x10008fee
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, ebx
pop ebx
ret

Function at 0x100093e0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea esp, [esp]
call fcn.10010b73
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.10015890
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x100094aa
call fcn.10010b73
cmp dword [eax], 0
je 0x10009427
call fcn.10010b73
mov ebp, dword [eax]
jmp 0x1000942a
or ebp, 0xffffffff
call fcn.100096b0
test esi, esi
mov dword [eax], ebp
jne 0x1000943f
call fcn.10010b73
cmp dword [eax], 4
je 0x100093f0
mov al, byte [esp + 0x20]
test al, 0x1a
je 0x10009497
cmp esi, 0xffffffff
jne 0x10009471
call fcn.100096b0
mov ecx, dword [eax]
push ecx
push ebx
call fcn.100086b0
add esp, 4
push eax
push 0x24
push 2
call fcn.100086e0
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test al, 6
je 0x10009497
call fcn.100096b0
mov edx, dword [eax]
push edx
push ebx
call fcn.100086b0
add esp, 4
push eax
push 0x24
push 9
call fcn.100086e0
mov al, byte [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x100094a0
test al, 6
je 0x100094b4
pop edi
pop esi
pop ebp
mov eax, 0xffffffff
pop ebx
ret
mov al, byte [esp + 0x20]
test al, 6
je 0x100094b4
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x10009540
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value
Terminate process

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x1003f394], eax
jne 0x10009571
call fcn.10010b73
mov eax, dword [eax]
push eax
push str.Cant_initialize_threads:_error__d_n
push 0x10033030
call fcn.10010ac4
add esp, 0xc
push 1
call fcn.10010eb4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1003f4a0
call esi
push 0x1003f440
call esi
push 0x1003f4c0
call esi
push 0x1003f460
call esi
push 0x1003f400
call esi
push 0x1003f420
call esi
push 0x1003f3c0
call esi
push 0x1003f3a0
call esi
push 0x1003f480
call esi
call fcn.10009730
push 0x1003f3e0
call esi
pop esi
jmp sym.LIBMYSQL.dll_my_thread_init
Function at 0x100095f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push 0x1003f460
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1003f394]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10009661
push 0x3c
push 1
call fcn.10011fbc
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000962d
push 0x1003f460
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop esi
ret
mov ecx, dword [0x1003f394]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1003efc0]
inc eax
lea edx, [esi + 0xc]
mov dword [0x1003efc0], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
add esi, 4
push esi
call fcn.100096e0
add esp, 8
push 0x1003f460
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop esi
ret

Function at 0x10009670
Capabilities:
Set thread local storage value

Disassembly:
push esi
call fcn.100096b0
mov esi, eax
test esi, esi
je 0x1000969b
lea eax, [esi + 4]
push eax
call fcn.10009710
add esp, 4
lea ecx, [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call fcn.10010741
add esp, 4
mov edx, dword [0x1003f394]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret

Function at 0x1000a050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
test eax, eax
push ebx
push esi
push edi
je 0x1000a145
cmp byte [eax], 0
je 0x1000a145
mov esi, dword [ebp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
mov edi, esi
call fcn.10009fe0
mov ebx, dword [ebp + 0xc]
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.10009fe0
mov al, byte [ebp + 0x14]
mov edx, dword [esp + 0x20]
add esp, 0x10
test al, al
je 0x1000a0b0
xor edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.1000a160
add esp, 8
jmp 0x1000a0cd
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
xor ecx, eax
push ecx
xor edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.10009f50
add esp, 0xc
cmp byte [ebx], 0
je 0x1000a106
lea ecx, [esp + 0x20]
inc ebx
push ecx
mov dword [ebp + 0xc], ebx
call fcn.10009f90
fmul qword [0x1001d190]
push ecx
fstp qword [esp]
call fcn.10012149
fadd qword [0x1001d188]
add esp, 8
call fcn.10012218
mov byte [esi], al
mov al, byte [ebx]
inc esi
test al, al
jne 0x1000a0d2
mov al, byte [ebp + 0x14]
test al, al
jne 0x1000a148
lea edx, [esp + 0x20]
push edx
call fcn.10009f90
fmul qword [0x1001d190]
push ecx
fstp qword [esp]
call fcn.10012149
add esp, 8
call fcn.10012218
cmp edi, esi
je 0x1000a148
xor byte [edi], al
inc edi
cmp edi, esi
jne 0x1000a132
mov byte [esi], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
pop edi
mov byte [esi], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a790
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x30], 3
push 0
jne 0x1000a7c2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000a7bd
or eax, 0xffffffff
ret
mov eax, dword [esp + 0xc]
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [eax]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
ret

Function at 0x1000a7e0
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x30], 3
push 0
jne 0x1000a812
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000a80d
or eax, 0xffffffff
ret
mov eax, dword [esp + 0xc]
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [eax]
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
ret

Function at 0x1000a850
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [ecx + 0x30]
xor eax, eax
cmp edx, 3
mov dword [esp], eax
je 0x1000a887
cmp byte [esp + 0xc], al
je 0x1000a871
mov dword [esp], 1
mov ecx, dword [ecx]
push 4
lea eax, [esp + 4]
push eax
push 8
push 0xffff
push ecx
call sub.WSOCK32.dll_setsockopt
pop ecx
ret
Function at 0x10018a89
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x100364a8
cmp edx, dword [eax]
je 0x10018aab
add eax, 8
inc ecx
cmp eax, 0x10036538
jl 0x10018a9c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x100364a8]
jne 0x10018bd9
mov eax, dword [0x1003f048]
cmp eax, 1
je 0x10018bb3
test eax, eax
jne 0x10018adc
cmp dword [0x1003f04c], 1
je 0x10018bb3
cmp edx, 0xfc
je 0x10018bd9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10018b13
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10016d30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10014c70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10018b56
lea eax, [ebp - 0x1a4]
push eax
call fcn.10014c70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1001ee48
push edi
call fcn.10016b70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10016d30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10016d40
lea eax, [ebp - 0xa0]
push 0x1001ee28
push eax
call fcn.10016d40
push dword [esi + 0x100364ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.10016d40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1001a515
add esp, 0x2c
pop edi
jmp 0x10018bd9
lea eax, [ebp + 8]
lea esi, [esi + 0x100364ac]
push 0
push eax
push dword [esi]
call fcn.10014c70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1001968d
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x100196bd
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
ror byte [ecx - 0x35c4f7b3], 1
jae 0x100196b8
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x100196a2
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x100196aa
cmp edx, ebx
jne 0x100197f8
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10019679
add eax, dword [eax + 4]
jmp 0x10019666
mov dword [ebp + 0xc], ebx
jmp 0x100196c8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100196e0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100196fe
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1001975c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10019743
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1001974c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10019756
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10019738
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100196c2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100197a9
dec eax
je 0x100197a0
sub eax, 3
je 0x10019797
mov dword [ebp - 4], 0x40
jmp 0x100197c6
mov dword [ebp - 4], 4
jmp 0x100197ac
mov dword [ebp - 4], 0x20
jmp 0x100197ac
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100197f8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10019778
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10019009
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fbcd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x43d140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00425013
mov edi, eax
add esp, 4
test edi, edi
je 0x4032dd
push 1
mov dword [ebp - 4], 0
call fcn.004240b4
add esp, 4
mov dword [edi + 4], eax
jmp 0x4032df
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.00401460
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x40333a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x40333a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x403356
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x403379
cmp byte [ebp + 0xc], 0
je 0x403365
push esi
call fcn.0042454a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x403385
mov esi, str.ios_base::badbit_set
jmp 0x403395
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.00403880
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.00401d30
push 0x4394b0
lea eax, [ebp - 0x28]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x403640
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fc5b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x43d140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x410
mov dword [ebp - 0x244], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x240], esi
test esi, esi
je 0x40385c
lea eax, [ebp - 0x234]
push eax
push 4
lea eax, [ebp - 0x244]
push eax
push esi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x40385c
mov eax, dword [ebp - 0x234]
xor ecx, ecx
shr eax, 2
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov dword [ebp - 0x23c], ecx
call fcn.00425051
mov edi, eax
add esp, 4
test edi, edi
je 0x403700
push dword [ebp - 0x23c]
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x403702
xor edi, edi
mov dword [ebp - 0x23c], edi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 0x234]
push edi
push esi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x40384f
xor esi, esi
test dword [ebp - 0x234], 0xfffffffc
jbe 0x40384f
nop dword [eax]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x208
push eax
push dword [edi + esi*4]
push dword [ebp - 0x240]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
movups xmmword [ebp - 0x230], xmm0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403797
sub eax, edx
lea ecx, [ebp - 0x230]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00401230
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x21c], 7
push 0
mov byte [ebp - 4], 1
lea ecx, [eax + eax]
lea eax, [ebp - 0x230]
cmova eax, dword [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0x238]
push eax
call fcn.00404290
mov ecx, dword [ebp - 0x238]
push 0
push 2
push 0x4325ac
call fcn.00404290
mov ecx, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp ecx, 7
jbe 0x40383d
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403833
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403877
push ecx
push edx
call fcn.00425043
add esp, 8
mov eax, dword [ebp - 0x234]
inc esi
shr eax, 2
cmp esi, eax
jb 0x403740
test edi, edi
je 0x40385c
push edi
call fcn.0042505a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042505f
mov esp, ebp
pop ebp
ret
call fcn.00426490
int3
Function at 0x404cb0
Capabilities:
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x43d140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push str.RshFileMap000
push 0x34
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404d2b
push 0x34
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 0x10]
add eax, 0x14
push eax
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x404d54
mov dword [esi], 0
mov dword [esi + 4], 0x3a4
mov dword [esi + 8], 0x411
mov dword [esi + 0xc], 0xfffffde4
mov dword [esi + 0x10], 0x64
mov dword [esi + 0x14], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
lea eax, [ebp - 0x408]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x404e9b
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404da6
pop edi
pop esi
mov eax, 0xffffd8ed
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042505f
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404e85
mov eax, 0x5a4d
cmp word [ebp - 0x404], ax
jne 0x404e85
push edi
call ebx
lea edi, [ebp - 0x404]
mov ebx, 0x14c
add edi, dword [ebp - 0x3c8]
movzx eax, word [edi + 4]
cmp ax, bx
je 0x404e19
mov ecx, 0x8664
cmp ax, cx
je 0x404e19
pop edi
pop esi
mov eax, 0xffffd8e5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042505f
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x34]
push str.RcpEvent000
push 0
push 0
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x28]
push 0
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.RcpFileMap000
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov dword [esi + 0x3c], eax
cmp word [edi + 4], bx
mov eax, 0xffffd8ef
pop edi
pop esi
cmove eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042505f
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffd8e6
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042505f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffd8ec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042505f
mov esp, ebp
pop ebp
ret