joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d66c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000d67b
pop dword [ebp - 0x28]
mov eax, 0xdbbaa9e2
sub eax, 0xcbb9d367
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3d984
push 0
mov eax, 0xa8b05b06
add eax, 0x6751063a
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xecadc639
sub ecx, 0xecad70b8
xor edx, edx
add edx, eax
mov esi, 0x66321d46
add esi, 0xa9d026ba
add esi, dword [ebp - 0x28]
mov ebx, 0xee1af99d
add ebx, 0x3610b060
mov edi, dword [esi]
mov dword [ebp - 0x20], 0xb7758123
add edi, ebx
xor dword [ebp - 0x14], 0x95731139
mov dword [edx], edi
xor dword [ebp - 0x1c], esi
add edx, 0x67e793ff
add edx, 0x98186c05
add esi, 0xd4087b0b
add esi, 0x2bf784f9
loop 0x1000d6dc
add eax, 0x74461bd7
sub eax, 0x7444d300
xor ebx, ebx
add ebx, eax
add eax, 0x4b3ffc76
sub eax, 0x4b3ffc71
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x46fda4
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov ebx, dword [edx]
mov eax, dword [edx + 4]
test esi, esi
jle 0x46fe0a
push ebp
mov ebp, dword [esp + 0x18]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x1c]
push edi
inc bl
movzx ebx, bl
mov cl, byte [edx + ebx + 8]
add al, cl
movzx eax, al
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x18]
mov al, byte [edx + eax + 8]
mov byte [edx + ebx + 8], al
add al, cl
movzx eax, al
mov byte [edx + edi + 8], cl
mov cl, byte [eax + edx + 8]
mov eax, edi
xor cl, byte [esi + ebp]
mov byte [esi], cl
inc esi
sub dword [esp + 0x10], 1
jne 0x46fdca
mov esi, dword [esp + 0x24]
pop edi
pop ebp
mov dword [edx + 4], eax
mov eax, esi
pop esi
mov dword [edx], ebx
pop ebx
pop ecx
ret
Function at 0x485bb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
lea eax, [edx + ecx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx], 0
jne 0x485bf1
xor eax, eax
jmp 0x485ccd
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 0xc]
cdq
and eax, 0xffff0000
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x30]
or ecx, dword [ebp - 0x2c]
jne 0x485c28
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x10]
mov dword [ebp - 0xc], eax
jmp 0x485c9e
mov dword [ebp - 0x10], 0xffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], 0
jmp 0x485c4d
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx + 0x18]
jae 0x485c7f
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
push eax
call fcn.004857d8
add esp, 8
test eax, eax
jne 0x485c7d
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
jmp 0x485c7f
jmp 0x485c44
cmp dword [ebp - 0x10], 0
jl 0x485c9e
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + ecx*2]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x485caf
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x14]
jb 0x485cb3
xor eax, eax
jmp 0x485ccd
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x408ff1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x415070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00404297
mov dword [ebp - 0x14], eax
cmp dword [0x417008], edi
jne 0x4090e2
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40906f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4091c2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4091c2
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4091c2
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x417008], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x41700c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x417010], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417018], eax
test eax, eax
je 0x4090df
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417014], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x409107
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4090fa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40911c
push 4
pop eax
jmp 0x4091c4
cmp dword [ebp - 0x14], edi
je 0x40911c
push dword [0x417008]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x409101
mov eax, dword [0x417014]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40917a
cmp dword [0x417018], esi
je 0x40917a
push eax
call ebx
push dword [0x417018]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40917a
test eax, eax
je 0x40917a
call ecx
test eax, eax
je 0x40916f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40916f
test byte [ebp - 8], 1
jne 0x40917a
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4091aa
mov eax, dword [0x41700c]
cmp eax, esi
je 0x4091a7
push eax
call ebx
test eax, eax
je 0x4091a7
call eax
mov edi, eax
test edi, edi
je 0x4091a7
mov eax, dword [0x417010]
cmp eax, esi
je 0x4091a7
push eax
call ebx
test eax, eax
je 0x4091a7
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x417008]
call ebx
test eax, eax
je 0x4091c2
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4091c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401b6f
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401c66
pop dword [ebp - 0x50]
mov eax, 0x17fd4a8d
add eax, 0xe842d1d9
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x379746a9
sub dword [ebp - 0x60], 0xe945015e
mov dword [ebp - 0x5c], 0xfed9ee10
sub dword [ebp - 0x5c], 0xcca6a1cb
mov dword [ebp - 0x58], 0x7b8c171b
sub dword [ebp - 0x58], 0x2f3fd2ed
mov dword [ebp - 0x54], 0x47c65010
add dword [ebp - 0x54], 0xb839aff0
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xbe164904
add dword [ebp - 0x60], 0xb65c2052
mov dword [ebp - 0x5c], 0x13ff640d
sub dword [ebp - 0x5c], 0xd2930298
mov dword [ebp - 0x58], 0x157b6528
add dword [ebp - 0x58], 0x4df40744
mov dword [ebp - 0x54], 0x4eab9eae
add dword [ebp - 0x54], 0xb1546152
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x1ffd7f61
add eax, 0xe042b0cb
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x31526
push 0
call eax
mov ecx, 0x33dafaf7
add ecx, 0xcc253866
xor edi, edi
add edi, eax
mov esi, 0xac173c8c
sub esi, 0xabd6cc8c
add esi, dword [ebp - 0x50]
mov ebx, 0x65324e18
sub ebx, 0xcff85e5d
add dword [ebp - 0x14], 0x14892124
mov edx, dword [esi]
add dword [ebp - 0x1c], 0x5ffa6e6f
add edx, ebx
xor dword [ebp - 0xc], edi
mov dword [edi], edx
sub dword [ebp - 0xc], ebx
add edi, 0xbc1902cb
sub edi, 0xbc1902c7
add esi, 0xce45173a
add esi, 0x31bae8ca
loop 0x401d85
add eax, 0x859ceed3
add eax, 0x7a63d174
mov ebx, eax
add eax, 0x1913389
add eax, 0xfe6ecc7c
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1004d335
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1004d344
pop dword [ebp - 0x1c]
mov eax, 0x1004d344
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xfa6fc116
sub dword [ebp - 0x2c], 0xac1d7bcb
mov dword [ebp - 0x28], 0x8a7b87bd
sub dword [ebp - 0x28], 0x58483b78
mov dword [ebp - 0x24], 0x70cae191
add dword [ebp - 0x24], 0xdb81629d
mov dword [ebp - 0x20], 0xf7ca55c7
sub dword [ebp - 0x20], 0xf7ca55c7
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x5d668a3e
add eax, 0xb2998656
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x1c840e06
sub dword [ebp - 0x2c], 0xa811a4b0
mov dword [ebp - 0x28], 0x486a177c
sub dword [ebp - 0x28], 0x6fdb607
mov dword [ebp - 0x24], 0x982e9d67
sub dword [ebp - 0x24], 0x34bf30fb
mov dword [ebp - 0x20], 0xa8286db
sub dword [ebp - 0x20], 0xa8286db
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a8f1
push 0
call eax
mov ecx, 0x4c54a527
sub ecx, 0x4c5468f8
mov ebx, eax
mov edx, 0xf2abd562
sub edx, 0xe2a4db62
add edx, dword [ebp - 0x1c]
mov edi, 0x9544c388
sub dword [ebp - 4], 0x2e3ead40
mov esi, dword [edx]
xor dword [ebp - 0xc], ebx
add esi, edi
mov dword [ebx], esi
mov dword [ebp - 0x14], 0x2f539387
add ebx, 4
add edx, 4
loop 0x1004d456
add eax, 0xe38f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4400c909
sub ecx, 0x3400c909
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.00418e8e
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00418e8e
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00418e8e
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401c66
pop dword [ebp - 0x38]
mov eax, 0x401c66
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x6edcb08b
add dword [ebp - 0x48], 0xdf7594c0
mov dword [ebp - 0x44], 0x7e9e1750
sub dword [ebp - 0x44], 0x4c6acb0b
mov dword [ebp - 0x40], 0xd39a33a8
sub dword [ebp - 0x40], 0x874def7a
mov dword [ebp - 0x3c], 0x9d8d3cd
add dword [ebp - 0x3c], 0xf6272c33
lea eax, [ebp - 0x48]
push eax
mov eax, 0x29d46c70
add eax, 0xd66bc3e4
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x6993e618
sub dword [ebp - 0x48], 0xf5217cc2
mov dword [ebp - 0x44], 0xa9df8702
add dword [ebp - 0x44], 0x978cda73
mov dword [ebp - 0x40], 0xf584d0ef
add dword [ebp - 0x40], 0x6dea9b7d
mov dword [ebp - 0x3c], 0xfd91491f
sub dword [ebp - 0x3c], 0xfd91491f
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x317fe
push 0
call eax
mov ecx, 0x3413
xor edi, edi
add edi, eax
mov edx, 0x44411e64
add edx, 0xbbff519c
add edx, dword [ebp - 0x38]
mov esi, 0x53406510
add esi, 0xbd161acb
xor dword [ebp - 0x2c], 0xe503d487
mov ebx, dword [edx]
xor ebx, esi
mov dword [edi], ebx
xor dword [ebp - 0x18], 0xe536792f
add edi, 0xd5eb215f
add edi, 0x2a14dea5
add edx, 0xb1993d13
sub edx, 0xb1993d0f
loop 0x401d7a
add eax, 0xab88a699
add eax, 0x54781c86
xor ebx, ebx
add ebx, eax
add eax, 0x485ebffb
sub eax, 0x485ebff6
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1000e070
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006772d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100d9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov ecx, 0x100e11d0
call fcn.10063695
mov dword [ebx], vtable.RC::DmAvCore::IVBusModule.0
mov dword [ebp - 4], 0
mov dword [ebx], vtable.RC::RCSafeModuleBase.0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 4], 1
lea edi, [ebx + 0xc]
mov dword [ebp - 0x14], edi
lea esi, [edi + 4]
mov dword [ebx], vtable.RC::RCLeakModule.0
mov dword [edi], vtable.RC::RCSafeTaskQueue.0
mov dword [ebp - 0x1c], esi
push 8
mov dword [ebp - 0x18], edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.1006162f
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov byte [ebp - 4], 3
lea esi, [edi + 0x18]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 4
push 0x18
call fcn.1006162f
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 8
mov dword [esi], eax
push eax
call ebx
mov byte [ebp - 4], 5
push ecx
push 0
push 0
lea ecx, [edi + 0x1c]
call fcn.100483b0
mov byte [ebp - 4], 6
mov dword [edi + 0x3c], 0
mov byte [ebp - 4], 7
add edi, 0x40
push ecx
push 1
mov dword [ebp - 0x1c], edi
push 0
lea ecx, [edi + 4]
mov dword [edi], vtable.RC::RCSafeThreadMgr.0
call fcn.100483b0
mov byte [ebp - 4], 8
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [ebp - 4], 9
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x40]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0xb
push 0x18
call fcn.1006162f
add esp, 4
mov dword [esi], eax
push eax
call ebx
mov byte [ebp - 4], 0xc
mov dword [edi + 0x44], 1
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x94], 0
mov dword [eax + 0x98], 0
mov dword [eax + 0x9c], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015cd0
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x100e11d0
call fcn.10063695
lea edx, [esi + 8]
pop esi
jmp fcn.100261b0
Function at 0x1001ea90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006fffc
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100d9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, 0x100e11d0
call fcn.10063695
mov eax, dword [esi + 4]
test eax, eax
je 0x1001ebf1
cmp byte [eax + 0x54], 0
je 0x1001ebf1
add eax, 0x1c
lea ecx, [ebp - 0x18]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x18], xmm0
call fcn.1001cf90
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x1001eb04
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001ebbe
push ecx
mov edx, edi
lea ecx, [ebp - 0x30]
call fcn.10047960
add esp, 4
mov byte [ebp - 4], 2
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x1c], 0x10
lea ecx, [ebp - 0x34]
push 0
push ecx
push dword [ebp - 0x20]
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x1001eba4
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001eb9a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001eb9a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1006165f
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
mov byte [ebp - 4], 0
mov byte [ebp - 4], 0
mov dword [ebp - 4], 7
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x1001ebe3
cmp byte [ebp - 0x14], 0
je 0x1001ebe3
mov eax, dword [esi]
test eax, eax
je 0x1001ebdf
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006161e
mov esp, ebp
pop ebp
ret 4
Function at 0x100261b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071a82
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100d9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], edx
mov ecx, 0x100e11d0
call fcn.10063695
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x48]
push 1
push str.29A83C8C_8395_47F1_9F05_9F112227DBE8
xor esi, esi
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x38], xmm0
call fcn.100483b0
mov dword [ebp - 4], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
mov eax, dword [ebp - 0x50]
cmp byte [eax], 0
jne 0x10026261
push str.90A3941A_7445_4D9A_8FA5_A55EB9290053
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x10026233
push eax
call edi
jmp 0x10026238
call fcn.10026050
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10026253
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10026374
add esi, 0x7d0
cmp esi, 0xea60
jb 0x10026210
cmp dword [0x100dcba8], 0
je 0x1002631a
push 0
mov ecx, 0x100dcba4
call fcn.1001d620
mov eax, dword [0x100dcba8]
cmp byte [eax + 0x54], 0
je 0x1002631a
cmp dword [eax + 0x58], 1
jb 0x1002631a
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x49], al
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
push 0x1b
push str.LeakFix.exe_Start_up_Failed
call fcn.1000f150
push 0x45
push str.RC::RCLeakProcessStarter::MakeSureLeakProcessRunning
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhino_safe_srcleakfixleakfixlib_src_rcleakprocessstarter.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x100dcba4
push eax
push 1
call fcn.1001e720
cmp byte [ebp - 0x49], 0
je 0x10026306
lea eax, [ebp - 0x28]
mov ecx, 0x100dcba4
push eax
call fcn.1001ea90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.1000f080
mov byte [ebp - 4], 0
mov byte [ebp - 4], 0
mov byte [ebp - 0x49], 0
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10026336
push eax
call edi
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0xc
mov ecx, eax
call fcn.1000f080
mov byte [ebp - 4], 0xa
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006161e
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x49], 1
jmp 0x1002631e