joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002227f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x78
mov eax, 0x100751e2
call fcn.1003d36c
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x1009eea0], eax
test edi, edi
jne 0x100222a2
xor al, al
jmp 0x100224a0
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x100222bd
cmp edi, dword [esi + 4]
jne 0x1002249e
call fcn.10022855
jmp 0x1002249e
and eax, 0xf0000
cmp eax, 0x10000
je 0x10022489
cmp eax, 0x40000
je 0x100222ed
cmp eax, 0x80000
jne 0x1002249e
mov ecx, dword [esi]
xor dl, dl
call fcn.1000d6c4
jmp 0x1002249e
mov ecx, dword [esi]
xor dl, dl
call fcn.1000d6c4
mov eax, dword [esi + 0x28]
xor ebx, ebx
sub eax, dword [esi + 0x24]
sar eax, 3
test eax, eax
je 0x1002232e
mov eax, dword [esi + 0x24]
mov eax, dword [eax + ebx*8 + 4]
test eax, eax
je 0x10022320
mov ecx, dword [eax]
test ecx, ecx
je 0x10022320
mov edx, 0x110
call fcn.1000d70e
mov eax, dword [esi + 0x28]
inc ebx
sub eax, dword [esi + 0x24]
sar eax, 3
cmp ebx, eax
jb 0x10022305
push edi
mov ecx, esi
call fcn.1002255e
mov edi, eax
test edi, edi
je 0x1002249e
mov eax, dword [edi + 0x60]
mov dword [ebp + 8], eax
test eax, eax
je 0x1002249e
mov ebx, dword [edi + 0x64]
test ebx, ebx
je 0x1002249e
push edi
mov ecx, esi
call fcn.10022591
cmp dword [esi + 0x18], eax
jne 0x1002249e
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
cmp dword [ecx], 0x3b9aca00
jb 0x1002238a
xor edx, edx
mov dword [ebp + 0xc], 0x3e8
div dword [ebp + 0xc]
add edx, dword [ecx]
mov dword [esi + 0x14], edx
jmp 0x1002238f
add eax, dword [ecx]
mov dword [esi + 0x14], eax
mov ecx, dword [edi]
mov edx, 0x400000
call fcn.1000d70e
call dword [0x1008e478]
mov cl, 0x30
mov dword [ebp - 0x18], 0x53487530
mov dword [ebp - 0x14], 0x575e5158
xor edx, edx
mov word [ebp - 0x10], 0x55
xor cl, byte [ebp + edx - 0x17]
mov byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 8
jae 0x100223cc
mov cl, byte [ebp - 0x18]
jmp 0x100223b9
lea eax, [ebp - 0x17]
mov byte [ebp - 0xf], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.10004179
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x60]
and dword [ebp - 4], 0
lea esi, [ebp - 0x30]
push 0x82
push 4
push ebx
call fcn.10009180
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x10022403
mov eax, dword [eax]
movaps xmm0, xmmword [str.3dF_W]
xor ebx, ebx
movups xmmword [ebp - 0x84], xmm0
mov edx, ebx
mov byte [ebp - 0x64], bl
movaps xmm0, xmmword [0x1008ff00]
push eax
movups xmmword [ebp - 0x74], xmm0
mov cl, byte [ebp - 0x84]
xor byte [ebp + edx - 0x83], cl
inc edx
cmp edx, 0x1f
jb 0x10022424
sub esp, 0x18
mov byte [ebp - 0x64], bl
lea eax, [ebp - 0x83]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x48]
push eax
call fcn.10003c43
add esp, 0x20
mov edx, esi
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.10012519
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.1000402e
jmp 0x1002249e
push edi
call fcn.1002255e
test eax, eax
je 0x1002249e
push eax
mov ecx, esi
call fcn.10022591
mov dword [esi + 0x18], eax
mov al, 1
call fcn.1003d335
ret 8
Function at 0x100260f7
Capabilities:
Encode data using xor

Disassembly:
push 0x8c
mov eax, 0x100754de
call fcn.1003d36c
mov esi, ecx
movzx eax, word [esi + 0xf6]
xor ebx, ebx
movaps xmm0, xmmword [0x10090400]
mov edx, ebx
push eax
movzx eax, word [esi + 0xf4]
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x632228
mov cl, byte [ebp - 0x24]
xor byte [ebp + edx - 0x23], cl
inc edx
cmp edx, 0x12
jb 0x1002612e
sub esp, 0x18
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x68]
push eax
call fcn.10003c43
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 0x10
jb 0x10026163
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10004179
mov byte [ebp - 4], 1
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x50]
call fcn.1000de50
xor edi, edi
lea ecx, [ebp - 0x50]
push ebx
inc edi
push edi
call fcn.1000402e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
push ebx
push edi
call fcn.1000402e
movzx eax, word [esi + 0xf8]
test ax, ax
jne 0x100261d7
mov cl, 0x3c
mov byte [ebp - 0xe], bl
mov al, 0x11
mov byte [ebp - 0x10], cl
xor al, cl
lea ecx, [ebp - 0x50]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0xf]
push eax
call fcn.10004179
mov dword [ebp - 4], 2
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x54]
call fcn.1000de50
lea ecx, [ebp - 0x50]
jmp 0x10026258
push eax
mov cl, 0x4a
mov dword [ebp - 0x20], 0x29231e4a
mov dword [ebp - 0x1c], 0x703e2f21
mov edx, ebx
mov dword [ebp - 0x18], 0x2e6f696a
mov byte [ebp - 0x14], bl
xor cl, byte [ebp + edx - 0x1f]
mov byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0xb
jae 0x10026207
mov cl, byte [ebp - 0x20]
jmp 0x100261f4
sub esp, 0x18
mov byte [ebp - 0x14], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x68]
push eax
call fcn.10003c43
add esp, 0x20
mov dword [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x10026233
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10004179
mov byte [ebp - 4], 4
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x54]
call fcn.1000de50
push ebx
push edi
lea ecx, [ebp - 0x50]
call fcn.1000402e
lea ecx, [ebp - 0x68]
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.1000402e
movzx eax, word [esi + 0xf4]
mov edx, ebx
movss xmm1, dword [0x1008f5a0]
push ecx
push ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov byte [ebp - 0x28], bl
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
movaps xmm0, xmmword [0x100903c0]
movups xmmword [ebp - 0x38], xmm0
mov cl, byte [ebp - 0x38]
xor byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xf
jb 0x10026297
sub esp, 0x18
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x98]
push eax
call fcn.10003c43
add esp, 0x24
mov dword [ebp - 4], 5
cmp dword [eax + 0x14], 0x10
jb 0x100262d3
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x80]
call fcn.10004179
mov byte [ebp - 4], 6
lea edx, [ebp - 0x80]
mov ecx, dword [esi + 0x58]
call fcn.1000de50
push ebx
push edi
lea ecx, [ebp - 0x80]
call fcn.1000402e
push ebx
push edi
lea ecx, [ebp - 0x98]
call fcn.1000402e
call fcn.1003d335
ret
Function at 0x1002683b
Capabilities:
Encode data using xor

Disassembly:
push 0x60
mov eax, 0x10075571
call fcn.1003d3a0
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.100081c7
movzx eax, al
xor ebx, ebx
sub eax, ebx
je 0x1002691c
sub eax, 1
jne 0x100269e4
mov cl, 0x5a
mov dword [ebp - 0x38], 0x2e35165a
mov dword [ebp - 0x34], 0x23283f2e
mov edx, ebx
mov dword [ebp - 0x30], 0x343f2c1f
mov word [ebp - 0x2c], 0x2e
xor cl, byte [ebp + edx - 0x37]
mov byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xc
jae 0x10026899
mov cl, byte [ebp - 0x38]
jmp 0x10026886
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x6c]
call fcn.10004179
mov dword [ebp - 4], 3
mov edx, ebx
movaps xmm0, xmmword [0x10090570]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x3b627777
mov dword [ebp - 0x40], 0x75727471
mov dword [ebp - 0x3c], 0x357f7e
mov cl, byte [ebp - 0x54]
xor byte [ebp + edx - 0x53], cl
inc edx
cmp edx, 0x1a
jb 0x100268d1
lea eax, [ebp - 0x53]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10004179
push ebx
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x6c]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
push eax
call dword [0x1008e474]
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.1000402e
lea ecx, [ebp - 0x6c]
jmp 0x100269dc
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.100080ee
cmp dword [ebp - 0x18], 0
je 0x100269d9
cmp dword [ebp - 0x18], 0xff
ja 0x100269d9
mov cl, 0x4a
mov dword [ebp - 0x38], 0x3e25064a
mov dword [ebp - 0x34], 0x33382f3e
mov edx, ebx
mov dword [ebp - 0x30], 0x242f3c0f
mov word [ebp - 0x2c], 0x3e
xor cl, byte [ebp + edx - 0x37]
mov byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xc
jae 0x10026980
mov cl, byte [ebp - 0x38]
jmp 0x1002696d
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.10004179
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10004179
push ebx
push ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x50]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x6c]
push eax
push eax
call dword [0x1008e474]
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.1000402e
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.1000402e
call fcn.1003d34a
ret 4
Function at 0x1002727f
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x1007566a
call fcn.1003d3a0
mov esi, ecx
mov eax, dword [esi]
mov dword [0x1009ef18], eax
mov ecx, dword [esi]
call fcn.1000d731
test al, al
je 0x10027390
cmp byte [ebp + 8], 0
jne 0x10027390
movaps xmm0, xmmword [0x1008f5e0]
xor ebx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov edx, ebx
mov cl, byte [ebp - 0x3c]
xor byte [ebp + edx - 0x3b], cl
inc edx
cmp edx, 0xe
jb 0x100272bc
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2d], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10004179
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], ebx
mov word [ebp - 0x2c], 0x65
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 0x2b], bl
call fcn.10004179
xor ebx, ebx
lea edx, [ebp - 0x54]
inc ebx
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x10]
call fcn.1000d958
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x54]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10004179
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x10]
call fcn.1000ddd7
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
mov ecx, dword [esi + 0x10]
call fcn.1000da0d
lea eax, [ebp - 0x2b]
mov word [ebp - 0x2c], 0x52
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2b], 0
call fcn.10004179
mov byte [ebp - 4], 3
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x20]
call fcn.1000de50
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
mov ecx, esi
call fcn.100281cc
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.1000402e
call fcn.1003d34a
ret 0xc
Function at 0x10027ab8
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x1007566a
call fcn.1003d3a0
mov esi, ecx
mov ecx, dword [esi]
xor dl, dl
call fcn.1000d5f0
movaps xmm0, xmmword [0x1008f5f0]
xor ebx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov edx, ebx
mov cl, byte [ebp - 0x3c]
xor byte [ebp + edx - 0x3b], cl
inc edx
cmp edx, 0xe
jb 0x10027ade
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2d], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10004179
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], ebx
mov word [ebp - 0x2c], 7
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 0x2b], bl
call fcn.10004179
xor ebx, ebx
lea edx, [ebp - 0x54]
inc ebx
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x10]
call fcn.1000d958
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x54]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10004179
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x10]
call fcn.1000ddd7
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
mov ecx, dword [esi + 0x10]
call fcn.1000da0d
lea eax, [ebp - 0x2b]
mov word [ebp - 0x2c], 0x2b
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2b], 0
call fcn.10004179
mov byte [ebp - 4], 3
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x20]
call fcn.1000de50
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.1000402e
mov ecx, esi
call fcn.100281cc
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.1000402e
call fcn.1003d34a
ret
Function at 0x1002e92a
Capabilities:
Encode data using xor

Disassembly:
push 0xa0
mov eax, 0x10075da0
call fcn.1003d36c
mov esi, ecx
call fcn.1002e4c9
xor ebx, ebx
cmp al, 6
jne 0x1002e9e3
movaps xmm0, xmmword [0x1008f680]
mov edx, ebx
movups xmmword [ebp - 0x48], xmm0
mov cl, byte [ebp - 0x48]
xor byte [ebp + edx - 0x47], cl
inc edx
cmp edx, 0xe
jb 0x1002e957
lea eax, [ebp - 0x47]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x7c]
call fcn.10004179
mov dword [ebp - 4], ebx
mov edx, ebx
movaps xmm0, xmmword [0x10090100]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x1245484c
mov word [ebp - 0x10], 0x1d
mov cl, byte [ebp - 0x24]
xor byte [ebp + edx - 0x23], cl
inc edx
cmp edx, 0x14
jb 0x1002e990
lea eax, [ebp - 0x23]
mov byte [ebp - 0xf], bl
push eax
lea ecx, [ebp - 0x64]
call fcn.10004179
push ebx
push ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x7c]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x64]
push eax
push eax
call dword [0x1008e474]
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.1000402e
jmp 0x1002eab6
push 6
mov edi, ebx
lea eax, [esi + 0x110]
pop ecx
cmp dword [eax - 4], ebx
jbe 0x1002e9fa
cmp dword [eax], ebx
jbe 0x1002e9fa
add edi, dword [eax + 4]
add eax, 0x14
sub ecx, 1
jne 0x1002e9ee
mov ecx, dword [esi + 0x34]
call fcn.1000d731
test al, al
je 0x1002ea18
mov ecx, dword [esi + 0x34]
xor dl, dl
call fcn.1000d5f0
push ecx
mov edx, edi
lea ecx, [ebp - 0xac]
call fcn.1000bcbd
pop ecx
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x1002ea36
mov eax, dword [eax]
movaps xmm0, xmmword [0x10090760]
mov edx, ebx
push eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x366065
mov cl, byte [ebp - 0x38]
xor byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0x12
jb 0x1002ea4b
sub esp, 0x18
mov byte [ebp - 0x25], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x94]
push eax
call fcn.10003c43
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x100]
call fcn.1000de50
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.1000402e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
push ebx
push 1
call fcn.1000402e
mov ecx, dword [esi + 0xfc]
mov dl, 1
call fcn.1000d5f0
call fcn.1003d335
ret
Function at 0x10031200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x23
pop ebx
mov esi, ecx
mov word [ebp - 0x14], 0x3557
mov cl, 0x57
mov byte [ebp - 0x12], bl
mov dword [ebp - 0x11], 0x3b340839
xor edx, edx
mov dword [ebp - 0xd], 0x322438
xor cl, byte [ebp + edx - 0x13]
mov byte [ebp + edx - 0x13], cl
inc edx
cmp edx, 9
jae 0x1003123b
mov cl, byte [ebp - 0x14]
jmp 0x10031228
sub esp, 0x18
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 4], eax
mov dl, 0x5e
mov dword [ebp - 0x14], 0x373a3b5e
mov dword [ebp - 0x10], 0x3f2a012a
xor ecx, ecx
mov word [ebp - 0xc], 0x39
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 8
jae 0x10031285
mov dl, byte [ebp - 0x14]
jmp 0x10031272
sub esp, 0x18
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 8], eax
mov byte [ebp - 0x14], bl
xor ecx, ecx
mov dword [ebp - 0x13], 0x7c4d5741
mov dword [ebp - 0xf], 0x454d4c40
mov dword [ebp - 0xb], 0x4e514a
xor bl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], bl
inc ecx
cmp ecx, 0xb
jae 0x100312d1
mov bl, byte [ebp - 0x14]
jmp 0x100312be
sub esp, 0x18
lea eax, [ebp - 0x13]
mov ecx, esp
xor ebx, ebx
mov byte [ebp - 8], bl
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 0xc], eax
mov dl, 0x3c
mov dword [ebp - 0x14], 0x52485e3c
mov dword [ebp - 0x10], 0x50595863
mov ecx, ebx
mov dword [ebp - 0xc], 0x594859
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 0xa
jae 0x1003131d
mov dl, byte [ebp - 0x14]
jmp 0x1003130a
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
mov dword [esi + 0x10], eax
add esp, 0x18
mov cl, 0x36
mov dword [ebp - 0x14], 0x515b5f36
mov dword [ebp - 0x10], 0x5a574669
mov eax, ebx
mov dword [ebp - 0xc], 0x53424253
mov byte [ebp - 8], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x10031366
mov cl, byte [ebp - 0x14]
jmp 0x10031357
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 0x14], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003138a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x48
mov eax, 0x1007608c
call fcn.1003d3a0
mov esi, ecx
mov eax, dword [esi]
mov dword [0x1009ef80], eax
mov ecx, dword [esi]
call fcn.1000d731
test al, al
je 0x1003147f
cmp byte [ebp + 8], 0
jne 0x1003147f
xor ebx, ebx
mov dword [ebp - 0x3c], 0x706a4104
mov cl, 4
mov dword [ebp - 0x38], 0x50247661
mov dword [ebp - 0x34], 0x4d246365
mov edx, ebx
mov word [ebp - 0x30], 0x40
xor cl, byte [ebp + edx - 0x3b]
mov byte [ebp + edx - 0x3b], cl
inc edx
cmp edx, 0xc
jae 0x100313ec
mov cl, byte [ebp - 0x3c]
jmp 0x100313d9
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2f], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.10004179
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], ebx
mov word [ebp - 0x2c], 0x33
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 0x2b], bl
call fcn.10004179
mov byte [ebp - 4], 1
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 8]
call fcn.1000d958
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.1000402e
mov ecx, dword [esi + 8]
or edx, 0xffffffff
call fcn.1000d9aa
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x54]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10004179
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 8]
call fcn.1000ddd7
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.1000402e
mov ecx, dword [esi + 8]
call fcn.1000da0d
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.1000402e
call fcn.1003d34a
ret 0xc
Function at 0x10031f06
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x39233557
mov esi, ecx
mov dword [ebp - 0x14], 0x38253308
mov cl, 0x57
mov word [ebp - 0x10], 0x27
mov edx, ebx
xor cl, byte [ebp + edx - 0x17]
mov byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 8
jae 0x10031f3d
mov cl, byte [ebp - 0x18]
jmp 0x10031f2a
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
movaps xmm0, xmmword [0x1008fc60]
add esp, 0x18
mov dword [esi + 0x10], eax
mov edx, ebx
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 0xc], bl
mov cl, byte [ebp - 0x1c]
xor byte [ebp + edx - 0x1b], cl
inc edx
cmp edx, 0xf
jb 0x10031f6b
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
movaps xmm0, xmmword [0x10090710]
add esp, 0x18
mov dword [esi + 0x14], eax
mov edx, ebx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x46404251
mov byte [ebp - 0xc], bl
mov cl, byte [ebp - 0x20]
xor byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0x13
jb 0x10031fad
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
add esp, 0x18
mov dword [esi + 4], eax
mov cl, 0x3c
mov dword [ebp - 0x1c], 0x52485e3c
mov dword [ebp - 0x18], 0x52495a63
mov edx, ebx
mov dword [ebp - 0x14], 0x4f5d505f
mov word [ebp - 0x10], 0x4f
xor cl, byte [ebp + edx - 0x1b]
mov byte [ebp + edx - 0x1b], cl
inc edx
cmp edx, 0xc
jae 0x1003200a
mov cl, byte [ebp - 0x1c]
jmp 0x10031ff7
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
mov dword [esi + 8], eax
add esp, 0x18
mov cl, 0x36
mov dword [ebp - 0x18], 0x58425436
mov dword [ebp - 0x14], 0x42595a69
mov eax, ebx
mov dword [ebp - 0x10], 0x4f445342
mov byte [ebp - 0xc], bl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xb
jae 0x10032053
mov cl, byte [ebp - 0x18]
jmp 0x10032044
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.10004179
mov ecx, dword [esi]
call fcn.1000d3c0
mov ecx, dword [0x1009ec68]
add esp, 0x18
mov dword [esi + 0xc], eax
test ecx, ecx
je 0x10032099
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x10032099
mov ecx, dword [ecx]
call fcn.1000d50c
mov ecx, dword [esi]
add edx, 0xf5
push 5
call fcn.1000d5a7
pop ecx
mov ecx, dword [esi]
push 0x14
pop edx
call fcn.1000d70e
mov ecx, dword [esi]
mov dl, 1
call fcn.1000d5f0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x100320ba
xor dl, dl
call fcn.1000d5f0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100320c8
xor dl, dl
call fcn.1000d5f0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x100320d6
xor dl, dl
call fcn.1000d5f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100332d7
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
mov dword [0x100c4230], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x100c422c], ecx
push edi
push ecx
mov dword [0x100c4228], eax
mov dword [0x100c4234], ecx
mov dword [0x100c4238], eax
mov dword [0x100c423c], ecx
mov dword [0x100c4240], ecx
call fcn.1005f89b
mov edi, eax
mov esi, edx
mov eax, 0x55555555
mov dword [0x100c4250], edi
xor ebx, ebx
mov dword [0x100c55d0], eax
pop ecx
mov dword [0x100c55d4], eax
inc ebx
mov dword [0x100c4254], esi
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.1003d570
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, 0x138
mov dword [ebx*8 + 0x100c4250], edi
adc esi, edx
mov dword [ebx*8 + 0x100c4254], esi
inc ebx
cmp ebx, eax
jl 0x10033336
movaps xmm0, xmmword [0x1008fef0]
pop edi
pop esi
mov dword [0x100c4248], eax
mov eax, 0x100c4228
movups xmmword [0x100c55d8], xmm0
pop ebx
ret 0x10

Function at 0x10037376
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1009a084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x100373bf
cmp word [edx], cx
je 0x100373bf
push ecx
lea eax, [ebp - 8]
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100373e4
mov eax, dword [ebp - 8]
xor ecx, ecx
push dword [ebp + 0x14]
push ebx
push 1
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
mov edi, eax
test ecx, ecx
je 0x100373e2
cmp ecx, esi
je 0x100373e2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c795
mov esp, ebp
pop ebp
ret

Function at 0x1003760d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1009a084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, str._pipediscord_ipc_0
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0x10037679
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1003765f
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x100376a8
inc ax
mov word [ebp - 0xa], ax
jmp 0x10037679
cmp eax, 0xe7
jne 0x100376a8
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x100376a8
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x10037642
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c795
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x10037697