joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003bac
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x140019188]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140003c1d
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140003c1d
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x140003bfb
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x1400138c0]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.140001c5c
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140003c93
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x140003d5c
mov edx, reloc.OLEAUT32.dll_CreateErrorInfo
mov rcx, qword [rbp + 0x168]
lea r8, [0x140013804]
call fcn.1400035c8
mov esi, eax
jmp 0x140003d5f
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.140003a24
mov esi, eax
test eax, eax
jns 0x140003cd0
mov rcx, qword [rbp + 0x168]
lea r8, [0x140013804]
mov r9d, eax
mov edx, 0xcf
call fcn.140003590
jmp 0x140003d5f
lea r8, [0x1400138c8]
lea rcx, [rsp + 0x30]
call fcn.140001c5c
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140003d08
mov edx, 0xd5
jmp 0x140003c79
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140003a24
mov esi, eax
test eax, eax
jns 0x140003d40
mov rcx, qword [rbp + 0x168]
lea r8, [0x140013804]
mov r9d, eax
mov edx, 0xd7
call fcn.140003590
mov rcx, rbx
call fcn.140003664
jmp 0x140003d5f
mov rcx, rbx
call fcn.140003664
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x140003d6c
mov rcx, rdi
call fcn.140003664
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14000ffb0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140005dd0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
or rax, 0xffffffffffffffff
xor ebx, ebx
inc rax
cmp word [r8 + rax*2], bx
jne 0x140005ddc
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140005e31
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_analog_sdk_simulation_servicesperceptionsimulationexemain.cpp
mov ebx, 0x80004005
mov edx, 0xd8
mov r9d, ebx
call fcn.140003590
mov eax, ebx
jmp 0x140005e33
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140005e40
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [0x140014250]
mov dword [rsp + 0x28], 0xb4
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140005e94
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_analog_sdk_simulation_servicesperceptionsimulationexemain.cpp
mov r9d, 0x80004005
mov edx, 0xf6
call fcn.140003590
mov eax, 0x80004005
jmp 0x140005e96
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000cffc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
sub rsp, 0x110
mov rbx, r8
mov dword [rax + 0x10], VarDecRound
lea rax, [rax + 0x10]
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, str.Name
mov qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14000d0d2
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, VarDecRound
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rsp + 0x40]
mov ecx, 0x80
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rbx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rbx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rbx + 0x50], xmm1
movups xmmword [rbx + 0x60], xmm0
add rbx, rcx
movups xmm0, xmmword [rax + 0x70]
add rax, rcx
movups xmmword [rbx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
mov rax, qword [rax + 0x40]
movups xmmword [rbx + 0x20], xmm1
movups xmmword [rbx + 0x30], xmm0
mov qword [rbx + 0x40], rax
add rsp, 0x110
pop rbx
ret

Function at 0x14000d0e4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
sub rsp, 0x38
mov r9d, 4
lea rax, [r11 + 0x18]
mov dword [r11 - 0x10], r9d
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
add rsp, 0x38
ret

Function at 0x14000d12c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
lea rax, [r11 + 0x18]
mov dword [rsp + 0x60], 4
mov qword [r11 - 0x18], rax
mov r8, rdx
lea rax, [r11 + 0x20]
mov r9d, 0x10
mov qword [r11 - 0x20], rax
xor edx, edx
and qword [r11 - 0x28], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d178
cmp dword [rsp + 0x60], 4
jne 0x14000d178
mov eax, dword [rsp + 0x68]
jmp 0x14000d17a
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000d188
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
mov rbx, r8
mov dword [rsp + 0x68], 0x30
lea rax, [r11 + 0x20]
mov r8, rdx
mov qword [r11 - 0x18], rax
mov r9d, 8
mov qword [r11 - 0x20], rbx
xor edx, edx
and qword [r11 - 0x28], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d1ce
cmp dword [rsp + 0x68], 0x30
je 0x14000d1dc
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
add rsp, 0x40
pop rbx
ret
Function at 0x14000d1ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
mov rbx, r8
mov dword [rsp + 0x68], 0x14
lea rax, [r11 + 0x20]
mov r8, rdx
mov qword [r11 - 0x18], rax
mov r9d, 8
mov qword [r11 - 0x20], rbx
xor edx, edx
and qword [r11 - 0x28], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d232
cmp dword [rsp + 0x68], 0x14
je 0x14000d23d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov dword [rbx + 0x10], eax
add rsp, 0x40
pop rbx
ret
Function at 0x14000ea70
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140019188]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
xor ebx, ebx
xor edi, edi
xor esi, esi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
mov ebp, 0x80070000
test eax, eax
jne 0x14000eaed
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
lea rcx, str.GetModuleFileName_failed__0x_08X__n
or ebx, ebp
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.140011148
test ebx, ebx
js 0x14000ec1f
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
test rax, rax
je 0x14000eb0b
mov rdi, rax
jmp 0x14000eb2f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
lea rcx, str.OpenSCManager_failed__0x_08X__n
or ebx, ebp
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.140011148
test ebx, ebx
js 0x14000ec07
lea rax, [0x140013bdc]
mov r9d, 0x14
mov qword [rsp + 0x60], rax
lea r8, [0x140013b90]
lea rax, str..LocalSystem
mov rcx, rdi
mov qword [rsp + 0x58], rax
lea rdx, str.PerceptionSimulation
lea rax, str.rpcss
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x70]
and qword [rsp + 0x48], rsi
and qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
nop dword [rax + rax]
test rax, rax
je 0x14000ebb4
mov rsi, rax
jmp 0x14000ebd8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
lea rcx, str.CreateService_failed__0x_08X__n
or ebx, ebp
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.140011148
test ebx, ebx
js 0x14000ebef
lea rdx, str.PerceptionSimulation
lea rcx, str._ls_is_installed.
call fcn.140011148
test rsi, rsi
je 0x14000ec07
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test eax, eax
je 0x14000ec67
test rdi, rdi
je 0x14000ec1f
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test eax, eax
je 0x14000ec4b
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000ffb0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, ebp
test eax, eax
cmovle ecx, eax
call fcn.140004b78
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, ebp
test eax, eax
cmovle ecx, eax
call fcn.140004b78
int3
Function at 0x14000ffd8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140019760], eax
call fcn.140010980
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140019760], 0
jne case.default.0x14001002e
mov ecx, 1
call fcn.140010980
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov edx, 0x8fc34457
out 0xee, al
invalid
Function at 0x1800403a2
Capabilities:
Write file on windows

Disassembly:
jmp 0x18008bd90
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1801430f4]
call fcn.1800429f9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x18008bde7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18008bef3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x18008be8c
cmp qword [rbp + 0x28], 0
jle 0x18008be8c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x18008be2c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.18004277e
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x18008bee2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x18008bee2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x180040703
Capabilities:
Write file on windows

Disassembly:
jmp 0x18008c820
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x1800f1500]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1801431b6]
call fcn.1800429f9
cmp qword [rbp + 0x150], 0
jne 0x18008c884
mov al, 1
jmp 0x18008c972
mov rax, qword [rbp + 0x140]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x18008c8b8
mov eax, dword [0x1800f1024]
add eax, 5
mov r8d, eax
lea rdx, str.D:_backupJar_INJ_racDiscordSDK_srcconnection_win.cpp
lea rcx, str.self
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
cmp qword [rbp + 8], 0
jne 0x18008c8c6
xor al, al
jmp 0x18008c972
mov rax, qword [rbp + 8]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x18008c8d8
xor al, al
jmp 0x18008c972
cmp qword [rbp + 0x148], 0
jne 0x18008c904
mov eax, dword [0x1800f1024]
add eax, 0xc
mov r8d, eax
lea rdx, str.D:_backupJar_INJ_racDiscordSDK_srcconnection_win.cpp
lea rcx, [0x1800d6aa8]
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
cmp qword [rbp + 0x148], 0
jne 0x18008c912
xor al, al
jmp 0x18008c972
mov eax, dword [rbp + 0x150]
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18008c961
mov eax, dword [rbp + 0x24]
cmp dword [rbp + 0x44], eax
jne 0x18008c961
mov dword [rbp + 0x114], 1
jmp 0x18008c96b
mov dword [rbp + 0x114], 0
movzx eax, byte [rbp + 0x114]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800d68d0]
call fcn.18004224c
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1800413b5
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x180040a1e
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x180092ea0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1801432be]
call fcn.1800429f9
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x138
jne 0x180092edc
mov rcx, qword [rbp + 0x100]
call fcn.1800406c2
jmp 0x180092ef7
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jb 0x180092ef7
mov rcx, qword [rbp + 0x100]
call fcn.18004148c
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx + rax*8 + 8]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shr rax, 0x1d
mov rcx, qword [rbp + 0x100]
and rax, qword [rcx + 0x1388]
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x25
movabs rcx, 0xfff7eee000000000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shr rax, 0x2b
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x18004148c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1800956f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1801432be]
call fcn.1800429f9
mov qword [rbp + 8], 0x137
mov qword [rbp + 0x28], 0x9c
mov qword [rbp + 0x48], 0
jmp 0x180095734
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0x9c
jae 0x1800957dd
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
and rax, 1
test rax, rax
je 0x18009579c
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x1800957a7
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0x68]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor rax, qword [rcx + rdx*8 + 0xea8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x180095729
mov qword [rbp + 0x88], 0x9c
jmp 0x1800957fb
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x137
jae 0x1800958bc
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
and rax, 1
test rax, rax
je 0x180095872
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x18009587d
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xa8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1800957ea
mov qword [rbp + 0xc8], 0x137
mov eax, 8
imul rax, rax, 0x26f
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rcx + rax + 8]
and rax, 0xffffffff80000000
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rdx + rcx + 8]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
and rax, 1
test rax, rax
je 0x18009592e
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x180095939
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xe8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov ecx, 8
imul rcx, rcx, 0x9b
mov rdx, qword [rbp + 0x1e0]
xor rax, qword [rdx + rcx + 8]
mov ecx, 8
imul rcx, rcx, 0x137
mov rdx, qword [rbp + 0x1e0]
mov qword [rdx + rcx + 8], rax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1800414c3
Capabilities:
Read file on windows
Read pipe

Disassembly:
jmp 0x18008c5c0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x1800f1500]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1801431b6]
call fcn.1800429f9
cmp qword [rbp + 0x168], 0
jne 0x18008c63e
mov eax, dword [0x1800f1028]
inc eax
mov r8d, eax
lea rdx, str.D:_backupJar_INJ_racDiscordSDK_srcconnection_win.cpp
lea rcx, [0x1800d6aa8]
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
cmp qword [rbp + 0x168], 0
jne 0x18008c64f
xor al, al
jmp 0x18008c76d
mov rax, qword [rbp + 0x160]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x18008c683
mov eax, dword [0x1800f1028]
add eax, 6
mov r8d, eax
lea rdx, str.D:_backupJar_INJ_racDiscordSDK_srcconnection_win.cpp
lea rcx, str.self
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
cmp qword [rbp + 8], 0
jne 0x18008c691
xor al, al
jmp 0x18008c76d
mov rax, qword [rbp + 8]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x18008c6a3
xor al, al
jmp 0x18008c76d
mov dword [rbp + 0x24], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18008c75f
mov eax, dword [rbp + 0x24]
cmp rax, qword [rbp + 0x170]
jb 0x18008c75d
mov eax, dword [rbp + 0x170]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x64], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x64]
mov r8d, dword [rbp + 0x44]
mov rdx, qword [rbp + 0x168]
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x18008c751
mov eax, dword [rbp + 0x64]
cmp dword [rbp + 0x44], eax
je 0x18008c74b
mov eax, dword [0x1800f1028]
add eax, 0x13
mov r8d, eax
lea rdx, str.D:_backupJar_INJ_racDiscordSDK_srcconnection_win.cpp
lea rcx, str.bytesToRead__bytesRead
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
mov al, 1
jmp 0x18008c76d
mov rcx, qword [rbp + 0x160]
call fcn.1800416e4
jmp 0x18008c76b
mov rcx, qword [rbp + 0x160]
call fcn.1800416e4
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800d69a0]
call fcn.18004224c
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1800413b5
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x180041702
Capabilities:
Terminate process

Disassembly:
jmp 0x1800be480
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x180041d1a
Capabilities:
Check if file exists

Disassembly:
jmp 0x18008c3d0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1b0
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1800f1500]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1801431b6]
call fcn.1800429f9
lea rax, [rbp + 8]
lea rcx, str._pipediscord_ipc_0
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x58], 0x15
mov eax, 2
imul rax, rax, 0x15
mov ecx, 0x30
mov word [rbp + rax + 8], cx
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x78], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rbp + 0x78]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x78]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x18008c4a4
mov rax, qword [rbp + 0x78]
mov byte [rax], 1
mov al, 1
jmp 0x18008c523
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 2
jne 0x18008c4f2
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rbp + rax + 8]
cmp eax, 0x39
jge 0x18008c4f0
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rbp + rax + 8]
inc ax
mov ecx, 2
imul rcx, rcx, 0x15
mov word [rbp + rcx + 8], ax
jmp 0x18008c458
jmp 0x18008c51a
cmp dword [rbp + 0x94], 0xe7
jne 0x18008c51a
mov edx, 0x2710
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x18008c515
xor al, al
jmp 0x18008c523
jmp 0x18008c458
xor al, al
jmp 0x18008c523
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1800d6850]
call fcn.18004224c
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1800413b5
lea rsp, [rbp + 0x170]
pop rdi
pop rsi
pop rbp
ret