joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16007b0cc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x16007b0fc
xor eax, eax
jmp 0x16007b1bf
mov rbp, rbx
cmp word [rax], si
je 0x16007b121
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x16007b108
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x16007b104
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1600750c4
movsxd r14, eax
test eax, eax
jne 0x16007b15f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x16007b0f5
mov rcx, r14
call fcn.160071884
mov rdi, rax
test rax, rax
jne 0x16007b178
xor ecx, ecx
call fcn.160071848
jmp 0x16007b154
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1600750c4
test eax, eax
jne 0x16007b1a9
mov rcx, rdi
call fcn.160071848
jmp 0x16007b1b3
xor ecx, ecx
call fcn.160071848
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x16007b1dc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x16007b263
mov rsi, rbx
cmp word [rax], bp
je 0x16007b222
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x16007b20c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x16007b208
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.160071884
mov rdi, rax
test rax, rax
je 0x16007b250
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1600588f0
mov rbp, rdi
xor ecx, ecx
call fcn.160071848
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1600830b4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1600782e8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1600782e8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x160083204
cmp rax, 0xffffffffffffffff
je 0x160083204
xor edi, edi
test rbp, rbp
jle 0x1600831af
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.16007325c
mov rbx, rax
test rax, rax
jne 0x16008313c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1600831a5
mov edx, 0x8000
mov ecx, r14d
call fcn.160082f3c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.16007694c
cmp eax, 0xffffffff
je 0x160083185
cdqe
sub rbp, rax
test rbp, rbp
jg 0x16008314c
mov edx, r15d
mov ecx, r14d
call fcn.160082f3c
jmp 0x1600831a5
cmp byte [rsi + 0x38], dil
je 0x16008319c
cmp dword [rsi + 0x34], 5
jne 0x16008319c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1600831a5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.160071848
jmp 0x160083218
jns 0x160083218
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1600782e8
cmp rax, 0xffffffffffffffff
jne 0x1600831d0
cmp byte [rsi + 0x30], dil
je 0x160083218
mov edi, dword [rsi + 0x2c]
jmp 0x160083218
mov ecx, r14d
call fcn.16007fdb0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x160083218
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x160083218
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x160083211
mov eax, dword [rsi + 0x2c]
jmp 0x160083216
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1600782e8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x160083a20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x160083a48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x160083a48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400054ed
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000550b
je 0x140005516
call 0x140005565
mov bl, 0xc7
lahf
pop rsi
jne 0x1400054f6
call 0x14000550e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400054f6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140005544
je 0x140005582
invalid
je 0x140005593
jne 0x1400054f6
lea rax, [0x14000541c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000117d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140005634
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000568d
je 0x140005693
call 0x140005684
fild qword [rdi - 0x7c]
jmp 0x174f41e06
jne 0x140005656
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140005616
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140005500
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000550b
je 0x140005516
call 0x140005565
mov bl, 0xc7
lahf
pop rsi
jne 0x1400054f6
call 0x14000550e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400054f6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140005544
je 0x140005582
invalid
je 0x140005593
jne 0x1400054f6
lea rax, [0x14000541c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000117d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140005634
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000568d
je 0x140005693
call 0x140005684
fild qword [rdi - 0x7c]
jmp 0x174f41e06
jne 0x140005656
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140005616
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000552c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000550b
je 0x140005516
call 0x140005565
mov bl, 0xc7
lahf
pop rsi
jne 0x1400054f6
call 0x14000550e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400054f6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140005544
je 0x140005582
invalid
je 0x140005593
jne 0x1400054f6
lea rax, [0x14000541c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000117d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140005634
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000568d
je 0x140005693
call 0x140005684
fild qword [rdi - 0x7c]
jmp 0x174f41e06
jne 0x140005656
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140005616
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140005565
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000550b
je 0x140005516
call 0x140005565
mov bl, 0xc7
lahf
pop rsi
jne 0x1400054f6
call 0x14000550e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x1400054f6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140005544
je 0x140005582
invalid
je 0x140005593
jne 0x1400054f6
lea rax, [0x14000541c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000117d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140005634
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000568d
je 0x140005693
call 0x140005684
fild qword [rdi - 0x7c]
jmp 0x174f41e06
jne 0x140005656
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140005616
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x180001848
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x1800018ae
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18000189f
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180001895
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180001869
mov r8, qword [rbx]
mov rcx, qword [0x18019e0c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800018c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x40]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x18019e0e0]
mov r8, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rbp, [r8 - 5]
cmove rbp, r8
lea rdi, [r8 - 5]
test al, al
lea r14, [rcx*2 + 5]
cmove rdi, r8
mov rdx, r14
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000192b
mov eax, 0xa
jmp 0x1800019b7
test esi, esi
je 0x18000194d
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18000196e
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18000196e
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180001968
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18000196e
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180001f44
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x180001f5b
cmp r8b, 0x90
je 0x180001f5b
cmp r8b, 0xcc
jne 0x180001f7d
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180001f79
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180001f7d
add edx, r10d
cmp edx, r9d
jb 0x180001f69
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x1800022e4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18000232e
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x18019e0d8]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x18000236b
cmp rbx, rsi
jb 0x180002366
cmp rbx, r15
jae 0x180002366
cmp qword [rbx + 8], 0
jne 0x1800024c7
mov rbx, qword [rbx]
jmp 0x18000234c
mov r14, rdi
cmp rdi, rsi
jb 0x1800023ef
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x1800023e6
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800023e6
cmp dword [rbp - 0x10], 0x10000
je 0x1800023b6
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x1800023e6
jmp 0x180002382
test r14, r14
je 0x1800023e6
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180002487
cmp r14, rsi
jae 0x180002373
test rbx, rbx
jne 0x180002487
cmp rdi, r15
ja 0x1800024c7
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800024c7
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800024c7
cmp dword [rbp - 0x10], 0x10000
je 0x18000245d
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x180002416
test rdi, rdi
je 0x1800024c7
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x1800023e9
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x18000249a
mov rax, qword [0x18019e0d8]
mov qword [rbx], rax
mov qword [0x18019e0d8], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180003200
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x30]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180003291
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x180003280
cmp rax, rcx
je 0x180003291
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180003272
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x180003291
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret
Function at 0x180003cd0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18012e6b8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x1800afda8]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x1800afdac]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x1800afd90]
mov word [rsp + 0x6c], ax
mov eax, 0x30
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x1800afda0]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x180003dd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180003d88
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x180003df7
inc ax
mov word [rsp + 0x6a], ax
jmp 0x180003da3
cmp eax, 0xe7
jne 0x180003df7
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x180003df7
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x180003d68
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800ac150
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x180003dd9

Function at 0x180003e00
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18012e6b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x180003eb0
test rcx, rcx
je 0x180003eb0
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x180003eb0
xor ebp, ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x30], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180003e9b
mov eax, dword [rsp + 0x30]
cmp rax, rdi
jb 0x180003eb0
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x34]
mov r8d, edi
mov dword [rsp + 0x34], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x180003e91
jmp 0x180003eb2
mov rcx, rbx
call fcn.180003c40
jmp 0x180003eb0
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800ac150
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180003ed0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18012e6b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
test r8, r8
jne 0x180003f02
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800ac150
add rsp, 0x40
pop rbx
ret
test rcx, rcx
je 0x180003f37
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x180003f37
test rdx, rdx
je 0x180003f37
xor eax, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x180003f37
cmp dword [rsp + 0x30], ebx
je 0x180003eed
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800ac150
add rsp, 0x40
pop rbx
ret