joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102efed8], 0
push ebx
push esi
je 0x10065677
cmp byte [0x102efed9], 0
jne 0x100656c5
mov byte [0x102efed9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102eff2c]
xor ebx, dword [0x102eff28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102efeda]
xor al, bl
mov byte [esi + 0x102efeda], al
inc esi
cmp esi, 0x4d
jb 0x10065630
jmp 0x100656c5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102eff2c]
xor ebx, dword [0x102eff28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102efeda]
xor al, bl
mov byte [esi + 0x102efeda], al
inc esi
cmp esi, 0x4d
jb 0x10065680
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102eff26
push 0x102efeda
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100656f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102eff60], 0
push ebx
push esi
je 0x10065767
cmp byte [0x102eff61], 0
jne 0x100657b5
mov byte [0x102eff61], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102eff7c]
xor ebx, dword [0x102eff78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102eff62]
xor al, bl
mov byte [esi + 0x102eff62], al
inc esi
cmp esi, 0xf
jb 0x10065720
jmp 0x100657b5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102eff7c]
xor ebx, dword [0x102eff78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102eff62]
xor al, bl
mov byte [esi + 0x102eff62], al
inc esi
cmp esi, 0xf
jb 0x10065770
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102eff70
push 0x102eff62
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100657e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102f0198], 0
push ebx
push esi
je 0x10065857
cmp byte [0x102f0199], 0
jne 0x100658a5
mov byte [0x102f0199], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f01f4]
xor ebx, dword [0x102f01f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f019a]
xor al, bl
mov byte [esi + 0x102f019a], al
inc esi
cmp esi, 0x50
jb 0x10065810
jmp 0x100658a5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f01f4]
xor ebx, dword [0x102f01f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f019a]
xor al, bl
mov byte [esi + 0x102f019a], al
inc esi
cmp esi, 0x50
jb 0x10065860
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102f01e9
push 0x102f019a
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100658d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102f02f0], 0
push ebx
push esi
je 0x10065947
cmp byte [0x102f02f1], 0
jne 0x10065995
mov byte [0x102f02f1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f033c]
xor ebx, dword [0x102f0338]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f02f2]
xor al, bl
mov byte [esi + 0x102f02f2], al
inc esi
cmp esi, 0x42
jb 0x10065900
jmp 0x10065995
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f033c]
xor ebx, dword [0x102f0338]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f02f2]
xor al, bl
mov byte [esi + 0x102f02f2], al
inc esi
cmp esi, 0x42
jb 0x10065950
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102f0333
push 0x102f02f2
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100659c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102f03c0], 0
push ebx
push esi
je 0x10065a37
cmp byte [0x102f03c1], 0
jne 0x10065a85
mov byte [0x102f03c1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f0414]
xor ebx, dword [0x102f0410]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f03c2]
xor al, bl
mov byte [esi + 0x102f03c2], al
inc esi
cmp esi, 0x49
jb 0x100659f0
jmp 0x10065a85
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f0414]
xor ebx, dword [0x102f0410]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f03c2]
xor al, bl
mov byte [esi + 0x102f03c2], al
inc esi
cmp esi, 0x49
jb 0x10065a40
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102f040a
push 0x102f03c2
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102f04e8], 0
push ebx
push esi
je 0x10065b27
cmp byte [0x102f04e9], 0
jne 0x10065b75
mov byte [0x102f04e9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f053c]
xor ebx, dword [0x102f0538]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f04ea]
xor al, bl
mov byte [esi + 0x102f04ea], al
inc esi
cmp esi, 0x4a
jb 0x10065ae0
jmp 0x10065b75
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f053c]
xor ebx, dword [0x102f0538]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f04ea]
xor al, bl
mov byte [esi + 0x102f04ea], al
inc esi
cmp esi, 0x4a
jb 0x10065b30
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102f0533
push 0x102f04ea
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102f0630], 0
push ebx
push esi
je 0x10065c17
cmp byte [0x102f0631], 0
jne 0x10065c65
mov byte [0x102f0631], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f067c]
xor ebx, dword [0x102f0678]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f0632]
xor al, bl
mov byte [esi + 0x102f0632], al
inc esi
cmp esi, 0x45
jb 0x10065bd0
jmp 0x10065c65
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f067c]
xor ebx, dword [0x102f0678]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f0632]
xor al, bl
mov byte [esi + 0x102f0632], al
inc esi
cmp esi, 0x45
jb 0x10065c20
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102f0676
push 0x102f0632
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102ef568], 0
push ebx
push esi
je 0x10065d0a
cmp byte [0x102ef569], 0
jne 0x10065d58
mov byte [0x102ef569], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ef6ac]
xor ebx, dword [0x102ef6a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102ef56a]
xor al, bl
mov byte [esi + 0x102ef56a], al
inc esi
cmp esi, 0x137
jb 0x10065cc0
jmp 0x10065d58
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ef6ac]
xor ebx, dword [0x102ef6a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102ef56a]
xor al, bl
mov byte [esi + 0x102ef56a], al
inc esi
cmp esi, 0x137
jb 0x10065d10
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102ef6a0
push 0x102ef56a
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102f0730], 0
push ebx
push esi
je 0x10065df7
cmp byte [0x102f0731], 0
jne 0x10065e45
mov byte [0x102f0731], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f0774]
xor ebx, dword [0x102f0770]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f0732]
xor al, bl
mov byte [esi + 0x102f0732], al
inc esi
cmp esi, 0x3a
jb 0x10065db0
jmp 0x10065e45
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f0774]
xor ebx, dword [0x102f0770]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f0732]
xor al, bl
mov byte [esi + 0x102f0732], al
inc esi
cmp esi, 0x3a
jb 0x10065e00
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102f076b
push 0x102f0732
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102ef348], 0
push ebx
push esi
je 0x10065ee7
cmp byte [0x102ef349], 0
jne 0x10065f35
mov byte [0x102ef349], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ef364]
xor ebx, dword [0x102ef360]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102ef34a]
xor al, bl
mov byte [esi + 0x102ef34a], al
inc esi
cmp esi, 0x10
jb 0x10065ea0
jmp 0x10065f35
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ef364]
xor ebx, dword [0x102ef360]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102ef34a]
xor al, bl
mov byte [esi + 0x102ef34a], al
inc esi
cmp esi, 0x10
jb 0x10065ef0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102ef359
push 0x102ef34a
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102ef368], 0
push ebx
push esi
je 0x10065fd7
cmp byte [0x102ef369], 0
jne 0x10066025
mov byte [0x102ef369], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ef37c]
xor ebx, dword [0x102ef378]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102ef36a]
xor al, bl
mov byte [esi + 0x102ef36a], al
inc esi
cmp esi, 0xc
jb 0x10065f90
jmp 0x10066025
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ef37c]
xor ebx, dword [0x102ef378]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102ef36a]
xor al, bl
mov byte [esi + 0x102ef36a], al
inc esi
cmp esi, 0xc
jb 0x10065fe0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102ef375
push 0x102ef36a
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10069a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1030cb40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x102f1be8], 0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
je 0x10069ad2
cmp byte [0x102f1be9], 0
jne 0x10069b16
mov byte [0x102f1be9], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f1c04]
xor ebx, dword [0x102f1c00]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102f1bea], al
inc esi
cmp esi, 0x10
jb 0x10069a91
jmp 0x10069b13
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f1c04]
xor ebx, dword [0x102f1c00]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102f1bea], al
inc esi
cmp esi, 0x10
jb 0x10069ad4
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x1d]
push eax
push 0x102f1bf9
push 0x102f1bea
lea ecx, [ebp - 0x1c]
call fcn.1004d640
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov esi, eax
cmp ecx, 0xf
jbe 0x10069b79
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10069b6f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10069b6f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1010f1fa
add esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
test esi, esi
jne 0x10069b93
mov dword [edi], esi
jmp 0x10069b9d
push 0
push ebx
call esi
add esp, 8
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010f522
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006f5a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1030cb40]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x1017bf88]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x1017bf8c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x1017bf70]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x1017bf80]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x1006f670
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x1006f639
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x1006f686
inc ax
mov word [ebp - 0xa], ax
jmp 0x1006f64f
cmp eax, 0xe7
jne 0x1006f686
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x1006f686
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1006f620
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010f522
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010f522
mov esp, ebp
pop ebp
ret
Function at 0x1006fb70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x1030cb40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [ebp - 0xa90]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1006fbe4
push str.Error_opening_Steam_key_n
jmp 0x1006fca4
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1006fc9f
mov ecx, dword [ebp - 0xa94]
cmp ecx, 1
jb 0x1006fc9f
shr ecx, 1
mov eax, esi
je 0x1006fc58
lea edx, [esi + 0x5c]
nop word [eax + eax]
cmp word [ebp + eax*2 - 0x28c], 0x2f
jne 0x1006fc53
mov word [ebp + eax*2 - 0x28c], dx
inc eax
cmp eax, ecx
jb 0x1006fc40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push str.__s__steam:__rungameid__s
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.1006fa80
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1006f790
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010f522
mov esp, ebp
pop ebp
ret
push str.Error_reading_SteamExe_key_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.1006fcd0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.1010f522
mov esp, ebp
pop ebp
ret
Function at 0x100715c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x1017ed74
push 0x64
call fcn.1010fd4f
mov esi, eax
add esp, 8
test esi, esi
je 0x10071763
push 0x64
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov byte [esi], 1
lea eax, [esi + 0x34]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
push eax
movq qword [esi + 0x20], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 4], 2
mov dword [esi + 0x30], 0
call sub.MSVCP140.dll__Cnd_init_in_situ
xorps xmm0, xmm0
mov dword [0x10333f6c], esi
add esp, 0x10
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x10071666
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1007165b
cmp byte [eax], 0
je 0x1007165b
push eax
push esi
call fcn.1006fb70
jmp 0x10071663
push 0
push esi
call fcn.1006faf0
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x102f3f60
mov dword [0x10333f68], eax
call sub.MSVCP140.dll__Mtx_lock
add esp, 4
test eax, eax
jne 0x10071772
cmp dword [0x102f3f8c], 0x7fffffff
je 0x10071779
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100716ad
movups xmm0, xmmword [eax]
movups xmmword [0x1032f918], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x100716b7
xorps xmm0, xmm0
movups xmmword [0x1032f918], xmm0
movq qword [0x1032f928], xmm0
xorps xmm0, xmm0
push 0x102f3f60
movups xmmword [0x1032f930], xmm0
movq qword [0x1032f940], xmm0
call sub.MSVCP140.dll__Mtx_unlock
add esp, 4
cmp dword [0x1032f914], 0
jne 0x1007176d
push esi
call fcn.10072ac0
mov dword [0x1032f914], eax
mov dword [eax + 8], 0x1006fd00
mov eax, dword [0x1032f914]
mov dword [eax + 0xc], 0x1006fd20
mov al, 1
mov esi, dword [0x10333f6c]
xchg byte [esi], al
push 4
call fcn.1010f1ca
add esp, 8
test eax, eax
je 0x10071725
mov dword [eax], esi
jmp 0x10071727
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1006fd70
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1007178a
cmp dword [esi + 0x60], 0
je 0x10071755
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x10333f6c], 0
pop esi
mov esp, ebp
pop ebp
ret
push 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 6
mov dword [0x102f3f8c], 0x7ffffffe
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x10075ce0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4

Function at 0x10076390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 8
call fcn.1010f1ca
add esp, 4
test eax, eax
je 0x100763b2
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
jmp 0x100763b4
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x100760d0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x100763dc
pop edi
pop esi
pop ebp
ret
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1007a0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102f54a0], 0
push ebx
push esi
je 0x1007a167
cmp byte [0x102f54a1], 0
jne 0x1007a1b5
mov byte [0x102f54a1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f54d4]
xor ebx, dword [0x102f54d0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f54a2]
xor al, bl
mov byte [esi + 0x102f54a2], al
inc esi
cmp esi, 0x28
jb 0x1007a120
jmp 0x1007a1b5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102f54d4]
xor ebx, dword [0x102f54d0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102f54a2]
xor al, bl
mov byte [esi + 0x102f54a2], al
inc esi
cmp esi, 0x28
jb 0x1007a170
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102f54c9
push 0x102f54a2
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4