joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413de8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xe8], 0xdbec2e45
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
push ebx
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0xe4], 0xe3a0bcf3
mov edi, dword [ebp + eax*4 - 0xc]
mov dword [ebp - 0xe0], 0x71bf94e
mov dword [ebp - 0xdc], 0x7103b6ae
mov dword [ebp - 0xd8], 0x84f0d5ec
mov dword [ebp - 0xd4], 0x76ced3be
mov dword [ebp - 0xd0], 0x3c4096f1
mov dword [ebp - 0xcc], 0xc62c3111
mov dword [ebp - 0xc8], 0x3aaf576e
mov dword [ebp - 0xc4], 0x7be36162
mov dword [ebp - 0xc0], 0xed423d88
mov dword [ebp - 0xbc], 0x4458c8a0
mov dword [ebp - 0xb8], 0xc5533cd9
mov dword [ebp - 0xb4], 0xa408f897
mov dword [ebp - 0xb0], 0x435e7a61
mov dword [ebp - 0xac], 0x8da5cf75
mov dword [ebp - 0xa8], 0xed989342
mov dword [ebp - 0xa4], 0xa8bdf31a
mov dword [ebp - 0xa0], 0xd6ad8170
mov dword [ebp - 0x9c], 0x21ab5db0
mov dword [ebp - 0x98], 0x7aec7ad8
mov dword [ebp - 0x94], 0xac60a3ee
mov dword [ebp - 0x90], 0x83398492
mov dword [ebp - 0x8c], 0xd68a488c
mov dword [ebp - 0x88], 0x5e166e82
mov dword [ebp - 0x84], 0xa3ed9c57
mov dword [ebp - 0x80], 0x76b06050
mov dword [ebp - 0x7c], 0xf3390eb7
mov dword [ebp - 0x78], 0x9363d3ee
mov dword [ebp - 0x74], 0xa14ffbc4
mov dword [ebp - 0x70], 0x3f1856
mov dword [ebp - 0x6c], 0xe0fc1230
mov dword [ebp - 0x68], 0xadb6edbd
mov dword [ebp - 0x64], 0x32048072
mov dword [ebp - 0x60], 0x640dbdf8
mov dword [ebp - 0x5c], 0xb4afd2b9
mov dword [ebp - 0x58], 0x5297cfb4
mov dword [ebp - 0x54], 0x40387f8
mov dword [ebp - 0x50], 0xc16e7f4e
mov dword [ebp - 0x4c], 0x70c7670b
mov dword [ebp - 0x48], 0x18d31878
mov dword [ebp - 0x44], 0x822120c2
mov dword [ebp - 0x40], 0x4e52df82
mov dword [ebp - 0x3c], 0x864972c7
mov dword [ebp - 0x38], 0xcc51b8d1
mov dword [ebp - 0x34], 0x273c3366
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x2c], 0xe6c50e58
mov dword [ebp - 0x28], 0xecb2f5bf
mov dword [ebp - 0x24], 0x6f7f8332
mov dword [ebp - 0x20], 0x296eafa1
mov dword [ebp - 0x1c], 0x99caad80
mov dword [ebp - 0x18], 0x59aa81e0
mov dword [ebp - 0x14], 0x265c96f0
mov word [ebp - 0x10], 0x3844
mov byte [ebp - 0xe], bl
test edi, edi
je 0x414050
push edi
call fcn.00405d0b
add eax, 2
push eax
call fcn.00402b7c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x414050
push edi
call fcn.00405d0b
add eax, 2
push eax
push ebx
push esi
call fcn.00402b4e
push edi
call fcn.00405d0b
push eax
push edi
push esi
call fcn.00402b2b
push edi
mov dword [ebp - 8], 0x46534f4b
mov word [ebp - 4], 0x464b
mov byte [ebp - 2], bl
call fcn.00405d0b
add esp, 0x24
push eax
push esi
lea eax, [ebp - 8]
push esi
push eax
call fcn.00405d0b
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00403aea
add esp, 0x14
mov eax, esi
jmp 0x414052
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov bl, 0x41
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push str.ventoy_disk_init_..._n
push 1
mov dword [ebp - 4], eax
call fcn.00401a20
push 0x20c00
call fcn.00425f1b
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401040
push 0x20c00
push 0
push esi
call fcn.004252d0
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [0x455b60], esi
test eax, eax
je 0x4010dd
test al, 1
je 0x4010d0
imul edx, dword [0x455ba8], 0x20c
mov cl, bl
movsx esi, bl
add edx, dword [0x455b60]
call fcn.00402d10
test eax, eax
jne 0x4010a0
mov edx, dword [0x455ba8]
mov eax, dword [0x455b60]
imul ecx, edx, 0x20c
inc edx
push esi
push str._C:_is_ventoy_disk_n
push 1
mov dword [0x455ba8], edx
mov byte [ecx + eax], bl
call fcn.00401a20
add esp, 0xc
jmp 0x4010cd
imul eax, dword [0x455ba8], 0x20c
push 0x20c
push 0
add eax, dword [0x455b60]
push eax
call fcn.004252d0
push esi
push str._C:_is_NOT_ventoy_disk_n
push 1
call fcn.00401a20
add esp, 0x18
mov eax, dword [ebp - 4]
inc bl
shr eax, 1
mov dword [ebp - 4], eax
jne 0x401051
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402310
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x318
mov eax, dword [0x454004]
xor eax, esp
mov dword [esp + 0x314], eax
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0xc]
push 0x104
push 0x104
push eax
call fcn.004010f0
push dword [eax + 4]
push dword [eax]
call fcn.00428cc7
add esp, 0x20
xor eax, eax
mov cl, byte [esp + eax]
test cl, cl
je 0x40236a
cmp cl, 0x7f
ja 0x402394
inc eax
cmp eax, 0x104
jl 0x402356
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4023c5
test al, 0x10
je 0x4023c5
mov eax, 1
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.00423c62
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [esp + 0x10c]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xc]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x402374
mov ecx, dword [esp + 0x314]
xor eax, eax
xor ecx, esp
call fcn.00423c62
mov esp, ebp
pop ebp
ret
Function at 0x4023e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x318
mov eax, dword [0x454004]
xor eax, esp
mov dword [esp + 0x314], eax
push ebx
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0x14]
push 0x104
push 0x104
push eax
call fcn.004010f0
push dword [eax + 4]
push dword [eax]
call fcn.00428cc7
add esp, 0x20
xor eax, eax
mov cl, byte [esp + eax + 8]
test cl, cl
je 0x40243d
cmp cl, 0x7f
ja 0x40248d
inc eax
cmp eax, 0x104
jl 0x402428
push 0
push 0
push 3
push 0
push 1
push 8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp esi, 0xffffffff
je 0x4024da
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, 0x10
jne 0x4024da
mov eax, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.00423c62
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [esp + 0x114]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 3
push 0
push 1
push 8
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x402461
mov ecx, dword [esp + 0x31c]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.00423c62
mov esp, ebp
pop ebp
ret
Function at 0x403090
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x454004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x220], eax
mov esi, ecx
push edi
mov dword [ebp - 0x218], edx
xor eax, eax
mov cl, byte [eax + esi]
test cl, cl
je 0x4030d6
cmp cl, 0x7f
ja 0x40310f
inc eax
cmp eax, 0x104
jl 0x4030c2
push 0
push 0
push 3
push 0
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403149
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_open__s__u_n
push 1
call fcn.00401a20
add esp, 0x10
jmp 0x403214
push 0x208
lea eax, [ebp - 0x210]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 3
push 0
push 1
push closesocket
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x4030ec
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
xor edx, edx
mov ecx, ebx
add ecx, dword [ebp - 0x218]
setb dl
neg edx
or edx, ecx
push edx
call fcn.00425f1b
add esp, 4
mov dword [ebp - 0x218], eax
test eax, eax
jne 0x403193
push str.Failed_to_alloc_file_buffer_n
push 1
call fcn.00401a20
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403214
push 0
lea ecx, [ebp - 0x214]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4031e1
cmp ebx, dword [ebp - 0x214]
jne 0x4031e1
mov ecx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
push edi
mov dword [ecx], eax
mov eax, dword [ebp - 0x220]
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423c62
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x214]
push esi
push str.Failed_to_read_file___s___u_err:_u
push 1
call fcn.00401a20
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x218]
push eax
call fcn.00425f00
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423c62
mov esp, ebp
pop ebp
ret
Function at 0x407960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x454004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, edx
test edi, edi
jne 0x407996
push 0xa0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423c62
mov esp, ebp
pop ebp
ret
push esi
push 0x358
call fcn.00425f1b
mov esi, eax
add esp, 4
test esi, esi
jne 0x4079c4
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423c62
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [ebp - 0x20c]
mov edx, edi
push eax
call fcn.004074b0
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407a3e
test al, 0x10
je 0x407a3e
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4079f5
mov eax, dword [0x44d7dc]
mov dword [ecx], eax
mov ax, word [0x44d7e0]
mov word [ecx + 4], ax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
mov eax, esi
mov byte [esi + 0x254], 0
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423c62
mov esp, ebp
pop ebp
ret
push esi
call fcn.00425f00
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop edi
call fcn.00423c62
mov esp, ebp
pop ebp
ret
Function at 0x413230
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
or edx, 0xffffffff
push edi
add dword [esi + 0xa4], 0xfffffffc
lea edi, [esi + 0xa8]
mov ebx, dword [esi + 0xa4]
test ebx, ebx
je 0x41326a
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x456c90]
sub ebx, 1
jne 0x413250
mov edi, dword [esi + 0xa4]
not edx
movzx ecx, byte [edi + esi + 0xab]
movzx eax, byte [edi + esi + 0xaa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + esi + 0xa9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + esi + 0xa8]
shl ecx, 8
or ecx, eax
cmp edx, ecx
jne 0x413468
lea ebx, [esi + 0xa0]
mov dword [ebx], 2
mov al, byte [esi + 0xa9]
test al, 0x3f
jne 0x41345f
test al, 0x40
je 0x4132f2
push edi
lea edi, [esi + 0xa8]
mov ecx, esi
push ebx
mov edx, edi
call fcn.00413130
add esp, 8
cmp eax, 1
jne 0x413468
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov al, byte [esi + 0xa9]
jmp 0x4132fe
or ecx, 0xffffffff
lea edi, [esi + 0xa8]
or edx, 0xffffffff
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], edx
test al, al
jns 0x41332c
push dword [esi + 0xa4]
mov edx, edi
mov ecx, esi
push ebx
call fcn.00413130
add esp, 8
cmp eax, 1
jne 0x413468
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
jmp 0x413332
or eax, 0xffffffff
or ecx, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov edx, dword [esi + 0xa4]
mov eax, edx
mov ecx, dword [ebx]
sub eax, ecx
cmp eax, 2
jb 0x413468
mov al, byte [ecx + esi + 0xa8]
inc ecx
mov dword [ebx], ecx
cmp al, 0x21
jne 0x41345f
mov al, byte [ecx + esi + 0xa8]
inc ecx
mov dword [ebx], ecx
cmp al, 1
jne 0x41345f
sub edx, ecx
cmp edx, 1
jb 0x413468
mov dl, byte [ecx + esi + 0xa8]
lea eax, [ecx + 1]
mov edi, dword [esi + 0x4a8]
mov dword [ebx], eax
cmp dl, 0x27
ja 0x41345f
movzx eax, dl
mov ecx, eax
and eax, 1
shr ecx, 1
add eax, 2
add ecx, 0xb
shl eax, cl
mov ecx, dword [edi + 0x3c]
mov dword [edi + 0x30], eax
test ecx, ecx
je 0x4133fd
cmp eax, dword [edi + 0x34]
jbe 0x4133c1
pop edi
pop esi
mov eax, 4
pop ebx
ret
mov dword [edi + 0x2c], eax
cmp ecx, 2
jne 0x4133fd
cmp dword [edi + 0x38], eax
jae 0x4133fd
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x4133e1
push ecx
call fcn.00425f00
mov eax, dword [edi + 0x30]
add esp, 4
push eax
call fcn.00425f1b
add esp, 4
mov dword [edi + 0x18], eax
test eax, eax
jne 0x4133fd
mov dword [edi + 0x38], eax
mov eax, 3
pop edi
pop esi
pop ebx
ret
mov dword [edi + 0x68], 0
mov dword [edi + 0x40], 0
mov byte [edi + 0x50], 1
mov dword [edi + 0x6ee4], 0
mov edx, dword [esi + 0xa4]
mov ecx, dword [ebx]
cmp ecx, edx
jae 0x413437
mov al, byte [ecx + esi + 0xa8]
inc ecx
mov dword [ebx], ecx
test al, al
jne 0x41345f
cmp ecx, edx
jb 0x413425
pop edi
mov dword [esi + 0x40], 0
xor eax, eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
pop esi
mov dword [ebx], 0
pop ebx
ret
pop edi
pop esi
mov eax, 6
pop ebx
ret
pop edi
pop esi
mov eax, 7
pop ebx
ret
Function at 0x435728
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4356f9
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x435717
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x435775
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x43575c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x435765
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x43576f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x435751
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4356db
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je fcn.004357c2
dec eax
je 0x4357b9
sub eax, 3
je 0x4357b0
mov dword [ebp - 4], 0x40
jmp 0x4357df
mov dword [ebp - 4], 4
jmp 0x4357c5
mov dword [ebp - 4], 0x20
jmp 0x4357c5
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x435811
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x435791
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00435022
cmp byte [eax], dh
lodsd eax, dword [esi]
push dword cs:[ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x43581d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43b1db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043b051

Function at 0x43d393
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043cee6
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10001071
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x10001071
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1000105a
jmp 0x10001071
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x10003080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1015bc40]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x10123948]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x1012394c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x10123930]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x10123940]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10003150
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x10003119
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x10003166
inc ax
mov word [ebp - 0xa], ax
jmp 0x1000312f
cmp eax, 0xe7
jne 0x10003166
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x10003166
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10003100
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d087e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d087e
mov esp, ebp
pop ebp
ret
Function at 0x10003270
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd20
mov eax, dword [0x1015bc40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x30c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
mov dword [ebp - 0xd20], eax
lea eax, [ebp - 0xd14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x50c]
mov dword [ebp - 0xd1c], 0
push eax
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
jne 0x10003427
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x104]
push edi
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc eax
add eax, eax
push eax
lea eax, [ebp - 0x104]
push eax
push 1
push 0
push 0
push dword [ebp - 0xd14]
call edi
lea eax, [ebp - 0x104]
push eax
call esi
push 2
lea eax, [ebp - 0xd1c]
push eax
push 1
push 0
push str.URL_Protocol
push dword [ebp - 0xd14]
call edi
mov eax, dword [ebp - 0xd14]
lea ecx, [ebp - 0xd10]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.DefaultIcon
push eax
mov dword [ebp - 0xd18], eax
mov dword [ebp - 0xd10], 0
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100033a3
mov eax, dword [ebp - 0xd20]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x30c]
push eax
push 1
push 0
push 0
push dword [ebp - 0xd10]
call edi
mov eax, dword [ebp - 0xd10]
test eax, eax
je 0x100033a3
cmp eax, dword [ebp - 0xd18]
je 0x100033a3
push eax
call esi
lea eax, [ebp - 0xd0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
lea ecx, [ebp - 0xd10]
mov dword [ebp - 0xd10], 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edi, [eax + 1]
mov eax, dword [ebp - 0xd14]
push str.shellopencommand
push eax
mov dword [ebp - 0xd18], eax
call ebx
test eax, eax
jne 0x1000341d
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0xd0c]
push eax
push 1
push 0
push 0
push dword [ebp - 0xd10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xd10]
test eax, eax
je 0x1000341d
cmp eax, dword [ebp - 0xd18]
je 0x1000341d
push eax
call esi
push dword [ebp - 0xd14]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100d087e
mov esp, ebp
pop ebp
ret
Function at 0x100034c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x1015bc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x84]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [ebp - 0x290]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100035ac
lea eax, [ebp - 0x294]
mov dword [ebp - 0x294], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 0x290]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x290]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100035ac
mov ecx, dword [ebp - 0x294]
cmp ecx, 1
jb 0x100035ac
shr ecx, 1
mov eax, esi
je 0x10003599
lea edx, [esi + 0x5c]
cmp word [ebp + eax*2 - 0x28c], 0x2f
jne 0x10003594
mov word [ebp + eax*2 - 0x28c], dx
inc eax
cmp eax, ecx
jb 0x10003581
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10003270
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100d087e
mov esp, ebp
pop ebp
ret
Function at 0x10005070
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x1013df20
push 0x64
call fcn.100d08ca
mov esi, eax
add esp, 8
test esi, esi
je 0x10005208
push 0x64
push 0
push esi
call fcn.100ed2d0
mov byte [esi], 1
lea eax, [esi + 0x34]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
push eax
movq qword [esi + 0x20], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 4], 2
mov dword [esi + 0x30], 0
call fcn.100d243a
xorps xmm0, xmm0
mov dword [0x1018492c], esi
add esp, 0x10
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x10005116
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000510b
cmp byte [eax], 0
je 0x1000510b
push eax
push esi
call fcn.100034c0
jmp 0x10005113
push 0
push esi
call fcn.10003440
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x1015a038
mov dword [0x10184928], eax
call fcn.100d228e
add esp, 4
test eax, eax
jne 0x10005217
cmp dword [0x1015a064], 0x7fffffff
je 0x1000521e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000515d
movups xmm0, xmmword [eax]
movups xmmword [0x101802d8], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x10005167
xorps xmm0, xmm0
movups xmmword [0x101802d8], xmm0
movq qword [0x101802e8], xmm0
xorps xmm0, xmm0
push 0x1015a038
movups xmmword [0x101802f0], xmm0
movq qword [0x10180300], xmm0
call fcn.100d229f
add esp, 4
cmp dword [0x101802d4], 0
jne 0x10005212
push esi
call fcn.100065d0
mov dword [0x101802d4], eax
mov dword [eax + 8], 0x100035c0
mov eax, dword [0x101802d4]
mov dword [eax + 0xc], 0x100035e0
mov al, 1
mov esi, dword [0x1018492c]
xchg byte [esi], al
push 4
call fcn.100d088c
add esp, 8
test eax, eax
je 0x100051d1
mov dword [eax], esi
jmp 0x100051d3
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10003630
push 0
push 0
call fcn.100f0916
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x10005234
cmp dword [esi + 0x60], 0
jne 0x1000522f
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x1018492c], 0
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.100d2944
push 6
mov dword [0x1015a064], 0x7ffffffe
call fcn.100d2944
call fcn.100f0715
push 6
mov dword [ebp - 4], 0
call fcn.100d2944
int3