joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d37c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42d39c
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42d3b6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42d3b1
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42d3bb
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42d429
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42d472
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42d3e7
inc dword [ebp - 0xc]
jmp 0x42d3ff
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42d3ff
cmp dword [ebp - 0xc], 0
jle 0x42d3ff
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42d421
xor eax, eax
jmp 0x42d41d
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42d41c
mov eax, esi
jmp 0x42d475
inc eax
cmp eax, ecx
jle 0x42d409
inc esi
cmp esi, dword [ebp - 8]
jl 0x42d3d3
jmp 0x42d472
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42d472
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42d44a
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42d46c
xor eax, eax
jmp 0x42d468
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42d467
mov eax, esi
jmp 0x42d475
inc eax
cmp eax, ecx
jle 0x42d454
inc esi
cmp esi, dword [ebp - 8]
jl 0x42d432
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42d664
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42d683
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42d693
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42d7b5
test ebx, ebx
jl 0x42d7b5
test esi, esi
jle 0x42d7b5
mov eax, dword [ebp - 8]
call fcn.0040ae3c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040ae3c
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42d752
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42d7b5
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42d737
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42d706
inc dword [ebp - 0x14]
jmp 0x42d716
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42d716
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42d721
or eax, 0xffffffff
jmp 0x42d737
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42d734
inc eax
jmp 0x42d737
or eax, 0xffffffff
test eax, eax
jl 0x42d73f
cmp esi, eax
jg 0x42d6f4
cmp esi, eax
jg 0x42d74a
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42d7b8
inc edx
dec dword [ebp - 0x1c]
jne 0x42d6f0
jmp 0x42d7b5
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42d7b5
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42d79c
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42d77b
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42d786
or eax, 0xffffffff
jmp 0x42d79c
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42d799
inc eax
jmp 0x42d79c
or eax, 0xffffffff
test eax, eax
jl 0x42d7a4
cmp esi, eax
jg 0x42d764
cmp esi, eax
jg 0x42d7af
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42d7b8
inc edx
dec dword [ebp - 0x1c]
jne 0x42d760
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43c864
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43c86c
mov eax, edx
pop esi
pop ebx
ret

Function at 0x43f4b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x43f4c7
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x43f4b7
mov eax, ecx
pop ebx
ret
Function at 0x4b798c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4b79cf
cmp byte [ebx + 0x11], 0
jne 0x4b79cf
cmp byte [ebx + 0x24], 0
jne 0x4b79cf
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b79e6
mov ecx, dword [0x4fd150]
mov dl, 1
mov eax, dword [0x487c44]
call fcn.00427c7c
call fcn.00409a50
pop ebx
ret
mov ecx, dword [0x4fd150]
mov dl, 1
mov eax, dword [0x487c44]
call fcn.00427c7c
call fcn.00409a50
pop ebx
ret

Function at 0x4b8354
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b83a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b7838
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b83bb
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b83c4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b7838
dec esi
jne 0x4b83e6
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4d36d8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d3897
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a810
mov eax, dword [ebp - 4]
call fcn.004d3024
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4d372a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b240
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004d432c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4d380b
xor eax, eax
push ebp
push 0x4d3804
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004d32c4
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004d38cc
test al, al
je 0x4d37e0
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a570
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4d37e0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040ae3c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d3224
test al, al
je 0x4d37da
mov eax, dword [ebp - 8]
call fcn.0040ae3c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040ae9c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004d36d8
dec ebx
cmp ebx, 0xffffffff
jne 0x4d3789
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d380b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004d32c4
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x5048b4], 0
je 0x4d384b
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae3c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004d32b0
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d3224
mov ebx, eax
jmp 0x4d3872
mov eax, dword [ebp - 4]
call fcn.0040ae3c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004d32b0
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d3224
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d389e
lea eax, [ebp - 0x3c]
call fcn.0040a3d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a438
pop eax
jmp eax
Function at 0x4d4208
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004d303c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040ae3c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004d3224
test al, al
jne 0x4d4270
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4fd0b4]
mov dl, 1
mov eax, dword [0x4d1e08]
call fcn.00427d50
call fcn.00409a50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d427c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040ae3c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004d3224
test al, al
jne 0x4d42dd
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4fd2ac]
mov dl, 1
mov eax, dword [0x4d1e08]
call fcn.00427d50
call fcn.00409a50
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004d306c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d48f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d4a20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004d32c4
xor eax, eax
push ebp
push 0x4d49f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d38cc
test al, al
je 0x4d49db
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004d47cc
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a570
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4d49db
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae3c
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d3224
test al, al
je 0x4d49d7
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae3c
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040ae9c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004d47cc
pop ecx
inc edi
dec ebx
jne 0x4d497f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4a00
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004d32c4
pop eax
jmp eax
Function at 0x4d4a30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d4c88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004d32c4
xor eax, eax
push ebp
push 0x4d4c5c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d38cc
test al, al
je 0x4d4c3e
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a570
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4d4c3e
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae3c
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d3224
test al, al
je 0x4d4c32
mov eax, dword [ebp - 4]
call fcn.0040ae3c
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040ae9c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d432c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4d4c32
xor eax, eax
push ebp
push 0x4d4c2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004d32c4
xor eax, eax
push ebp
push 0x4d4c0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040ae3c
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040ae9c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d32c8
mov eax, dword [ebp - 4]
call fcn.0040ae3c
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040ae9c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d432c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4d4be6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004d48f4
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004d4a30
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4bed
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4d4abb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4c63
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004d32c4
pop eax
jmp eax
Function at 0x417a10
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push str.CONOUT_
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x417a5f
mov ecx, dword [0x4c3a9c]
push 0x4c378c
push ecx
mov dword [0x4c0064], edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x49f62d
Capabilities:
Encode data using xor

Disassembly:
mov word [ebx - 0x6471886a], fs
add edx, dword [ebx]
pop edx
std
push ebx
push eax
push esi
imul edi, dword [edi - 6], 0x1b0a3434
mov edi, 0x9410d922
xchg esp, eax
insd dword es:[edi], dx
adc dword [ebp + 0x1fa865a9], eax
sal dword [0x5d825c25], cl
xchg esp, eax
aas
sbb al, 0x37
dec edx
push esp
test al, 0x91
scasb al, byte es:[edi]
push esp
ror dword [edx], cl
arpl word [ebx], si
xchg edi, eax
lcall 0x4477, 0x18ca6677
ja 0x49f6af
xor edx, dword [edi - 0x35998866]
sbb byte [edi + 0x44], dh
ja 0x49f6af
aas
and eax, 0xe976e09f
je 0x49f69b
adc al, bh
mov byte [edi - 0x5e2f725f], bh
invalid
invalid
dec edx
jbe 0x49f6c8
xchg esi, eax
int 0x9a
push esp
sahf
jbe 0x49f6f2
and dword [ebx], esi
mov eax, dword [0xf349d898]
arpl si, di
imul esi, esi, 0x4276b344
push eax
adc dword [ebx], edx
dec eax
mov al, 0xa4
movsb byte es:[edi], byte [esi]
adc dword [eax + 0x73a780a1], esp
jns 0x49f6c6
jge 0x49f716
cmp al, 0x19
mov dh, byte [ebp - 0x28]
salc
cmc
pop esp
or byte [ebx], ah
jbe 0x49f70c
and dword [0xf0d3a77b], ebx
jbe 0x49f6c2
jae 0x49f706
push 0xe8135473
xor dword [esi - 0x1c3ac7ab], edx
invalid
clc
imul esi, dword [ebx], 0x289a073e
jp 0x49f662
jbe 0x49f6d7
xor ch, byte [0xbe313108]
movsb byte es:[edi], byte [esi]
invalid
xor dword [esi - 0x1a48395c], edi
imul ebp
adc eax, 0x25826a39
xchg ecx, eax
inc esi
pushal
jmp 0xdf3a13fc
push esi
mov edi, 0x86a7703e
invalid
jecxz 0x49f751
clc
push ss
and byte [edx - 0x58], dh
ret
test al, 0xc3
out dx, al
push ss
jmp 0x13220e62
mov bh, 0x22
mov ecx, dword [eax]
push 0xe22531a5
mov al, 0xe0
invalid
dec esp
push 0x7e0e44e9
xchg esp, eax
hlt
Function at 0x10001220
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1005f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, str._pipediscord_ipc_0
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0x1000128c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10001272
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x100012b9
inc ax
mov word [ebp - 0xa], ax
jmp 0x1000128c
cmp eax, 0xe7
jne 0x100012b9
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x100012b9
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x10001255
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004cbca
leave
ret
xor al, al
jmp 0x100012aa

Function at 0x10001415
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
mov eax, esi
test edx, edx
je 0x1000144a
cmp word [edx], di
je 0x1000144a
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10001473
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
mov edi, eax
test ecx, ecx
je 0x10001471
cmp ecx, esi
je 0x10001471
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10001684
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
mov dword [0x100d5a70], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x100d5a6c], ebx
push edi
push ebx
mov dword [0x100d5a68], eax
mov dword [0x100d5a74], ebx
mov dword [0x100d5a78], eax
mov dword [0x100d5a7c], ebx
mov dword [0x100d5a80], ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov esi, eax
mov dword [0x100d5a94], edx
mov eax, 0x55555555
mov dword [0x100d5a90], esi
xor edi, edi
mov dword [0x100d6e10], eax
pop ecx
mov dword [0x100d6e14], eax
inc edi
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, esi
push eax
push ecx
call fcn.10050950
mov esi, eax
mov eax, 0x138
add esi, edi
mov dword [edi*8 + 0x100d5a90], esi
adc edx, ebx
mov dword [edi*8 + 0x100d5a94], edx
inc edi
cmp edi, eax
jb 0x100016e2
movaps xmm0, xmmword [0x1005a250]
pop edi
pop esi
mov dword [0x100d5a88], eax
mov eax, 0x100d5a68
movups xmmword [0x100d6e18], xmm0
pop ebx
ret 0x10
Function at 0x100019f9
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x10050e69
call fcn.1005065b
mov esi, dword [0x100f7e9c]
xor edi, edi
mov al, 1
xchg byte [esi], al
push 4
call fcn.1004cbd8
mov dword [ebp - 0x10], eax
mov dword [eax], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
push eax
push 0x10002dff
push edi
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x1c
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x10001a59
cmp dword [esi + 0x60], edi
je 0x10001a4a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call fcn.10050638
ret
push 6
mov dword [ebp - 0x14], edi
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x100021e2
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 6], 0
je 0x10002200
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 5
jb 0x100021ed
pop ebx
mov byte [edx + 6], 0
mov eax, edx
ret

Function at 0x10002203
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 5], 0
je 0x10002221
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 4
jb 0x1000220e
pop ebx
mov byte [edx + 5], 0
mov eax, edx
ret

Function at 0x10002224
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 8], 0
je 0x10002242
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 7
jb 0x1000222f
pop ebx
mov byte [edx + 8], 0
mov eax, edx
ret

Function at 0x10002245
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xe], 0
je 0x10002263
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x10002250
pop ebx
mov byte [edx + 0xe], 0
mov eax, edx
ret

Function at 0x10002266
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 7], 0
je 0x10002284
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 6
jb 0x10002271
pop ebx
mov byte [edx + 7], 0
mov eax, edx
ret

Function at 0x10002287
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x12], 0
je 0x100022a5
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x10002292
pop ebx
mov byte [edx + 0x12], 0
mov eax, edx
ret

Function at 0x100022a8
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x16], 0
je 0x100022c6
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 0x15
jb 0x100022b3
pop ebx
mov byte [edx + 0x16], 0
mov eax, edx
ret

Function at 0x100022c9
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 3], 0
je 0x100022e7
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 2
jb 0x100022d4
pop ebx
mov byte [edx + 3], 0
mov eax, edx
ret

Function at 0x100022ea
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 9], 0
je 0x10002308
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 9]
xor byte [ecx], al
inc ebx
cmp ebx, 8
jb 0x100022f5
pop ebx
mov byte [edx + 9], 0
mov eax, edx
ret