joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a9a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0x3626631
xor esi, esi
mov dword [ebp - 0x18], 0x1f03026e
mov dword [ebp - 0x14], 0x5d5d55
cmp esi, 0xb
jb 0x1001a9dc
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov bl, byte [ebp + esi - 0x1b]
xor bl, byte [ebp - 0x1c]
cmp esi, 0xb
jb 0x1001a9ff
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov byte [ebp + esi - 0x1b], bl
inc esi
cmp esi, 0xa
jb 0x1001a9c0
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x1001aa28
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x10], 0x6001765
xor esi, esi
mov word [ebp - 0xc], 0x13
cmp esi, 5
jb 0x1001aa53
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov bl, byte [ebp + esi - 0xf]
xor bl, byte [ebp - 0x10]
cmp esi, 5
jb 0x1001aa76
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov byte [ebp + esi - 0xf], bl
inc esi
cmp esi, 4
jb 0x1001aa37
lea eax, [ebp - 0xf]
mov byte [ebp - 0xb], 0
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
test eax, eax
je 0x1001aa20
mov ecx, eax
call fcn.10019fa0
cmp al, 0xe9
je 0x1001aa20
mov dword [ebp - 0x10], 0x796b6f38
xor esi, esi
mov dword [ebp - 0xc], 0x4e5b5d6a
mov byte [ebp - 8], 0
cmp esi, 8
jb 0x1001aad0
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov bl, byte [ebp + esi - 0xf]
xor bl, byte [ebp - 0x10]
cmp esi, 8
jb 0x1001aaf3
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov byte [ebp + esi - 0xf], bl
inc esi
cmp esi, 7
jb 0x1001aab4
lea eax, [ebp - 0xf]
mov byte [ebp - 8], 0
push eax
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
test eax, eax
je 0x1001ab1c
mov ecx, eax
call fcn.10019fa0
cmp al, 0xe9
jne 0x1001ab24
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x1001bea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1014b084]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x6d12c0
call fcn.10019fa0
cmp al, 0xe9
jne 0x1001bec6
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x6d12c0
call esi
test eax, eax
jne 0x1001bf09
mov dword [0x10150774], 0x6d12c0
call fcn.10073160
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10073630
push 0x1001ab90
push 0x10150774
call fcn.100729e0
call fcn.100731c0
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x6d141e
push eax
call esi
test eax, eax
jne 0x1001bf4d
push 4
push 0x1001ab30
call esi
test eax, eax
jne 0x1001bf4d
call fcn.10073160
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10073630
push 0x1001ab30
lea eax, [ebp - 8]
push eax
call fcn.100729e0
call fcn.100731c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10074510
mov esp, ebp
pop ebp
ret
Function at 0x1001f5b0
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x1014b084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x2f4], 0x31290f5d
xor esi, esi
mov dword [ebp - 0x2f0], 0x393c3211
mov dword [ebp - 0x2ec], 0x342f290e
mov word [ebp - 0x2e8], 0x3a33
mov byte [ebp - 0x2e6], 0
push ebx
cmp esi, 0xe
jb 0x1001f611
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov bl, byte [ebp + esi - 0x2f3]
xor bl, byte [ebp - 0x2f4]
cmp esi, 0xe
jb 0x1001f63a
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov byte [ebp + esi - 0x2f3], bl
inc esi
cmp esi, 0xd
jb 0x1001f5f5
mov byte [ebp - 0x2e6], 0
xor esi, esi
mov dword [ebp - 0x2e4], 0x1a0a107e
mov dword [ebp - 0x2e0], 0x1a501212
mov word [ebp - 0x2dc], 0x1212
mov byte [ebp - 0x2da], 0
cmp esi, 0xa
jb 0x1001f690
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov bl, byte [ebp + esi - 0x2e3]
xor bl, byte [ebp - 0x2e4]
cmp esi, 0xa
jb 0x1001f6b9
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov byte [ebp + esi - 0x2e3], bl
inc esi
cmp esi, 9
jb 0x1001f674
lea eax, [ebp - 0x2f3]
mov byte [ebp - 0x2da], 0
push eax
lea eax, [ebp - 0x2e3]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
pop ebx
add esi, 0x430
jne 0x1001f704
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10074510
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1001f6f3
push 0x2cc
lea eax, [ebp - 0x2d8]
push 0
push eax
call fcn.10079b70
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001f6f3
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1001f6f3
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1001f6f3
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x100024e0
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1001f6f3
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10074510
mov esp, ebp
pop ebp
ret
Function at 0x1001f900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1001f93e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001f942
cmp edx, esi
jne 0x1001f927
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1001f962
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001f966
cmp edx, esi
jne 0x1001f94b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1001f986
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001f98a
cmp edx, esi
jne 0x1001f96f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001fa40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1014b084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.10016ef0
test eax, eax
je 0x1001fb9b
push esi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebx, ebx
test eax, eax
setne bl
test ebx, ebx
je 0x1001fb9b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1001fb9b
movaps xmm0, xmmword [0x1013ae60]
xor esi, esi
movups xmmword [ebp - 0x24], xmm0
nop dword [eax + eax]
cmp esi, 0xf
jb 0x1001fabc
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov bl, byte [ebp + esi - 0x23]
xor bl, byte [ebp - 0x24]
cmp esi, 0xf
jb 0x1001fadf
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov byte [ebp + esi - 0x23], bl
inc esi
cmp esi, 0xe
jb 0x1001faa0
mov byte [ebp - 0x15], 0
xor esi, esi
mov dword [ebp - 0x14], 0x55455f31
mov dword [ebp - 0x10], 0x551f5d5d
mov word [ebp - 0xc], 0x5d5d
mov byte [ebp - 0xa], 0
cmp esi, 0xa
jb 0x1001fb23
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov bl, byte [ebp + esi - 0x13]
xor bl, byte [ebp - 0x14]
cmp esi, 0xa
jb 0x1001fb46
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov byte [ebp + esi - 0x13], bl
inc esi
cmp esi, 9
jb 0x1001fb07
lea eax, [ebp - 0x23]
mov byte [ebp - 0xa], 0
push eax
lea eax, [ebp - 0x13]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x116e058
mov edi, eax
call fcn.1001a010
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1001fbb8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
call edi
test eax, eax
jns 0x1001fba3
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp - 8], 0
jbe 0x1001fbb1
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10074510
mov esp, ebp
pop ebp
ret
Function at 0x1004fe50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc100
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x1014b084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov dword [0x101509dc], eax
mov esi, dword [edi]
push 4
push esi
call ebx
test eax, eax
jne 0x1005000d
push 4
add esi, 0xe5
push esi
call ebx
test eax, eax
jne 0x1005000d
mov al, byte [esi]
test al, al
je 0x1005000d
mov eax, dword [ebp + 8]
cmp eax, 0x1c
je 0x1004fec6
cmp eax, 0x9c
jne 0x1005000d
mov esi, dword [edi + 0x68]
test esi, esi
je 0x1005000d
push 4
push esi
call ebx
test eax, eax
jne 0x1005000d
mov ecx, 0x10b7b10
call fcn.1001a010
cmp esi, eax
sete al
test al, al
je 0x1005000d
push 1
push dword [edi + 0x64]
mov ecx, edi
call fcn.1004d290
lea eax, [ebp + 9]
mov word [ebp + 8], 0x7e
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp + 9], 0
call fcn.10007690
mov dword [ebp - 4], 0
mov esi, dword [edi + 0x68]
test esi, esi
je 0x1004ff3a
push 4
push esi
call ebx
test eax, eax
jne 0x1004ff3a
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call dword [0x101364a4]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.10006b40
mov dword [ebp - 0x1c], 0x4a4e782b
xor esi, esi
mov dword [ebp - 0x18], 0xb434859
mov dword [ebp - 0x14], 0x464e5f62
mov byte [ebp - 0x10], 0
cmp esi, 0xc
jb 0x1004ff80
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov bl, byte [ebp + esi - 0x1b]
xor bl, byte [ebp - 0x1c]
cmp esi, 0xc
jb 0x1004ffa3
push 0x90
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VCinclude_array
push str.array_subscript_out_of_range
call fcn.10064930
add esp, 0xc
mov byte [ebp + esi - 0x1b], bl
inc esi
cmp esi, 0xb
jb 0x1004ff64
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x10], 0
push eax
lea ecx, [ebp - 0x54]
call fcn.10007690
mov dword [ebp - 4], 1
mov esi, dword [edi + 0x68]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test esi, esi
je 0x1004ffe6
push 4
push esi
call ebx
test eax, eax
jne 0x1004ffe6
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
call dword [0x101364e8]
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0xffffffff
call fcn.10006b40
mov esi, dword [edi + 0x68]
test esi, esi
je 0x1005000d
push 4
push esi
call ebx
test eax, eax
jne 0x1005000d
mov ecx, esi
call dword [0x101364ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005afe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcaac
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1014b084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x28]
xorps xmm0, xmm0
mov dword [edi + 4], 1
mov dword [edi], 1
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x24], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], 0
movups xmmword [edi + 0x48], xmm0
movups xmmword [edi + 0x58], xmm0
movups xmmword [edi + 0x68], xmm0
lea ecx, [edi + 0x84]
mov dword [ebp - 4], 0
call fcn.10006d30
mov eax, dword [edi + 0x88]
mov dword [edi + 0x8c], eax
lea ecx, [edi + 0x94]
mov dword [ebp - 4], 1
call fcn.10006d30
mov eax, dword [edi + 0x98]
mov dword [edi + 0x9c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005b3c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcadc
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1014b084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
mov dword [edi + 4], 1
mov dword [edi], 1
lea eax, [edi + 0x110]
mov dword [edi + 8], 0
mov ecx, 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x4c], 0
movups xmmword [edi + 0x58], xmm0
movups xmmword [edi + 0x70], xmm0
movups xmmword [edi + 0x80], xmm0
movups xmmword [edi + 0x90], xmm0
nop dword [eax]
mov dword [eax + 4], 0
lea eax, [eax + 0x14]
mov dword [eax - 0x14], 0
mov dword [eax - 0x18], 0
mov dword [eax - 0x1c], 0
mov dword [eax - 0x20], 0
sub ecx, 1
jne 0x1005b4d0
mov dword [ebp - 4], ecx
lea ecx, [edi + 0xb4]
call fcn.10006d30
mov eax, dword [edi + 0xbc]
mov esi, dword [edi + 0xb8]
cmp esi, eax
je 0x1005b532
mov edi, eax
nop dword [eax + eax]
lea ecx, [esi + 8]
call fcn.1001a1e0
add esi, 0x40
cmp esi, edi
jne 0x1005b520
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 0xb8]
mov dword [edi + 0xbc], eax
lea ecx, [edi + 0xc4]
mov dword [ebp - 4], 1
call fcn.10006d30
mov eax, dword [edi + 0xcc]
mov esi, dword [edi + 0xc8]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x1005b57e
mov edi, eax
lea ecx, [esi + 0x34]
call fcn.1001a1e0
mov ecx, esi
call fcn.10006b40
add esi, 0x48
cmp esi, edi
jne 0x1005b565
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 0xc8]
mov dword [edi + 0xcc], eax
mov dword [edi + 0x100], 0
mov dword [edi + 0xfc], 0
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005e510
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcc48
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1014b084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 0x10
lea ecx, [ebp - 0x7c]
push dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
push eax
mov byte [ebp - 0x7c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
call fcn.1005e2c0
lea ecx, [ebp - 0x7c]
call fcn.1005e370
push esi
lea ecx, [ebp - 0x7c]
call fcn.1005e460
lea ecx, [ebp + 8]
call fcn.10006b40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10074510
mov esp, ebp
pop ebp
ret

Function at 0x10060270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
mov ebx, 1
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
add eax, 0x10
mov dword [ebp + 0xc], eax
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.10075820
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, dword [ebp + 0xc]
adc esi, edx
inc ebx
mov dword [eax], edi
mov dword [eax + 4], esi
add eax, 8
mov dword [ebp + 0xc], eax
cmp ebx, 0x138
jl 0x10060293
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0x138
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10064660
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1014b084]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x1013adac]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x1013adb0]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x1013ad94]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x1013ada4]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10064730
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x100646f9
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x10064746
inc ax
mov word [ebp - 0xa], ax
jmp 0x1006470f
cmp eax, 0xe7
jne 0x10064746
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x10064746
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x100646e0
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10074510
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10074510
mov esp, ebp
pop ebp
ret

Function at 0x10068b80
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0x10068b10
push 0x1014edf0
call fcn.1006e930
add esp, 8
cmp dword [0x1014b064], 0xffffffff
je 0x10068bc9
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x1014b064]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10068bc7
push 0x70
push 0x10104a28
push str.TlsSetValue_current_thread_tls_key__new_data_
call fcn.10096c90
add esp, 0xc
jmp 0x10068be1
xor eax, eax
jne 0x10068be1
push 0x74
push 0x10104ad0
push 0x10104b14
call fcn.10096c90
add esp, 0xc
pop ebp
ret
Function at 0x1006b490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fd92c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1014b084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.boost::detail::thread_data_base.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.1006b420
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.1006b0e0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.1006b130
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.1006b130
mov byte [ebp - 4], 3
push 0
push 1
call fcn.10009e80
add esp, 8
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1006b400
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x44], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10071840
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10071a10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1007191d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1014b068]
jb 0x1007188a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1014b06c]
ja 0x1007188a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1007185a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10079b70
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x100718af
jmp 0x1007191d
cmp dword [ebp - 0x14], 0x10000
jne 0x10071903
cmp dword [ebp - 0x18], 0x10000
jb 0x10071903
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100718e6
mov eax, dword [ebp - 8]
jmp 0x1007191f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100718f6
xor eax, eax
jmp 0x1007191f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10071918
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10071a10
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1007185a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10071930
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10071a40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10071a05
mov edx, dword [ebp - 4]
cmp edx, dword [0x1014b068]
jb 0x10071975
mov eax, dword [ebp - 4]
cmp eax, dword [0x1014b06c]
ja 0x10071975
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10071945
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10079b70
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1007199a
jmp 0x10071a05
cmp dword [ebp - 0x14], 0x10000
jne 0x100719ee
cmp dword [ebp - 0x18], 0x10000
jb 0x100719ee
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100719d1
mov eax, dword [ebp - 8]
jmp 0x10071a07
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100719e1
xor eax, eax
jmp 0x10071a07
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10071a00
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10071a40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10071945
xor eax, eax
mov esp, ebp
pop ebp
ret