joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001fb8d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x78
mov eax, 0x1003b2fe
call fcn.1003905f
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x100502e0], eax
test edi, edi
jne 0x1001fbb0
xor al, al
jmp 0x1001fdae
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1001fbcb
cmp edi, dword [esi + 4]
jne 0x1001fdac
call fcn.10020163
jmp 0x1001fdac
and eax, 0xf0000
cmp eax, 0x10000
je 0x1001fd97
cmp eax, 0x40000
je 0x1001fbfb
cmp eax, 0x80000
jne 0x1001fdac
mov ecx, dword [esi]
xor dl, dl
call fcn.1000b156
jmp 0x1001fdac
mov ecx, dword [esi]
xor dl, dl
call fcn.1000b156
mov eax, dword [esi + 0x28]
xor ebx, ebx
sub eax, dword [esi + 0x24]
sar eax, 3
test eax, eax
je 0x1001fc3c
mov eax, dword [esi + 0x24]
mov eax, dword [eax + ebx*8 + 4]
test eax, eax
je 0x1001fc2e
mov ecx, dword [eax]
test ecx, ecx
je 0x1001fc2e
mov edx, 0x110
call fcn.1000b1a0
mov eax, dword [esi + 0x28]
inc ebx
sub eax, dword [esi + 0x24]
sar eax, 3
cmp ebx, eax
jb 0x1001fc13
push edi
mov ecx, esi
call fcn.1001fe6c
mov edi, eax
test edi, edi
je 0x1001fdac
mov eax, dword [edi + 0x60]
mov dword [ebp + 8], eax
test eax, eax
je 0x1001fdac
mov ebx, dword [edi + 0x64]
test ebx, ebx
je 0x1001fdac
push edi
mov ecx, esi
call fcn.1001fe9f
cmp dword [esi + 0x18], eax
jne 0x1001fdac
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
cmp dword [ecx], 0x3b9aca00
jb 0x1001fc98
xor edx, edx
mov dword [ebp + 0xc], 0x3e8
div dword [ebp + 0xc]
add edx, dword [ecx]
mov dword [esi + 0x14], edx
jmp 0x1001fc9d
add eax, dword [ecx]
mov dword [esi + 0x14], eax
mov ecx, dword [edi]
mov edx, 0x400000
call fcn.1000b1a0
call dword [0x10046198]
mov cl, 0x4e
mov dword [ebp - 0x18], 0x2d360b4e
mov dword [ebp - 0x14], 0x29202f26
xor edx, edx
mov word [ebp - 0x10], 0x2b
xor cl, byte [ebp + edx - 0x17]
mov byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 8
jae 0x1001fcda
mov cl, byte [ebp - 0x18]
jmp 0x1001fcc7
lea eax, [ebp - 0x17]
mov byte [ebp - 0xf], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.100040a5
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x60]
and dword [ebp - 4], 0
lea esi, [ebp - 0x30]
push 0x82
push 4
push ebx
call fcn.1000691b
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x1001fd11
mov eax, dword [eax]
movaps xmm0, xmmword [0x10048370]
xor ebx, ebx
movups xmmword [ebp - 0x84], xmm0
mov edx, ebx
mov byte [ebp - 0x64], bl
movaps xmm0, xmmword [0x10047a70]
push eax
movups xmmword [ebp - 0x74], xmm0
mov cl, byte [ebp - 0x84]
xor byte [ebp + edx - 0x83], cl
inc edx
cmp edx, 0x1f
jb 0x1001fd32
sub esp, 0x18
mov byte [ebp - 0x64], bl
lea eax, [ebp - 0x83]
mov ecx, esp
push eax
call fcn.100040a5
lea eax, [ebp - 0x48]
push eax
call fcn.10003b8a
add esp, 0x20
mov edx, esi
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.1000fe6d
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10003f51
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.10003f51
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.10003f51
jmp 0x1001fdac
push edi
call fcn.1001fe6c
test eax, eax
je 0x1001fdac
push eax
mov ecx, esi
call fcn.1001fe9f
mov dword [esi + 0x18], eax
mov al, 1
call fcn.10039028
ret 8
Function at 0x100239c3
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x8c
mov eax, 0x1003b5fa
call fcn.1003905f
mov esi, ecx
movzx eax, word [esi + 0xf6]
xor ebx, ebx
movaps xmm0, xmmword [0x10047840]
mov edx, ebx
push eax
movzx eax, word [esi + 0xf4]
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x195852
mov cl, byte [ebp - 0x24]
xor byte [ebp + edx - 0x23], cl
inc edx
cmp edx, 0x12
jb 0x100239fa
sub esp, 0x18
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.100040a5
lea eax, [ebp - 0x68]
push eax
call fcn.10003b8a
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 0x10
jb 0x10023a2f
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.100040a5
mov byte [ebp - 4], 1
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x50]
call fcn.1000b8e3
xor edi, edi
lea ecx, [ebp - 0x50]
push ebx
inc edi
push edi
call fcn.10003f51
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
push ebx
push edi
call fcn.10003f51
movzx eax, word [esi + 0xf8]
test ax, ax
jne 0x10023aa3
mov cl, 0x77
mov byte [ebp - 0xe], bl
mov al, 0x5a
mov byte [ebp - 0x10], cl
xor al, cl
lea ecx, [ebp - 0x50]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0xf]
push eax
call fcn.100040a5
mov dword [ebp - 4], 2
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x54]
call fcn.1000b8e3
lea ecx, [ebp - 0x50]
jmp 0x10023b24
push eax
mov cl, 0x5e
mov dword [ebp - 0x20], 0x3d370a5e
mov dword [ebp - 0x1c], 0x642a3b35
mov edx, ebx
mov dword [ebp - 0x18], 0x3a7b7d7e
mov byte [ebp - 0x14], bl
xor cl, byte [ebp + edx - 0x1f]
mov byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0xb
jae 0x10023ad3
mov cl, byte [ebp - 0x20]
jmp 0x10023ac0
sub esp, 0x18
mov byte [ebp - 0x14], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.100040a5
lea eax, [ebp - 0x68]
push eax
call fcn.10003b8a
add esp, 0x20
mov dword [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x10023aff
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.100040a5
mov byte [ebp - 4], 4
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x54]
call fcn.1000b8e3
push ebx
push edi
lea ecx, [ebp - 0x50]
call fcn.10003f51
lea ecx, [ebp - 0x68]
or dword [ebp - 4], 0xffffffff
push ebx
push edi
call fcn.10003f51
movzx eax, word [esi + 0xf4]
mov edx, ebx
movss xmm1, dword [0x100472cc]
push ecx
push ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov byte [ebp - 0x28], bl
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
movaps xmm0, xmmword [0x100476a0]
movups xmmword [ebp - 0x38], xmm0
mov cl, byte [ebp - 0x38]
xor byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xf
jb 0x10023b63
sub esp, 0x18
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.100040a5
lea eax, [ebp - 0x98]
push eax
call fcn.10003b8a
add esp, 0x24
mov dword [ebp - 4], 5
cmp dword [eax + 0x14], 0x10
jb 0x10023b9f
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x80]
call fcn.100040a5
mov byte [ebp - 4], 6
lea edx, [ebp - 0x80]
mov ecx, dword [esi + 0x58]
call fcn.1000b8e3
push ebx
push edi
lea ecx, [ebp - 0x80]
call fcn.10003f51
push ebx
push edi
lea ecx, [ebp - 0x98]
call fcn.10003f51
call fcn.10039028
ret
Function at 0x10024107
Capabilities:
Encode data using xor

Disassembly:
push 0x60
mov eax, 0x1003b68d
call fcn.10039093
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.10005968
movzx eax, al
xor ebx, ebx
sub eax, ebx
je 0x100241e8
sub eax, 1
jne 0x100242b0
mov cl, 0x60
mov dword [ebp - 0x38], 0x140f2c60
mov dword [ebp - 0x34], 0x19120514
mov edx, ebx
mov dword [ebp - 0x30], 0xe051625
mov word [ebp - 0x2c], 0x14
xor cl, byte [ebp + edx - 0x37]
mov byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xc
jae 0x10024165
mov cl, byte [ebp - 0x38]
jmp 0x10024152
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x6c]
call fcn.100040a5
mov dword [ebp - 4], 3
mov edx, ebx
movaps xmm0, xmmword [0x10048020]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x9504545
mov dword [ebp - 0x40], 0x47404643
mov dword [ebp - 0x3c], 0x74d4c
mov cl, byte [ebp - 0x54]
xor byte [ebp + edx - 0x53], cl
inc edx
cmp edx, 0x1a
jb 0x1002419d
lea eax, [ebp - 0x53]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.100040a5
push ebx
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x6c]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
push eax
call dword [0x10046194]
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10003f51
lea ecx, [ebp - 0x6c]
jmp 0x100242a8
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.1000588f
cmp dword [ebp - 0x18], 0
je 0x100242a5
cmp dword [ebp - 0x18], 0xff
ja 0x100242a5
mov cl, 0x69
mov dword [ebp - 0x38], 0x1d062569
mov dword [ebp - 0x34], 0x101b0c1d
mov edx, ebx
mov dword [ebp - 0x30], 0x70c1f2c
mov word [ebp - 0x2c], 0x1d
xor cl, byte [ebp + edx - 0x37]
mov byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0xc
jae 0x1002424c
mov cl, byte [ebp - 0x38]
jmp 0x10024239
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.100040a5
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100040a5
push ebx
push ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x50]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x6c]
push eax
push eax
call dword [0x10046194]
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.10003f51
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.10003f51
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.10003f51
call fcn.1003903d
ret 4
Function at 0x10024b4a
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x1003b786
call fcn.10039093
mov esi, ecx
mov eax, dword [esi]
mov dword [0x10050358], eax
mov ecx, dword [esi]
call fcn.1000b1c3
test al, al
je 0x10024c5b
cmp byte [ebp + 8], 0
jne 0x10024c5b
movaps xmm0, xmmword [0x100473e0]
xor ebx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov edx, ebx
mov cl, byte [ebp - 0x3c]
xor byte [ebp + edx - 0x3b], cl
inc edx
cmp edx, 0xe
jb 0x10024b87
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2d], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.100040a5
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], ebx
mov word [ebp - 0x2c], 0x64
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 0x2b], bl
call fcn.100040a5
xor ebx, ebx
lea edx, [ebp - 0x54]
inc ebx
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x10]
call fcn.1000b3ea
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10003f51
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x54]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100040a5
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x10]
call fcn.1000b86a
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10003f51
mov ecx, dword [esi + 0x10]
call fcn.1000b49f
lea eax, [ebp - 0x2b]
mov word [ebp - 0x2c], 0x5b
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2b], 0
call fcn.100040a5
mov byte [ebp - 4], 3
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x20]
call fcn.1000b8e3
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10003f51
mov ecx, esi
call fcn.10025a2d
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.10003f51
call fcn.1003903d
ret 0xc
Function at 0x10025319
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x1003b786
call fcn.10039093
mov esi, ecx
mov ecx, dword [esi]
xor dl, dl
call fcn.1000b082
movaps xmm0, xmmword [0x10047450]
xor ebx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov edx, ebx
mov cl, byte [ebp - 0x3c]
xor byte [ebp + edx - 0x3b], cl
inc edx
cmp edx, 0xe
jb 0x1002533f
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2d], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.100040a5
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], ebx
mov word [ebp - 0x2c], 0x17
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 0x2b], bl
call fcn.100040a5
xor ebx, ebx
lea edx, [ebp - 0x54]
inc ebx
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x10]
call fcn.1000b3ea
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10003f51
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x54]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100040a5
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x10]
call fcn.1000b86a
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10003f51
mov ecx, dword [esi + 0x10]
call fcn.1000b49f
lea eax, [ebp - 0x2b]
mov word [ebp - 0x2c], 0x69
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2b], 0
call fcn.100040a5
mov byte [ebp - 4], 3
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 0x20]
call fcn.1000b8e3
push 0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.10003f51
mov ecx, esi
call fcn.10025a2d
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.10003f51
call fcn.1003903d
ret
Function at 0x1002a386
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
mov eax, 0x1003bb94
call fcn.1003905f
mov esi, ecx
mov eax, dword [esi]
mov dword [0x10050380], eax
mov ecx, dword [esi]
call fcn.1000b1c3
test al, al
je 0x1002a470
cmp dword [ebp + 8], 0x1c
je 0x1002a3bd
cmp dword [ebp + 8], 0x9c
jne 0x1002a470
mov ecx, dword [esi + 0x64]
call fcn.1000b4be
test al, al
je 0x1002a470
xor edi, edi
mov ecx, esi
inc edi
push edi
push dword [esi + 0x60]
call fcn.10028ada
lea eax, [ebp + 9]
mov word [ebp + 8], 0x71
xor ebx, ebx
lea ecx, [ebp - 0x34]
push eax
mov byte [ebp + 9], bl
call fcn.100040a5
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x34]
mov ecx, dword [esi + 0x64]
call fcn.1000b3ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
push ebx
push edi
call fcn.10003f51
mov dl, 0x35
mov dword [ebp - 0x1c], 0x54506635
mov dword [ebp - 0x18], 0x155d5647
mov ecx, ebx
mov dword [ebp - 0x14], 0x5850417c
mov byte [ebp - 0x10], bl
xor dl, byte [ebp + ecx - 0x1b]
mov byte [ebp + ecx - 0x1b], dl
inc ecx
cmp ecx, 0xb
jae 0x1002a43d
mov dl, byte [ebp - 0x1c]
jmp 0x1002a42a
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x10], bl
push eax
lea ecx, [ebp - 0x4c]
call fcn.100040a5
mov dword [ebp - 4], edi
lea edx, [ebp - 0x4c]
mov ecx, dword [esi + 0x64]
call fcn.1000b86a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
push ebx
push edi
call fcn.10003f51
mov ecx, dword [esi + 0x64]
call fcn.1000b49f
call fcn.10039028
ret 4

Function at 0x1002a5e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x44
mov eax, 0x1003b9fc
call fcn.1003905f
mov esi, ecx
mov ecx, dword [esi]
xor dl, dl
call fcn.1000b082
lea eax, [ebp - 0xf]
mov word [ebp - 0x10], 0x23
xor ebx, ebx
lea ecx, [ebp - 0x38]
push eax
mov byte [ebp - 0xf], bl
call fcn.100040a5
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x38]
mov ecx, dword [esi + 0x64]
call fcn.1000b3ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
xor edi, edi
push ebx
inc edi
push edi
call fcn.10003f51
mov dl, 0x2d
mov dword [ebp - 0x20], 0x4c487e2d
mov dword [ebp - 0x1c], 0xd454e5f
mov ecx, ebx
mov dword [ebp - 0x18], 0x40485964
mov byte [ebp - 0x14], bl
xor dl, byte [ebp + ecx - 0x1f]
mov byte [ebp + ecx - 0x1f], dl
inc ecx
cmp ecx, 0xb
jae 0x1002a660
mov dl, byte [ebp - 0x20]
jmp 0x1002a64d
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x14], bl
push eax
lea ecx, [ebp - 0x50]
call fcn.100040a5
mov dword [ebp - 4], edi
lea edx, [ebp - 0x50]
mov ecx, dword [esi + 0x64]
call fcn.1000b86a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
push ebx
push edi
call fcn.10003f51
mov ecx, dword [esi + 0x64]
call fcn.1000b49f
call dword [0x10046198]
mov ecx, dword [esi + 0x34]
call fcn.1000b1c3
test al, al
je 0x1002a6af
mov ecx, dword [esi + 0x34]
xor dl, dl
call fcn.1000b082
mov ecx, esi
call fcn.1002ad4b
mov ecx, esi
call fcn.1002c18b
call fcn.1002c5ef
mov ecx, dword [esi + 0x1a8]
call fcn.1000b1c3
test al, al
je 0x1002a6de
mov ecx, dword [esi + 0x1a8]
xor dl, dl
call fcn.1000b082
call fcn.10039028
ret
Function at 0x1002c257
Capabilities:
Encode data using xor

Disassembly:
push 0xa0
mov eax, 0x1003be9b
call fcn.1003905f
mov esi, ecx
call fcn.1002bdf6
xor ebx, ebx
cmp al, 6
jne 0x1002c310
movaps xmm0, xmmword [0x10047590]
mov edx, ebx
movups xmmword [ebp - 0x48], xmm0
mov cl, byte [ebp - 0x48]
xor byte [ebp + edx - 0x47], cl
inc edx
cmp edx, 0xe
jb 0x1002c284
lea eax, [ebp - 0x47]
mov byte [ebp - 0x39], bl
push eax
lea ecx, [ebp - 0x7c]
call fcn.100040a5
mov dword [ebp - 4], ebx
mov edx, ebx
movaps xmm0, xmmword [0x10047f90]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x14434e4a
mov word [ebp - 0x10], 0x1b
mov cl, byte [ebp - 0x24]
xor byte [ebp + edx - 0x23], cl
inc edx
cmp edx, 0x14
jb 0x1002c2bd
lea eax, [ebp - 0x23]
mov byte [ebp - 0xf], bl
push eax
lea ecx, [ebp - 0x64]
call fcn.100040a5
push ebx
push ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x7c]
and dword [esp], 0
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x64]
push eax
push eax
call dword [0x10046194]
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.10003f51
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.10003f51
jmp 0x1002c3e3
push 6
mov edi, ebx
lea eax, [esi + 0x110]
pop ecx
cmp dword [eax - 4], ebx
jbe 0x1002c327
cmp dword [eax], ebx
jbe 0x1002c327
add edi, dword [eax + 4]
add eax, 0x14
sub ecx, 1
jne 0x1002c31b
mov ecx, dword [esi + 0x34]
call fcn.1000b1c3
test al, al
je 0x1002c345
mov ecx, dword [esi + 0x34]
xor dl, dl
call fcn.1000b082
push ecx
mov edx, edi
lea ecx, [ebp - 0xac]
call fcn.10009524
pop ecx
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x1002c363
mov eax, dword [eax]
movaps xmm0, xmmword [0x10047f20]
mov edx, ebx
push eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x1c4a4f
mov cl, byte [ebp - 0x38]
xor byte [ebp + edx - 0x37], cl
inc edx
cmp edx, 0x12
jb 0x1002c378
sub esp, 0x18
mov byte [ebp - 0x25], bl
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.100040a5
lea eax, [ebp - 0x94]
push eax
call fcn.10003b8a
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x100]
call fcn.1000b8e3
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.10003f51
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
push ebx
push 1
call fcn.10003f51
mov ecx, dword [esi + 0xfc]
mov dl, 1
call fcn.1000b082
call fcn.10039028
ret
Function at 0x1002f7ff
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], 0xd170163
mov esi, ecx
mov dword [ebp - 0x14], 0xc11073c
mov cl, 0x63
mov word [ebp - 0x10], 0x13
mov edx, ebx
xor cl, byte [ebp + edx - 0x17]
mov byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 8
jae 0x1002f836
mov cl, byte [ebp - 0x18]
jmp 0x1002f823
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, dword [esi]
call fcn.1000ae52
movaps xmm0, xmmword [0x10047bb0]
add esp, 0x18
mov dword [esi + 0x10], eax
mov edx, ebx
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 0xc], bl
mov cl, byte [ebp - 0x1c]
xor byte [ebp + edx - 0x1b], cl
inc edx
cmp edx, 0xf
jb 0x1002f864
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, dword [esi]
call fcn.1000ae52
movaps xmm0, xmmword [0x10047f10]
add esp, 0x18
mov dword [esi + 0x14], eax
mov edx, ebx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x6e686a79
mov byte [ebp - 0xc], bl
mov cl, byte [ebp - 0x20]
xor byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0x13
jb 0x1002f8a6
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, dword [esi]
call fcn.1000ae52
add esp, 0x18
mov dword [esi + 4], eax
mov dl, 0x4c
mov dword [ebp - 0x1c], 0x22382e4c
mov dword [ebp - 0x18], 0x22392a13
mov ecx, ebx
mov dword [ebp - 0x14], 0x3f2d202f
mov word [ebp - 0x10], 0x3f
xor dl, byte [ebp + ecx - 0x1b]
mov byte [ebp + ecx - 0x1b], dl
inc ecx
cmp ecx, 0xc
jae 0x1002f903
mov dl, byte [ebp - 0x1c]
jmp 0x1002f8f0
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, dword [esi]
call fcn.1000ae52
mov dword [esi + 8], eax
add esp, 0x18
mov cl, 0x1b
mov dword [ebp - 0x18], 0x756f791b
mov dword [ebp - 0x14], 0x6f747744
mov eax, ebx
mov dword [ebp - 0x10], 0x62697e6f
mov byte [ebp - 0xc], bl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xb
jae 0x1002f94c
mov cl, byte [ebp - 0x18]
jmp 0x1002f93d
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.100040a5
mov ecx, dword [esi]
call fcn.1000ae52
mov ecx, dword [0x100500a8]
add esp, 0x18
mov dword [esi + 0xc], eax
test ecx, ecx
je 0x1002f992
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x1002f992
mov ecx, dword [ecx]
call fcn.1000af9e
mov ecx, dword [esi]
add edx, 0xf5
push 5
call fcn.1000b039
pop ecx
mov ecx, dword [esi]
push 0x14
pop edx
call fcn.1000b1a0
mov ecx, dword [esi]
mov dl, 1
call fcn.1000b082
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1002f9b3
xor dl, dl
call fcn.1000b082
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002f9c1
xor dl, dl
call fcn.1000b082
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1002f9cf
xor dl, dl
call fcn.1000b082
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030bd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
mov dword [0x10075670], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x1007566c], ecx
push edi
push ecx
mov dword [0x10075668], eax
mov dword [0x10075674], ecx
mov dword [0x10075678], eax
mov dword [0x1007567c], ecx
mov dword [0x10075680], ecx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov edi, eax
mov esi, edx
mov eax, 0x55555555
mov dword [0x10075690], edi
xor ebx, ebx
mov dword [0x10076a10], eax
pop ecx
mov dword [0x10076a14], eax
inc ebx
mov dword [0x10075694], esi
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.10039360
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, 0x138
mov dword [ebx*8 + 0x10075690], edi
adc esi, edx
mov dword [ebx*8 + 0x10075694], esi
inc ebx
cmp ebx, eax
jl 0x10030c30
movaps xmm0, xmmword [0x10047d20]
pop edi
pop esi
mov dword [0x10075688], eax
mov eax, 0x10075668
movups xmmword [0x10076a18], xmm0
pop ebx
ret 0x10

Function at 0x10034be9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x10034c32
cmp word [edx], cx
je 0x10034c32
push ecx
lea eax, [ebp - 8]
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10034c57
mov eax, dword [ebp - 8]
xor ecx, ecx
push dword [ebp + 0x14]
push ebx
push 1
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
mov edi, eax
test ecx, ecx
je 0x10034c55
cmp ecx, esi
je 0x10034c55
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037f95
mov esp, ebp
pop ebp
ret

Function at 0x10034e7d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, str._pipediscord_ipc_0
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0x10034ee9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10034ecf
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x10034f18
inc ax
mov word [ebp - 0xa], ax
jmp 0x10034ee9
cmp eax, 0xe7
jne 0x10034f18
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x10034f18
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x10034eb2
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037f95
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x10034f07