joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x103085c0], 0
push ebx
push esi
je 0x100650a7
cmp byte [0x103085c1], 0
jne 0x100650f5
mov byte [0x103085c1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1030860c]
xor ebx, dword [0x10308608]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103085c2]
xor al, bl
mov byte [esi + 0x103085c2], al
inc esi
cmp esi, 0x43
jb 0x10065060
jmp 0x100650f5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1030860c]
xor ebx, dword [0x10308608]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103085c2]
xor al, bl
mov byte [esi + 0x103085c2], al
inc esi
cmp esi, 0x43
jb 0x100650b0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10308604
push 0x103085c2
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10308610], 0
push ebx
push esi
je 0x10065197
cmp byte [0x10308611], 0
jne 0x100651e5
mov byte [0x10308611], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308654]
xor ebx, dword [0x10308650]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308612]
xor al, bl
mov byte [esi + 0x10308612], al
inc esi
cmp esi, 0x3b
jb 0x10065150
jmp 0x100651e5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308654]
xor ebx, dword [0x10308650]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308612]
xor al, bl
mov byte [esi + 0x10308612], al
inc esi
cmp esi, 0x3b
jb 0x100651a0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1030864c
push 0x10308612
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x103086d8], 0
push ebx
push esi
je 0x10065287
cmp byte [0x103086d9], 0
jne 0x100652d5
mov byte [0x103086d9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1030872c]
xor ebx, dword [0x10308728]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103086da]
xor al, bl
mov byte [esi + 0x103086da], al
inc esi
cmp esi, 0x4d
jb 0x10065240
jmp 0x100652d5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1030872c]
xor ebx, dword [0x10308728]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103086da]
xor al, bl
mov byte [esi + 0x103086da], al
inc esi
cmp esi, 0x4d
jb 0x10065290
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10308726
push 0x103086da
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10308760], 0
push ebx
push esi
je 0x10065377
cmp byte [0x10308761], 0
jne 0x100653c5
mov byte [0x10308761], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1030877c]
xor ebx, dword [0x10308778]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308762]
xor al, bl
mov byte [esi + 0x10308762], al
inc esi
cmp esi, 0xf
jb 0x10065330
jmp 0x100653c5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1030877c]
xor ebx, dword [0x10308778]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308762]
xor al, bl
mov byte [esi + 0x10308762], al
inc esi
cmp esi, 0xf
jb 0x10065380
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10308770
push 0x10308762
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100653f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10308998], 0
push ebx
push esi
je 0x10065467
cmp byte [0x10308999], 0
jne 0x100654b5
mov byte [0x10308999], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103089f4]
xor ebx, dword [0x103089f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1030899a]
xor al, bl
mov byte [esi + 0x1030899a], al
inc esi
cmp esi, 0x50
jb 0x10065420
jmp 0x100654b5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103089f4]
xor ebx, dword [0x103089f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1030899a]
xor al, bl
mov byte [esi + 0x1030899a], al
inc esi
cmp esi, 0x50
jb 0x10065470
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x103089e9
push 0x1030899a
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100654e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10308af0], 0
push ebx
push esi
je 0x10065557
cmp byte [0x10308af1], 0
jne 0x100655a5
mov byte [0x10308af1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308b3c]
xor ebx, dword [0x10308b38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308af2]
xor al, bl
mov byte [esi + 0x10308af2], al
inc esi
cmp esi, 0x42
jb 0x10065510
jmp 0x100655a5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308b3c]
xor ebx, dword [0x10308b38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308af2]
xor al, bl
mov byte [esi + 0x10308af2], al
inc esi
cmp esi, 0x42
jb 0x10065560
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10308b33
push 0x10308af2
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100655d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10308bc0], 0
push ebx
push esi
je 0x10065647
cmp byte [0x10308bc1], 0
jne 0x10065695
mov byte [0x10308bc1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308c14]
xor ebx, dword [0x10308c10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308bc2]
xor al, bl
mov byte [esi + 0x10308bc2], al
inc esi
cmp esi, 0x49
jb 0x10065600
jmp 0x10065695
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308c14]
xor ebx, dword [0x10308c10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308bc2]
xor al, bl
mov byte [esi + 0x10308bc2], al
inc esi
cmp esi, 0x49
jb 0x10065650
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10308c0a
push 0x10308bc2
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100656c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10308ce8], 0
push ebx
push esi
je 0x10065737
cmp byte [0x10308ce9], 0
jne 0x10065785
mov byte [0x10308ce9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308d3c]
xor ebx, dword [0x10308d38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308cea]
xor al, bl
mov byte [esi + 0x10308cea], al
inc esi
cmp esi, 0x4a
jb 0x100656f0
jmp 0x10065785
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308d3c]
xor ebx, dword [0x10308d38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308cea]
xor al, bl
mov byte [esi + 0x10308cea], al
inc esi
cmp esi, 0x4a
jb 0x10065740
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10308d33
push 0x10308cea
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100657b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10308e30], 0
push ebx
push esi
je 0x10065827
cmp byte [0x10308e31], 0
jne 0x10065875
mov byte [0x10308e31], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308e7c]
xor ebx, dword [0x10308e78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308e32]
xor al, bl
mov byte [esi + 0x10308e32], al
inc esi
cmp esi, 0x45
jb 0x100657e0
jmp 0x10065875
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308e7c]
xor ebx, dword [0x10308e78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308e32]
xor al, bl
mov byte [esi + 0x10308e32], al
inc esi
cmp esi, 0x45
jb 0x10065830
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10308e76
push 0x10308e32
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100658a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10307d68], 0
push ebx
push esi
je 0x1006591a
cmp byte [0x10307d69], 0
jne 0x10065968
mov byte [0x10307d69], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10307eac]
xor ebx, dword [0x10307ea8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10307d6a]
xor al, bl
mov byte [esi + 0x10307d6a], al
inc esi
cmp esi, 0x137
jb 0x100658d0
jmp 0x10065968
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10307eac]
xor ebx, dword [0x10307ea8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10307d6a]
xor al, bl
mov byte [esi + 0x10307d6a], al
inc esi
cmp esi, 0x137
jb 0x10065920
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10307ea0
push 0x10307d6a
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10308f30], 0
push ebx
push esi
je 0x10065a07
cmp byte [0x10308f31], 0
jne 0x10065a55
mov byte [0x10308f31], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308f74]
xor ebx, dword [0x10308f70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308f32]
xor al, bl
mov byte [esi + 0x10308f32], al
inc esi
cmp esi, 0x3a
jb 0x100659c0
jmp 0x10065a55
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10308f74]
xor ebx, dword [0x10308f70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10308f32]
xor al, bl
mov byte [esi + 0x10308f32], al
inc esi
cmp esi, 0x3a
jb 0x10065a10
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10308f6b
push 0x10308f32
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10307b48], 0
push ebx
push esi
je 0x10065af7
cmp byte [0x10307b49], 0
jne 0x10065b45
mov byte [0x10307b49], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10307b64]
xor ebx, dword [0x10307b60]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10307b4a]
xor al, bl
mov byte [esi + 0x10307b4a], al
inc esi
cmp esi, 0x10
jb 0x10065ab0
jmp 0x10065b45
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10307b64]
xor ebx, dword [0x10307b60]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10307b4a]
xor al, bl
mov byte [esi + 0x10307b4a], al
inc esi
cmp esi, 0x10
jb 0x10065b00
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10307b59
push 0x10307b4a
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10307b68], 0
push ebx
push esi
je 0x10065be7
cmp byte [0x10307b69], 0
jne 0x10065c35
mov byte [0x10307b69], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10307b7c]
xor ebx, dword [0x10307b78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10307b6a]
xor al, bl
mov byte [esi + 0x10307b6a], al
inc esi
cmp esi, 0xc
jb 0x10065ba0
jmp 0x10065c35
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10307b7c]
xor ebx, dword [0x10307b78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10307b6a]
xor al, bl
mov byte [esi + 0x10307b6a], al
inc esi
cmp esi, 0xc
jb 0x10065bf0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10307b75
push 0x10307b6a
call fcn.1004d5e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10069670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x103250c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1030a3e8], 0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
je 0x100696f2
cmp byte [0x1030a3e9], 0
jne 0x10069736
mov byte [0x1030a3e9], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1030a404]
xor ebx, dword [0x1030a400]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1030a3ea], al
inc esi
cmp esi, 0x10
jb 0x100696b1
jmp 0x10069733
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1030a404]
xor ebx, dword [0x1030a400]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1030a3ea], al
inc esi
cmp esi, 0x10
jb 0x100696f4
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x1d]
push eax
push 0x1030a3f9
push 0x1030a3ea
lea ecx, [ebp - 0x1c]
call fcn.1004d5e0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov esi, eax
cmp ecx, 0xf
jbe 0x10069799
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006978f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006978f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1010f64a
add esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
test esi, esi
jne 0x100697b3
mov dword [edi], esi
jmp 0x100697bd
push 0
push ebx
call esi
add esp, 8
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010f972
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006f130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x103250c0]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x1017cf88]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x1017cf8c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x1017cf70]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x1017cf80]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x1006f200
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x1006f1c9
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x1006f216
inc ax
mov word [ebp - 0xa], ax
jmp 0x1006f1df
cmp eax, 0xe7
jne 0x1006f216
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x1006f216
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1006f1b0
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010f972
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010f972
mov esp, ebp
pop ebp
ret
Function at 0x1006f700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x103250c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [ebp - 0xa90]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1006f774
push str.Error_opening_Steam_key_n
jmp 0x1006f834
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1006f82f
mov ecx, dword [ebp - 0xa94]
cmp ecx, 1
jb 0x1006f82f
shr ecx, 1
mov eax, esi
je 0x1006f7e8
lea edx, [esi + 0x5c]
nop word [eax + eax]
cmp word [ebp + eax*2 - 0x28c], 0x2f
jne 0x1006f7e3
mov word [ebp + eax*2 - 0x28c], dx
inc eax
cmp eax, ecx
jb 0x1006f7d0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push str.__s__steam:__rungameid__s
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.1006f610
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1006f320
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010f972
mov esp, ebp
pop ebp
ret
push str.Error_reading_SteamExe_key_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.1006f860
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.1010f972
mov esp, ebp
pop ebp
ret
Function at 0x10071150
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x1017fd8c
push 0x64
call fcn.1011019f
mov esi, eax
add esp, 8
test esi, esi
je 0x100712f3
push 0x64
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov byte [esi], 1
lea eax, [esi + 0x34]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
push eax
movq qword [esi + 0x20], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 4], 2
mov dword [esi + 0x30], 0
call sub.MSVCP140.dll__Cnd_init_in_situ
xorps xmm0, xmm0
mov dword [0x1034c53c], esi
add esp, 0x10
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x100711f6
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100711eb
cmp byte [eax], 0
je 0x100711eb
push eax
push esi
call fcn.1006f700
jmp 0x100711f3
push 0
push esi
call fcn.1006f680
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x1030c760
mov dword [0x1034c538], eax
call sub.MSVCP140.dll__Mtx_lock
add esp, 4
test eax, eax
jne 0x10071302
cmp dword [0x1030c78c], 0x7fffffff
je 0x10071309
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1007123d
movups xmm0, xmmword [eax]
movups xmmword [0x10347ee8], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x10071247
xorps xmm0, xmm0
movups xmmword [0x10347ee8], xmm0
movq qword [0x10347ef8], xmm0
xorps xmm0, xmm0
push 0x1030c760
movups xmmword [0x10347f00], xmm0
movq qword [0x10347f10], xmm0
call sub.MSVCP140.dll__Mtx_unlock
add esp, 4
cmp dword [0x10347ee4], 0
jne 0x100712fd
push esi
call fcn.10072650
mov dword [0x10347ee4], eax
mov dword [eax + 8], 0x1006f890
mov eax, dword [0x10347ee4]
mov dword [eax + 0xc], 0x1006f8b0
mov al, 1
mov esi, dword [0x1034c53c]
xchg byte [esi], al
push 4
call fcn.1010f61a
add esp, 8
test eax, eax
je 0x100712b5
mov dword [eax], esi
jmp 0x100712b7
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1006f900
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1007131a
cmp dword [esi + 0x60], 0
je 0x100712e5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x1034c53c], 0
pop esi
mov esp, ebp
pop ebp
ret
push 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 6
mov dword [0x1030c78c], 0x7ffffffe
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3