joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011c70
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180011ca0
xor eax, eax
jmp 0x180011d63
mov rbp, rbx
cmp word [rax], si
je 0x180011cc5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180011cac
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180011ca8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180011b90
movsxd r14, eax
test eax, eax
jne 0x180011d03
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180011c99
mov rcx, r14
call fcn.18000cbcc
mov rdi, rax
test rax, rax
jne 0x180011d1c
xor ecx, ecx
call fcn.18000d544
jmp 0x180011cf8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180011b90
test eax, eax
jne 0x180011d4d
mov rcx, rdi
call fcn.18000d544
jmp 0x180011d57
xor ecx, ecx
call fcn.18000d544
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400293ac
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ca74
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ca74
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400294fc
cmp rax, 0xffffffffffffffff
je 0x1400294fc
xor edi, edi
test rbp, rbp
jle 0x1400294a7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f3a0
mov rbx, rax
test rax, rax
jne 0x140029434
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002949d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a3a8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d750
cmp eax, 0xffffffff
je 0x14002947d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029444
mov edx, r15d
mov ecx, r14d
call fcn.14001a3a8
jmp 0x14002949d
cmp byte [rsi + 0x38], dil
je 0x140029494
cmp dword [rsi + 0x34], 5
jne 0x140029494
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002949d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b13c
jmp 0x140029510
jns 0x140029510
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ca74
cmp rax, 0xffffffffffffffff
jne 0x1400294c8
cmp byte [rsi + 0x30], dil
je 0x140029510
mov edi, dword [rsi + 0x2c]
jmp 0x140029510
mov ecx, r14d
call fcn.140018864
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029510
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029510
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029509
mov eax, dword [rsi + 0x2c]
jmp 0x14002950e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ca74
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14006bd00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1401743c8]
test rax, rax
je 0x14006bd4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006bd4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006bd4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006bd4a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006bd4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006bd4c
xor al, al
add rsp, 0x28
ret
Function at 0x140012f90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140012fc9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400130b8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140013060
cmp qword [rsp + 0x20], 0
jle 0x140013060
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140013009
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.14000a540
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x1400130a8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x1400130a8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x1400130c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14028c080]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x1400130f4
xor eax, eax
jmp 0x1400132f1
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140013126
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400132f1
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x1400131d8
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000a4f0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.14000a540
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x1400132e1
mov rcx, qword [rsp + 0x80]
call fcn.140015e20
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14001328e
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140013289
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x1400132f1
jmp 0x140013204
cmp qword [rsp + 0x50], 0
jbe 0x1400132e1
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140179cd0
add rsp, 0x78
ret
Function at 0x140015ee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14028c080]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x140015f1d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140015f24
mov al, 1
jmp 0x14001607c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140018510
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140018510
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.140018570
movzx eax, al
test eax, eax
je 0x140015f79
xor al, al
jmp 0x14001607c
mov qword [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140015fe9
cmp dword [rsp + 0x30], 1
je 0x140015ff5
cmp dword [rsp + 0x30], 3
je 0x14001606a
jmp 0x14001607a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140016041
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140016041
xor al, al
jmp 0x14001607c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001605b
mov dword [rsp + 0x34], 1
jmp 0x140016063
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14001607c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001607c
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140179cd0
add rsp, 0xa8
ret
Function at 0x1400280a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x14028c080]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x58]
lea rcx, str._pipediscord_ipc_0
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WLDAP32.dll_Ordinal_46
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x50], reloc.WS2_32.dll_setsockopt
mov eax, 2
imul rax, rax, 0x15
mov ecx, Ordinal_50
mov word [rsp + rax + 0x58], cx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x48]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x140028152
mov rax, qword [rsp + 0x48]
mov byte [rax], 1
mov al, 1
jmp 0x1400281cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 2
jne 0x14002819c
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x58]
cmp eax, 0x39
jge 0x14002819a
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x58]
inc ax
mov ecx, 2
imul rcx, rcx, 0x15
mov word [rsp + rcx + 0x58], ax
jmp 0x140028102
jmp 0x1400281c3
cmp dword [rsp + 0x40], 0xe7
jne 0x1400281c3
mov edx, 0x2710
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x1400281be
xor al, al
jmp 0x1400281cc
jmp 0x140028102
xor al, al
jmp 0x1400281cc
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140179cd0
add rsp, 0x98
pop rdi
pop rsi
ret

Function at 0x140028230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14028c080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x70], 0
jne 0x140028261
mov al, 1
jmp 0x14002833e
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14002828f
mov r8d, reloc.WLDAP32.dll_Ordinal_79
lea rdx, [0x14019a3d0]
lea rcx, [0x14019a460]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
cmp qword [rsp + 0x38], 0
jne 0x14002829e
xor al, al
jmp 0x14002833e
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x1400282b1
xor al, al
jmp 0x14002833e
cmp qword [rsp + 0x68], 0
jne 0x1400282d5
mov r8d, 0x56
lea rdx, [0x14019a470]
lea rcx, [0x14019a500]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
cmp qword [rsp + 0x68], 0
jne 0x1400282e1
xor al, al
jmp 0x14002833e
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140028331
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x40], eax
jne 0x140028331
mov dword [rsp + 0x34], 1
jmp 0x140028339
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140179cd0
add rsp, 0x58
ret
Function at 0x140028350
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14028c080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x68], 0
jne 0x140028396
mov r8d, 0x62
lea rdx, [0x14019a510]
lea rcx, [0x14019a5a0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
cmp qword [rsp + 0x68], 0
jne 0x1400283a5
xor al, al
jmp 0x1400284bc
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400283d3
mov r8d, 0x67
lea rdx, [0x14019a5b0]
lea rcx, str.self
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
cmp qword [rsp + 0x38], 0
jne 0x1400283e2
xor al, al
jmp 0x1400284bc
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x1400283f5
xor al, al
jmp 0x1400284bc
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400284af
mov eax, dword [rsp + 0x40]
cmp rax, qword [rsp + 0x70]
jb 0x1400284ad
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x1400284a2
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x30], eax
je 0x14002849c
mov r8d, reloc.WS2_32.dll_WSACleanup
lea rdx, str.C:Usersd3oosyDesktopLS_HAX_NEWDiscordSDK_srcconnection_win.cpp
lea rcx, str.bytesToRead__bytesRead
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov al, 1
jmp 0x1400284bc
mov rcx, qword [rsp + 0x60]
call fcn.1400281f0
nop
jmp 0x1400284ba
mov rcx, qword [rsp + 0x60]
call fcn.1400281f0
nop
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140179cd0
add rsp, 0x58
ret
Function at 0x140028860
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14028c080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
cmp qword [rsp + 0x88], 0
je 0x140028924
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
movzx eax, word [rcx + rax]
test eax, eax
je 0x140028924
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14002891a
mov eax, dword [rsp + 0x50]
jmp 0x140028985
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x98]
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x60], 0
je 0x140028981
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x60], rax
je 0x140028981
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140179cd0
add rsp, 0x78
ret
Function at 0x140028dd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xaf8
mov rax, qword [0x14028c080]
xor rax, rsp
mov qword [rsp + 0xae0], rax
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0xb00]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0xb08]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140028ea2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
mov rcx, rax
call fcn.1400285f0
nop
jmp 0x140028fac
mov dword [rsp + 0x48], 0x208
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SteamExe
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rsp + 0x34], 0
jne 0x140028ef7
cmp dword [rsp + 0x48], 1
jae 0x140028f17
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.1400285f0
nop
jmp 0x140028fac
mov eax, dword [rsp + 0x48]
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0
jmp 0x140028f3d
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
jae 0x140028f6b
mov eax, dword [rsp + 0x30]
movzx eax, word [rsp + rax*2 + 0xd0]
cmp eax, 0x2f
jne 0x140028f69
mov eax, dword [rsp + 0x30]
mov ecx, 0x5c
mov word [rsp + rax*2 + 0xd0], cx
jmp 0x140028f33
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
lea r8, str.__s__steam:__rungameid__s
mov edx, 0x800
lea rcx, [rsp + 0x2e0]
call fcn.140028660
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x90]
call fcn.1400289a0
nop
mov rcx, qword [rsp + 0xae0]
xor rcx, rsp
call fcn.140179cd0
add rsp, 0xaf8
ret
Function at 0x14002c670
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14028c080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140009e00
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14002ca60
nop
lea rax, [0x14002cad0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140006260
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14002c714
lea rcx, [rsp + 0x40]
call fcn.14001d890
nop
jmp 0x14002c72c
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x40]
call fcn.14002c8c0
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140179cd0
add rsp, 0x58
ret

Function at 0x14002cdf0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x138
jne 0x14002ce13
mov rcx, qword [rsp + 0x40]
call fcn.14002cef0
nop
jmp 0x14002ce2b
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jb 0x14002ce2b
mov rcx, qword [rsp + 0x40]
call fcn.14002cfc0
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax*8 + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shr rax, 0x1d
mov rcx, qword [rsp + 0x40]
and rax, qword [rcx + 0x1388]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rax, rcx
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shl rax, 0x25
movabs rcx, 0xfff7eee000000000
and rax, rcx
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shr rax, 0x2b
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret