joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102e0132
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x102e017c
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x102e0123
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x102e0132
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x106e5dd5
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x102e0183
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.102c6ff9
cmp eax, dword [ebp + 0xc]
pop eax
je 0x102e0222
add edi, 4
add eax, 2
dec ecx
jne 0x102e0168
call 0x102e01cf
loope 0x102e01c5
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x102e021f
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x102e0230
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x102e01e3
cmp eax, ecx
ja 0x102e01e3
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x102e026d
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x102e0263
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.102c74d8
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5ec44dc9
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x16256dea
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1006b5e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1006b780
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1006b6a4
cmp dword [ebp - 4], 0x50000000
jb 0x1006b621
cmp dword [ebp - 4], 0x80000000
ja 0x1006b621
mov dword [ebp - 4], 0x4fff0000
jmp 0x1006b5fa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10075b70
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1006b647
jmp 0x1006b6a4
cmp dword [ebp - 0x14], 0x10000
jne 0x1006b68a
cmp dword [ebp - 0x18], 0x10000
jb 0x1006b68a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1006b67d
mov eax, dword [ebp - 8]
jmp 0x1006b6a6
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1006b69f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1006b780
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1006b5fa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1006b6b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1006b7b0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1006b76c
cmp dword [ebp - 4], 0x50000000
jb 0x1006b6ec
cmp dword [ebp - 4], 0x80000000
ja 0x1006b6ec
mov dword [ebp - 4], 0x80010000
jmp 0x1006b6c5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10075b70
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1006b712
jmp 0x1006b76c
cmp dword [ebp - 0x14], 0x10000
jne 0x1006b755
cmp dword [ebp - 0x18], 0x10000
jb 0x1006b755
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1006b748
mov eax, dword [ebp - 8]
jmp 0x1006b76e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1006b767
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1006b7b0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1006b6c5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1006bee0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x1006bef5
xor eax, eax
jmp 0x1006bf6a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x1006bf22
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x1006bf65
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x1006bf63
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x1006bf5f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x1006bf63
xor eax, eax
jmp 0x1006bf6a
jmp 0x1006bf19
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1006c130
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101de6c8]
mov dword [ebp - 4], eax
jmp 0x1006c149
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1006c166
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1006c140
mov esp, ebp
pop ebp
ret
Function at 0x1006c5b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101de6d8], eax
je 0x1006c5ce
mov eax, 0x10dd
jmp 0x1006c6af
mov eax, dword [0x101de6e8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006c64c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1006c62a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1006c62a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1006bc50
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1006da49
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1006c5d6
mov dword [0x101de6e8], 0
call fcn.1006bf70
mov ecx, dword [0x101de6e4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1006c699
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1006da49
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1006c664
mov dword [0x101de6e4], 0
mov dword [0x101de6d8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1006cba0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101de6dc], 0
je 0x1006cbb9
mov eax, dword [0x101de6dc]
jmp 0x1006cc59
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1006cbcb
xor eax, eax
jmp 0x1006cc59
push 8
call fcn.1006db88
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1006cc21
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1006cc0a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1006da49
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x101de6dc], eax
mov dword [0x101de6e0], 0
mov eax, dword [ebp - 8]
jmp 0x1006cc59
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1006cc3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1006cbeb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x101de6e4]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x101de6e4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1008264e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1007c6b7
mov dword [ebp - 0x14], eax
cmp dword [0x101df438], edi
jne 0x1008273f
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x100826cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1008281f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1008281f
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008281f
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x101df438], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x101df43c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x101df440], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101df448], eax
test eax, eax
je 0x1008273c
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101df444], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10082764
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10082757
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10082779
push 4
pop eax
jmp 0x10082821
cmp dword [ebp - 0x14], edi
je 0x10082779
push dword [0x101df438]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1008275e
mov eax, dword [0x101df444]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x100827d7
cmp dword [0x101df448], esi
je 0x100827d7
push eax
call ebx
push dword [0x101df448]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100827d7
test eax, eax
je 0x100827d7
call ecx
test eax, eax
je 0x100827cc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100827cc
test byte [ebp - 8], 1
jne 0x100827d7
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10082807
mov eax, dword [0x101df43c]
cmp eax, esi
je 0x10082804
push eax
call ebx
test eax, eax
je 0x10082804
call eax
mov edi, eax
test edi, edi
je 0x10082804
mov eax, dword [0x101df440]
cmp eax, esi
je 0x10082804
push eax
call ebx
test eax, eax
je 0x10082804
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x101df438]
call ebx
test eax, eax
je 0x1008281f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10082821
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006d500
leave
ret
Function at 0x100878a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0x101a12f0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.1006d5e8
add esp, 0xc
test eax, eax
je 0x100878e7
xor al, al
jmp 0x10087968
mov eax, dword [ebp + 0x10]
push eax
call fcn.1006d62d
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1008790c
mov ecx, dword [ebp - 8]
push ecx
call fcn.1006d72b
add esp, 4
xor al, al
jmp 0x10087968
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.1006d965
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10087941
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.10087970
jmp 0x1008790c
mov edx, dword [ebp - 4]
push edx
call fcn.1006da11
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.1006d72b
add esp, 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
xor edx, 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10087a30
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0x4c11db7
mov dword [ebp - 4], 0
jmp 0x10087a52
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xff
jg 0x10087aec
push 8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
call fcn.100879d0
shl eax, 0x18
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0xc], 0
jmp 0x10087a8b
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x10087aca
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
and edx, 0x80000000
je 0x10087aaa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x10087ab1
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4]
shl eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x10087a82
push 0x20
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
push edx
mov ecx, dword [ebp - 8]
call fcn.100879d0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x10087a49
mov esp, ebp
pop ebp
ret
Function at 0x10089cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.1007fca0
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1020], ecx
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.10075b70
add esp, 0xc
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1018], 0
jmp 0x10089d1f
mov ecx, dword [ebp - 0x1018]
add ecx, 1
mov dword [ebp - 0x1018], ecx
cmp dword [ebp - 0x1018], 0xa
jge 0x10089dd6
mov edx, dword [ebp - 0x1018]
imul edx, edx, 0x16
add edx, dword [ebp - 0x1020]
mov dword [ebp - 0x1010], edx
mov eax, dword [ebp - 0x1010]
add eax, 1
mov dword [ebp - 0x102c], eax
mov ecx, dword [ebp - 0x1010]
mov dl, byte [ecx]
mov byte [ebp - 0x1009], dl
add dword [ebp - 0x1010], 1
cmp byte [ebp - 0x1009], 0
jne 0x10089d50
mov eax, dword [ebp - 0x1010]
sub eax, dword [ebp - 0x102c]
mov dword [ebp - 0x1024], eax
je 0x10089dd1
mov ecx, dword [ebp - 0x1018]
imul ecx, ecx, 0x16
add ecx, dword [ebp - 0x1020]
mov edx, dword [ebp - 0x1014]
lea eax, [ebp + edx - 0x1004]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov cx, word [ecx + 0x14]
mov word [eax + 0x14], cx
mov edx, dword [ebp - 0x1014]
add edx, 0x16
mov dword [ebp - 0x1014], edx
jmp 0x10089d10
mov dword [ebp - 0x1008], 0
jmp 0x10089df1
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1014]
jge 0x10089e6f
mov edx, dword [ebp - 0x1008]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
xor eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
mov edx, dword [ebp - 0x1008]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
sub eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
jmp 0x10089de2
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x101c], 0xffffffff
jne 0x10089e99
jmp 0x10089ee7
mov dword [ebp - 0x1028], 0
push 0
lea eax, [ebp - 0x1028]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
lea edx, [ebp - 0x1004]
push edx
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10089eda
mov ecx, dword [ebp - 0x101c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10089ee7
mov edx, dword [ebp - 0x101c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d500
mov esp, ebp
pop ebp
ret 4
Function at 0x10089f00
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call fcn.1007fca0
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1024], ecx
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.10075b70
add esp, 0xc
push 0x1000
push 0
lea ecx, [ebp - 0x1004]
push ecx
call fcn.10075b70
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x1018], 0xffffffff
jne 0x10089f7d
jmp 0x1008a173
push 0
mov eax, dword [ebp - 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1020], eax
mov dword [ebp - 0x102c], 0
push 0
lea ecx, [ebp - 0x102c]
push ecx
mov edx, dword [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1018]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10089fd6
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1008a173
mov dword [ebp - 0x1008], 0
jmp 0x10089ff1
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1020]
jge 0x1008a06f
mov edx, dword [ebp - 0x1008]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
add eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
mov edx, dword [ebp - 0x1008]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
xor eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
jmp 0x10089fe2
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp - 0x1020]
xor edx, edx
mov ecx, 0x16
div ecx
mov dword [ebp - 0x1034], eax
mov dword [ebp - 0x100c], 0
jmp 0x1008a0b8
mov edx, dword [ebp - 0x100c]
add edx, 1
mov dword [ebp - 0x100c], edx
cmp dword [ebp - 0x100c], 0xa
jge 0x1008a173
mov eax, dword [ebp - 0x100c]
imul eax, eax, 0x16
add eax, dword [ebp - 0x101c]
mov dword [ebp - 0x1014], eax
mov ecx, dword [ebp - 0x1014]
add ecx, 1
mov dword [ebp - 0x1028], ecx
mov edx, dword [ebp - 0x1014]
mov al, byte [edx]
mov byte [ebp - 0x100d], al
add dword [ebp - 0x1014], 1
cmp byte [ebp - 0x100d], 0
jne 0x1008a0e9
mov ecx, dword [ebp - 0x1014]
sub ecx, dword [ebp - 0x1028]
mov dword [ebp - 0x1030], ecx
je 0x1008a136
mov edx, dword [ebp - 0x1024]
mov eax, dword [edx + 0xec]
add eax, 1
mov ecx, dword [ebp - 0x1024]
mov dword [ecx + 0xec], eax
mov edx, dword [ebp - 0x100c]
imul edx, edx, 0x16
mov eax, dword [ebp - 0x101c]
lea ecx, [eax + edx + 0xb]
push ecx
mov edx, dword [ebp - 0x100c]
imul edx, edx, 0x16
add edx, dword [ebp - 0x101c]
push edx
mov ecx, dword [ebp - 0x100c]
imul ecx, ecx, 0x16
add ecx, dword [ebp - 0x1024]
call fcn.10001d90
jmp 0x1008a0a9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d500
mov esp, ebp
pop ebp
ret 4
Function at 0x10096950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
push str.discord_rpc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x101df648], eax
cmp dword [0x101df648], 0
je 0x100969a7
call fcn.100969e0
movzx ecx, al
test ecx, ecx
je 0x100969a7
mov ecx, dword [ebp - 4]
call fcn.10096910
push 0
push 0
push 0
push 0x10096420
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov byte [edx + 8], 1
mov esp, ebp
pop ebp
ret